County working to enhance information security

Charles Warner Editor

September 6, 2013

UNION COUNTY — Signs, firewalls, encryption, oversight of unauthorized personnel in secure locations, and new policies and procedures are all part of Union County’s efforts to keep sensitive information safe online.

Diane Freeman, IT Security Coordinator for Union County, is currently working with several other county employees to update the “County of Union Information Security Policy” handbook. The new policies and procedures being developed will help county employees protect the county’s online information and the systems and methods of transmitting and storing them. They will also bring the county into compliance with federal security requirements.

“We have to have a security policy now that covers all aspects of our offices,” Freeman said Thursday. “It pertains to how information is stored on laptops, printouts, CDs, and thumbdrives. We’re also talking about where the sheriff’s office has Criminal Justice Information Services and FBI information. Each county has to be audited and we’re having to comply with the rules and regulations of the CJIS and FBI.

“For instance, we have to post all areas and keep visitors logs,” she said. “We’re having to put to policies in place to make sure virus protection is run on all equipment. We’re resetting all passwords to meet CJIS and FBI standards. We’re combining county and CJIS policies.”

Encryption is also an important part of the enhanced security.

“We have to make sure that encryption is used on all secured data,” Freeman said. “If you send any secure data, whether by email or thumbdrive or any means of transportation out of a secure location encryption is mandatory. The software we’ll use for this will ensure that the information being transported can only be read in a specific location. If you lose it, it cannot be read.”

Freeman said a major reason for the enhanced security is the 2012 hacking of the South Carolina Department of Revenue’s computer system. The hacker stole the Social Security numbers and other personal information of millions of South Carolinians. As a result this “major security breach,” Freeman said counties have been made more aware of the need to protect their data from hackers and other online threats. This awareness, along with the requirement of the CJIS and the FBI, is behind the efforts of Union County to improve its online security.

A crucial part of this security are the firewalls that Freeman said have to be constantly updated.

“The firewalls are to prevent hackers from getting in,” Freeman said. “We already have them in place, we’re updating them because every day you have new viruses, new programs that are trying to hack systems.”

The handbook states that firewalls “provide a point of defense and a controlled and audited access to servers, both from inside and outside the CJIS and Union County network.” The firewall checklist includes 16 steps personnel must take to ensure the firewalls are functioning properly.

Another step the county is taking to ensure the security of its information is increased supervision of unauthorized personnel who for whatever reason must be admitted to a secure area.

“What has happened is that anywhere there are communication lines, whether it be where your VPNs come in or your Internet comes in, those lines have to be protected,” Freeman said. “That means unauthorized personnel are not allowed in that are or, if they have to be there they have to be accompanied by authorized personnel.”

Freeman said this includes anyone from repairmen called in to fix a problem to the trustees who empty the trashcans.

“Where we have our servers or patch panels, those are marked for authorized personnel only,” Freeman said. “Authorized personnel have been through security training. Even if the electrician shows up, if he hasn’t been through security training he must be accompanied by authorized personnel who have.”

Freeman stressed that the county already had security systems in place. She said what the county is doing now is simply updating and strengthening its defenses against a constantly evolving threat.

“A lot of this we were already doing,” Freeman said. “There’s always new equipment coming out and so you need new regulations for that. Security is an ongoing process.”

Editor Charles Warner can be reached at 864-427-1234, ext. 14, or by email at cwarner@civitasmedia.com.