Hamre Orders DoD Web Security Review

 


 American Forces Press Service




 WASHINGTON -- Deputy Defense Secretary John Hamre directed a 

 security review Sept. 24 to ensure information on publicly 

 accessible DoD Internet sites does not compromise national 

 security or place personnel at risk.

 

 "The Internet World Wide Web provides the department with a 

 powerful tool to convey information quickly and efficiently on a 

 broad range of topics," Hamre said in a memorandum sent 

 departmentwide. "At the same time, … " he added, "such 

 information, especially when combined with information from 

 other sources, increases the vulnerability of DoD systems and 

 may endanger DoD personnel and their families."

 

 Hamre said he was concerned about the possibility of personal 

 and private information being posted to publicly accessible Web 

 sites, such as service members' Social Security numbers or home 

 addresses.

 

 The department uses the Internet in a variety of ways, including 

 contract administration, finance, electronic commerce and news 

 reporting. The activities won't change, he said, but more 

 attention will be given to the security implications of Web 

 technology. "Security and efficiency can be achieved at the same 

 time," he said.

 

 Hamre's order for the review includes the creation of a task 

 force to develop policy and procedures addressing operational, 

 public affairs, acquisition, technology, privacy, legal and 

 security issues associated with the use of DoD Web sites. The 

 group's preliminary guidance should be issued to the field by 

 late November, he said.

 

 Pending the task force guidance, and provided that essential 

 missions are unaffected, all DoD organizations have 60 days to 

 remove from their public Web sites: plans or lessons learned 

 that would reveal sensitive military operations, exercises or 

 vulnerabilities; information on sensitive troop movements; 

 personal data such as Social Security numbers, birth dates, home 

 addresses and home phone numbers; and any other identifying 

 information about family members of DoD employees and military 

 personnel.

 

 The Hamre order directs all DoD components to conduct a 

 comprehensive security assessment of all their Web sites within 

 three months of receiving the task force guidance, and conduct 

 annual reassessments thereafter. It orders a plan be implemented 

 by March 1999 that uses reserve component assets to conduct 

 operational security and threat assessments of DoD Web sites. It 

 also orders the development of a Web information security 

 training program by March 1999.

 

 "I believe that these steps will help us to better manage Web 

 information services to strike the appropriate balance between 

 openness and sound security," Hamre said. For more information 

 and discussion about department Web security issues, visit DoD's 

 home page at www.defenselink.mil and its special, Web security 

 pages at http://websecurity.afis.osd.mil.

 

 

 -END-