Official telework programs are not a security threat and do not hamper agencies’ ability to meet Federal Information Security Management Act (FISMA) mandates, according to a new survey of Federal Chief Information Security Officers (CISOs), whose primary tasks involve safeguarding agency networks and databases and recognizing and thwarting emerging vulnerabilities.
"Remote Control - Federal CISOs Dish on Mobility, Telework, and Data Security," a study conducted by Telework Exchange and sponsored by HP, determined that the vast majority (94 percent) of Federal CISOs believe official telework programs are secure.
Another 88 percent have direct input into their agency’s official telework infrastructure, giving further assurance that official teleworkers are equipped with appropriate and effective security measures. These measures include using multi-factor authentication on mobile devices, having remote data deletion for lost/stolen devices, and using a secure Virtual Private Network (VPN) for remote connection.
"Based on numerous study results, we find that while security is top of mind and should be top of mind for agencies, it should not hinder telework adoption," said Stephen W.T. O’Keeffe, executive director of Telework Exchange. "Now is the time to stop pointing the finger at telework as a culprit and instead embrace these programs as a standard operating practice."
Eric Brennan, director of PSG Solutions Marketing for HP, agreed. "This is further evidence that when agencies establish telework programs with proper security, support, and equipment, Federal employees can safely benefit from more work/life balance, freedom, and cost-savings from reduced commute times."
Thirty seven percent of CISOs note lack of data security training for all employees is the most serious data security threat. Federal CISOs are focused on secure operations for end-users outside of official agency telework programs. Often, "unofficial teleworkers", or those who work at home on nights and weekends, usually have not received in-depth security training and often lack appropriate data security tools and technologies. Past Telework Exchange research highlights a hidden majority of "unofficial teleworkers" as the data security Achilles heel.
For these reasons, 63 percent of Federal CISOs say that securing mobile devices now is their top data security priority. Their recommendations for addressing the challenge are as follows:
- Ensure that all employees, regardless of telework status, receive mobile data security training
- Audit and understand the full population of employees who work from locations other than their primary work site
- Ensure that all telework-eligible employees are working within an official telework program
- Encourage adoption of a FISMA-compliant mobile end-point certification
For more information or to view the study, please visit
www.teleworkexchange.com/cisostudy.
