FDIC identifies, monitors, and addresses risks to the  Deposit Insurance Fund when a bank or thrift institution fails. Opportunities Exist for FDIC to Improve Information Security Controls

Although FDIC had implemented numerous controls over its systems, it  had not always implemented access and other controls to protect the  confidentiality, integrity, and availability of its financial systems and  information. Although these weaknesses did not individually or collectively constitute a  material weakness or significant deficiency in 2010, they still increase the  risk that financial and other sensitive information could be disclosed or  modified without authorization. For example, it had implemented  controls to effectively detect and change default vendor-supplied user  accounts and passwords in installed software and had ensured that  passwords for privileged accounts on certain servers were changed in  accordance with its policy. FDIC had implemented controls to restrict user access to certain  resources. However, FDIC had not always ensured that sensitive financial  information transmitted over and stored on its network was adequately  encrypted. However, FDIC’s audit and monitoring of security- relevant events on key financial systems was not always sufficient. FDIC Had Not Always Implemented Key Activities of its Information Security Program

An underlying reason for the information security weaknesses noted in  the previous section is that, while FDIC has developed and documented a  comprehensive corporate information security program, including  documenting an information security risk management policy, developing  security policies and procedures, documenting system security plans, and  periodically testing information security controls, the corporation had not  fully implemented its information security program. FISMA requires  each agency to develop, document, and implement an information  security program that, among other things, includes    periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems;    policies and procedures that (1) are based on risk assessments, (2)  cost effectively reduce information security risks to an acceptable  level, (3) ensure that information security is addressed throughout the  life cycle of each system, and (4) ensure compliance with applicable  requirements;    plans for providing adequate information security for networks,  facilities, and systems;    periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls  for every system identified in the agency’s required inventory of major  information systems; and    a process for planning, implementing, evaluating, and documenting  remedial actions to address any deficiencies in its information security  policies, procedures, or practices. Conclusions

FDIC has made significant progress in correcting or mitigating previously  reported information security weaknesses, but other control weaknesses  continue to unnecessarily put FDIC’s systems at an increased risk from  internal and external threats. FDIC had made  improvements in its information security controls and had mitigated the  potential effect of its remaining weaknesses on financial reporting by  implementing compensating management and reconciliation controls  during 2010, enabling us to conclude that FDIC had resolved the  significant deficiency over information systems that we had reported in  our 2009 audit. Appendix I: Objective, Scope, and Methodology

The objective of our audit was to determine the effectiveness of the  Federal Deposit Insurance Corporation’s (FDIC) controls protecting the  confidentiality, integrity, and availability of its financial systems and  information. To determine whether controls over key financial systems were effective,  we considered the results of our evaluation of FDIC’s actions to mitigate  previously reported weaknesses and performed new audit work at FDIC  facilities in Arlington, Virginia, and Washington, D.C. We concentrated our  evaluation primarily on the controls for financial applications and  enterprise database applications associated with the New Financial  Environment; the Assessment Information Management System; the  Communication, Capability, Challenge, and Control System (4C)  application; the programs, data, and systems supporting the preparation  of the estimates of losses and costs due to loss-sharing agreements, and  the general support systems.
Why GAO Did This Study

The Federal Deposit Insurance Corporation (FDIC) has a demanding responsibility enforcing banking laws, regulating financial institutions, and protecting depositors. Because of the importance of FDIC's work, effective information security controls are essential to ensure that the corporation's systems and information are adequately protected from inadvertent misuse, fraudulent use, or improper disclosure. As part of its audits of the 2010 financial statements of the Deposit Insurance Fund and the Federal Savings & Loan Insurance Corporation Resolution Fund administrated by FDIC, GAO assessed the effectiveness of the corporation's controls in protecting the confidentiality, integrity, and availability of its financial systems and information. To perform the audit, GAO examined security policies, procedures, reports, and other documents; tested controls over key financial applications; and interviewed key FDIC personnel.

What GAO Found

Although FDIC had implemented numerous controls in its systems, it had not always implemented access and other controls to protect the confidentiality, integrity, and availability of its financial systems and information. FDIC has implemented controls to detect and change default user accounts and passwords in vendor-supplied software, restricted access to network management servers, developed and tested contingency plans for major systems, and improved mainframe logging controls. However, the corporation had not always (1) required strong passwords on financial systems and databases; (2) reviewed user access to financial information in its document sharing system in accordance with policy; (3) encrypted financial information transmitted over and stored on its network; and (4) protected powerful database accounts and privileges from unauthorized use. In addition, other weaknesses existed in FDIC's controls that were intended to appropriately segregate incompatible duties, manage system configurations, and implement patches. An underlying reason for the information security weaknesses is that FDIC had not always implemented key information security program activities. To its credit, FDIC had developed and documented a security program and had completed actions to correct or mitigate 26 of the 33 information security weaknesses that were previously identified by GAO. However, the corporation had not assessed risks, documented security controls, or performed periodic testing on the programs and data used to support the estimates of losses and costs associated with the servicing and disposal of the assets of failed institutions. Additionally, FDIC had not always implemented its policies for restricting user access or for monitoring the progress of security patch installation. Because FDIC had made progress in correcting or mitigating previously reported weaknesses and had implemented compensating management and reconciliation controls during 2010, GAO concluded that FDIC had resolved the significant deficiency in internal control over financial reporting related to information security reported in GAO's 2009 audit, and that the remaining unresolved issues and the new issues identified did not individually or collectively constitute a material weakness or significant deficiency in 2010. However, if left unaddressed, these issues will continue to increase FDIC's risk that its sensitive and financial information will be subject to unauthorized disclosure, modification, or destruction.

What GAO Recommends

GAO recommends that FDIC take two actions to enhance its comprehensive information security program. In commenting on a draft of this report, FDIC discussed actions that it has taken or plans to take to address these recommendations.