Scott Olechowski

Security and Threat Research Manager

Cisco

http://www.cisco.com/go/security

Scott Olechowski and his team are focused on researching and unraveling complex Internet security threats and working with internal and external groups to coordinate strategic responses. Prior to this role, Scott managed business development for Cisco's Security Technology Business Unit (STBU) and focused on identifying and developing Cisco's security technology partnerships. Before these positions at Cisco, he was responsible for business development, product strategy and market delivery for email encryption company PostX (subsequently acquired by IronPort/Cisco). Olechowski also held senior management positions in product planning, marketing and development at actzero, nCognito and Legal Video Sync. He holds a B.S. in Marketing from DePaul University.

This month’s self-tending mushroom alert goes to the Department of Defense (DOD) thanks to a series of tweets from civil servants and uniformed officers outlining its somewhat bizarre approach to shortening URLs from long-winded official government domains to short .gov URLs and declaring a complete lack of consistency on internet use and social media policy. The DOD is guilty of initially banning social media altogether, then allowing usage without consistent parameters meanwhile procrastinating over implementation of a policy that would strike the right balance between connectivity and security. Since 2009, the Army has been using social media successfully to connect with 18-24-year-olds for recruiting purposes. As Suzanne Nagel, Army Accessions Command’s media and Web chief for Army advertising said in an American Forces Press Services article on defense.gov, “In essence, our philosophy is that we want to fish where the fish are.” However, balancing the pros of social networking for recruiting, public affairs and communication against the potential security risks, network vulnerability and bandwidth drain was always a concern. So, in February, 2010, a new policy, known as the “Responsible and Effective Use of Internet-based Capabilities” was implemented. Essentially, social media was allowed, but had to be used responsibly under the watchful eye of operations security staff and public affairs.  Military families were relieved to be able to use internet-based communications, especially when members of the family were deployed. But, there are still concerns about privacy and there may still be threats to national security because of the vulnerability of the vast number of networks, network connections and applications. During a brief spell of confusion in early 2011, there were fears that social media privileges would be revoked once more because there were no plans to extend the policy. However, the policy was renewed despite concerns that OPSEC training (for safe computer use) had not been updated to reinforce social media guidelines. The lessons from this Self Tending Mushroom Award are these. When crafting your digital access, take security into account. Balancing security with openness is anything but easy. There are times when openness is just not appropriate. Employees need to talk, so give them a forum. Lastly, autonomy is great but not to the detriment of consistent policy.