As the administrator of the BSA, FinCEN, a bureau within Treasury, is  tasked with the mission of safeguarding the U.S. financial system from  money laundering, terrorist financing, and other abuses. Inappropriate disclosure, modification, or misuse of this  information could undermine the ability of the federal government,  financial institutions, and law enforcement agencies to combat money  laundering and terrorist financing. FinCEN, TCS, and IRS Had Not Fully Implemented Appropriate Security Controls and Practices to Protect Information and Systems Supporting FinCEN’s Mission

Although FinCEN, TCS, and IRS had implemented many information  security controls to protect the information and systems supporting  FinCEN’s mission, weaknesses existed in several critical areas. As  a result, BSA data—containing highly sensitive personal and financial  information about private individuals that is used by the law enforcement  community to identify and prosecute illegal activity—are at an increased  risk of unauthorized use, modification, or disclosure. Although FinCEN and TCS had employed controls to segregate sensitive  areas of their networks and protect them from intrusion, the organizations  did not always adequately control the logical and physical boundaries  protecting information and systems supporting FinCEN’s mission, as the  following examples indicate:    FinCEN had not fully implemented controls to protect the boundaries of  its network. IRS did not restrict the processing of sensitive data on its systems that  support FinCEN. FISMA requires agencies to develop, document, and implement an  information security program that, among other things, includes    periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems;    policies and procedures that (1) are based on risk assessments, (2)  cost-effectively reduce information security risks to an acceptable  level, (3) ensure that information security is addressed throughout the  life cycle of each system, and (4) ensure compliance with applicable  requirements;   plans for providing adequate information security for networks,  facilities, and systems;   security awareness training to inform personnel of information security  risks and of their responsibilities in complying with agency policies and  procedures, as well as training personnel with significant security  responsibilities for information security;   periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls for  every system identified in the agency’s required inventory of major  information systems; and   a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in its information security  policies, procedures, or practices. Further, the bureau did not have  detailed implementation guidance for securely configuring its virtual  private network. As we have previously reported, IRS’s verification process for  determining whether remedial actions were implemented was not always  effective. Conclusions

FinCEN, TCS, and IRS have taken important steps in implementing  numerous controls to protect the information and systems that support  FinCEN’s mission. However, significant weaknesses in access controls and  other information security controls existed at all three organizations that  impaired their ability to ensure the confidentiality, integrity, and  availability of the information and systems. Appendix I: Objective, Scope, and Methodology

The objective of our review was to determine whether information  security controls have been implemented that effectively protect the  confidentiality, integrity, and availability of the information and  information systems supporting the mission of the Financial Crimes  Enforcement Network (FinCEN). We focused our  evaluation on the controls for the applications, databases, and network  infrastructure that directly or indirectly support the processing and  storage of Bank Secrecy Act (BSA) data on behalf of FinCEN at the  Department of the Treasury (Treasury), FinCEN, and the Internal Revenue  Service (IRS).
Why GAO Did This Study

The Financial Crimes Enforcement Network (FinCEN), a bureau within the Department of the Treasury, relies extensively on its own computer systems, as well as those at the Internal Revenue Service (IRS) and the Treasury Communications System (TCS), to administer the Bank Secrecy Act (BSA) and fulfill its mission of safeguarding the U.S. financial system from financial crimes. Effective information security controls over these systems are essential to ensuring that BSA data, which contains sensitive financial information used by law enforcement agencies to prosecute financial crime, is protected from inappropriate or deliberate misuse, improper disclosure, or destruction. GAO evaluated whether security controls that effectively protect the confidentiality, integrity, and availability of the information and systems that support FinCEN's mission have been implemented. To do this, GAO examined security policies and controls for systems at three organizations.

What GAO Found

FinCEN, TCS, and IRS have taken important steps in implementing numerous controls to protect the information and systems that support FinCEN's mission; however, significant information security weaknesses remain in protecting the confidentiality, integrity, and availability of these systems and information. The three organizations implemented many information security controls to protect the information and systems that support FinCEN's mission. For example, IRS controlled changes to a key application and FinCEN segregated areas of its network. Nonetheless, the organizations had inconsistently applied or not fully implemented controls to prevent, limit, or detect unauthorized access to this information and these systems. For example, the organizations did not always (1) implement user and password management controls for properly identifying and authenticating users, (2) restrict user access to data to only what was required for performing job functions, (3) adequately encrypt data, (4) protect the external and internal boundaries on its systems, and (5) log user activity on databases. Furthermore, weaknesses in which systems were insecurely configured and patches were not applied to critical systems also existed. As a result, sensitive information used by the federal government, financial institutions, and law enforcement agencies to combat money laundering and terrorist financing is at an increased risk of unauthorized use, modification, or disclosure. A key reason for many of the weaknesses was that FinCEN and IRS had not fully implemented key information security program activities. For example, FinCEN did not always include detailed implementation guidance in its policies and procedures and adequately test and evaluate information security controls. Furthermore, GAO has previously reported that IRS did not sufficiently verify whether remedial actions were implemented or effective in mitigating vulnerabilities and recommended that it implement a revised remedial action verification process.