Surfing the Digital Beat

New York takes the security lead with the first state and municipal information-security officers.
By John Marcotte, NULL - January 28, 2001

It took New York state's freshly-minted Information Security Officer Laura Iwan just two months on the job before she felt the love. Unfortunately, it was the ILOVEYOU virus. "We have a discussion list for all ISOs [Information Security Officers] in state agencies. We routinely post things that we think are of interest that they should be aware of. As soon as we got word about the Love Bug, we broadcast the word out to the agencies -- but it was already too late," she said ruefully. Iwan, a lifetime civil servant with 12 years experience in information security, didn't single-handedly stop the Love Bug virus in its tracks. But her office provided a centralized source for the distribution of information, and after her baptism by fire she has plans to improve how the state handles the next security hole that crops up.

After the virus hit, Microsoft released a security patch for Outlook. "[Our agencies] were all in competition with the rest of the world trying to download these patches as soon as they became available," she said. The congestion delayed the implementation of the fix. Next time, Iwan plans to download a copy of the patch and distribute it via the statewide intranet. Information security officers are an old idea in the private sector, but New York is the first state to create the position.

"Security has always been a focus for the office, since we were a taskforce," said Will Pelgrin, executive deputy commissioner of the Office for Technology (OFT). "As we decided to move forward, we decided that a statewide approach with a statewide security officer made sense."

"Security is becoming a much higher priority," Tom Duffy, deputy director of administration of the OFT, said. "With Y2K behind us, we are starting to focus more on security, as I assume all public and private institutions should be doing."

One public institution that focused on security even earlier than the state is New York City. It has been more than a year since NYC created its own information security officer, a first for any major city.

»read more