Nice pic of the drill instructor from one of my favourite movies of all time Full Metal Jacket.

"The Ponemon Institute reports, 'IT operations and IT security professionals identified cloud computing, outsourcing of sensitive information to third parties, external threat of
organized cyber criminal syndicates, cyber terrorism, and a mobile workforce... '" ... "Is this a case of out-of-touch government bigwigs cracking down on the social web when black hat hackers are truly to blame?"

What do social media have to do with cloud computing and outsourcing of sensitive information? Nothing at all.

Cloud computing (which is one specific form of outsourcing of information) is a security risk for individuals as much as for the government and businesses. When your data leaves your control, you have no idea who's looking at it or what they are doing with it, and no way of knowing how secure or at risk it really is. Of course that's a top security risk. And, no, the government, companies and individuals ought not be exposing themselves to that risk.

As far as social media go, though, the government should also not be involved with these in any significant way. It is not the business of the government to stamp particular social media outlets with their stamp of approval, nor should they allow these outlets to filter or color official government information or interactions with government. The government should communicate directly with the people via official government sites and not through third-party intermediaries.

I wrote about this earlier this month, when the study was released, and interviewed CA's Dave Hansen about the findings:
http://itknowledgeexchange.techtarget.com/it-compliance/study-links-outsourcing-mobile-workforce-and-cyberterrorism-threats/

It might be worth mentioning to your readers, in that vein, that his employer, CA Inc. sponsored the research.

Why is any of that sad or frightening, Jolie? Whose "POVs" don't support the contention that Web application security isn't particularly good right now, and that the use of it by agencies exposed them to greater risk?

The OWASP conference I attended in DC recently showed again and again how vulnerable social networks and mobile applications are to to hacking and social engineering.

It would be, perhaps, more frightening if the risks of outsourcing, an increasingly mobile workforce and cyberterrorism weren't perceived as growing threats by government IT execs. Most government data breaches have come from lost laptops, USB drives loaded with malware or network penetration. Bad code in the supply chain or reliance on third-party vendors for security aren't minor concerns.

Anonymous, above, makes a strong point regarding the use of third-party intermediaries or cloud computing, in terms of the greater risk surface that it exposes for agencies. Where he/she misses the study's point is in the perceived risk of unstructured data, as cited in the study.

That's a direct outgrowth of enterprise social computing systems, which have been increasingly used in government, or in external social networks. In either case, the concern is that classified, proprietary or otherwise sensitive data will leak.

I'm not sure how "we solve the problem," other than making sure that sensitive information isn't enter into insecure systems, that laptops are encrypted and that Web application developers build security into their software at the outset, so that governments, nonprofits and private citizens alike can trust them enough to rely upon them in emergencies.

I don't think that the "social media experts" are at fault here - that description usually doesn't include a thorough grounding in infosec. The federal CIO council recently released a document governing the secure use of social media in government that addresses many of those issues.

On the other fronts, maybe it's time to stop loving the trends and making friends with the apps? They're all just tools. If we're lucky, people will use them to effect good in society. Sometimes, bad actors will put them to malicious use.

Regardless of whether we're in 2.0 or some other iteration of a tech epoch, my bet is that that will remain true.

Are we to understand that these supposed IT leaders (one would think/hope technically savvy people) believe 'web2.0' (a collection of technologies that change presenation of data) are a higher security risk than data breaches (active efforts from crackers)? I think they must think web2.0 means something it does not.

lordmorgul continues "It is pretty clear that some of the respondents to this poll did not understand the questions which they are answering..."

There are a lot of misconceptions around some of the newer technologies in this survey, such as Web 2.0 and Cloud Computing. While they certainly can be the source of security threats (as much as simply connecting a computer to a network), it is very much up to the implementation and usage. If poor coding practices or faulty proceedures are followed, these, like almost anything else, can be huge security holes. However, with the right precautions in place, they don't have to be. (Data encryption and data access at a granular level, for instance, are among the precautions that can significantly improve data security.)

(I am contracted by M80, working with Microsoft to promote Windows Azure)