FDIC Continues to Implement Controls, but Collective Weaknesses Require Management Attention

For calendar years 2016 and 2015, FDIC implemented numerous  information security controls intended to protect its key financial systems. As we have previously reported, the collective effect of weaknesses in  access and configuration management controls, both new and unresolved  from previous audits, contributed to our determination that FDIC had a  significant deficiency in internal control over financial reporting as of  December 31, 2016. FDIC did not implement sufficient internal boundary protection controls on  its network to isolate financial systems from other parts of its network. FDIC did not implement sufficient controls to ensure that users would be  held accountable for the use of a key privileged account. For example, although the corporation used  multiple tools to track and validate its IT assets, it had not established a  single, authoritative,  accurate listing of all IT assets in its environment. Agency programs are to include, among  other things, the following elements: periodic assessments of risk, including the magnitude of harm that  could result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems  that support the operations and assets of the organization; plans and procedures to ensure continuity of operations for  information systems that support the operations and assets of the  agency; policies and procedures that are based on risk assessments, cost- effectively reduce information security risks to an acceptable level,  and ensure that information security is addressed throughout the life  cycle of each organizational information system; periodic testing and evaluation of the effectiveness of information  security policies, procedures, practices, and security controls to be  performed with a frequency depending on risk, but no less than  annually; a process for planning, implementing, evaluating, and documenting  remedial actions to address any deficiencies in the information  security policies, procedures, and practices of the organization; and procedures for detecting, reporting, and responding to security  incidents. For example, it had defined security categories for the general support systems we  reviewed based on risk using NIST guidance, assessed the risk from  control deficiencies identified during security control tests, and  ensured that the general support systems we reviewed were  authorized to operate; and conducted a disaster recovery test of its general support systems and  mission-critical applications. However, FDIC had not fully or consistently implemented aspects of its  information security program, which was an underlying reason for many   of the information security weaknesses identified during our review. Specifically, FDIC had not  included all necessary information in procedures for granting access  to a key financial application;  fully addressed the FDIC OIG’s finding that security control  assessments of outsourced service providers had not been completed  in a timely manner;  fully addressed key previously identified weaknesses related to  establishing agencywide configuration baselines and monitoring  changes to critical server files; and completed actions to address the FDIC OIG’s finding that the  corporation had not ensured that major security incidents are  identified and reported in a timely manner. In addition, as of December 31, 2016, FDIC had addressed 15  of the 21 previously reported information system weaknesses that were  unresolved at the end of our prior audit. However, management attention is needed  to address new and previously identified deficiencies in access controls— including boundary protection, identification and authentication,  authorization, cryptography, and audit and monitoring controls—and in  configuration management controls. In a separate report with limited distribution, we are also making six  recommendations to resolve shortcomings in FDIC’s internal control over  financial reporting and help strengthen access and configuration  management controls over key financial information, systems, and  networks. Agency Comments and Our Evaluation

In written comments on a draft of this report (reprinted in appendix II),  FDIC concurred with our recommendation to improve its implementation  of its information security program and stated that corrective actions will  be completed by July 2017. Appendix I: Objective, Scope, and Methodology

The objective of this information security review was to determine the  effectiveness of the Federal Deposit Insurance Corporation’s (FDIC)  controls in protecting the confidentiality, integrity, and availability  of its  financial systems and information. The review was conducted as part of our audit of the  financial statements of the two funds administered by FDIC: the Deposit  Insurance Fund and the Federal Savings and Loan Insurance Corporation  Resolution Fund.
Why GAO Did This Study

FDIC has a demanding responsibility enforcing banking laws, regulating financial institutions, and protecting depositors. Because of FDIC's reliance on information systems, effective information security controls are essential to ensure that the corporation's systems and information are adequately protected from inadvertent or deliberate misuse, improper modification, unauthorized disclosure, or destruction.
As part of its audit of the 2016 and 2015 financial statements of the Deposit Insurance Fund and the Federal Savings and Loan Insurance Corporation Resolution Fund, which are administered by FDIC, GAO assessed the effectiveness of the corporation's controls in protecting the confidentiality, integrity, and availability of its financial systems and information. To do so, GAO examined security policies, procedures, reports, and other documents; tested controls over key financial applications; and interviewed FDIC personnel.

What GAO Found

The Federal Deposit Insurance Corporation (FDIC) implemented numerous information security controls intended to protect its key financial systems. However, further actions are needed to address weaknesses in access controls—including boundary protection, identification and authentication, and authorization controls—and in configuration management controls. For example, the corporation did not sufficiently isolate financial systems from other parts of its network, ensure that users would be held accountable for the use of a key privileged account, or establish a single, accurate listing of all IT assets in its environment.
The corporation established a comprehensive framework for its information security program and implemented many aspects of its program. For example, FDIC (1) defined security categories for the general support systems we reviewed based on risk; (2) assessed the risk from control deficiencies identified during security control tests; and (3) conducted a disaster recovery test of its general support systems and mission-critical applications. In addition, FDIC addressed 15 of the 21 previously reported weaknesses that were unresolved as of December 31, 2015, as indicated in the following table.
However, an underlying reason for many of the information security weaknesses identified during GAO's review was that FDIC did not fully implement other aspects of its program. For example, the corporation did not (1) include necessary information in procedures for granting access to a key financial application and (2) fully address the FDIC Office of the Inspector General's finding that the corporation did not always identify and report major security incidents in a timely manner.
Until FDIC takes the necessary steps to address both new and previously reported control deficiencies, its sensitive financial information and resources will remain at increased risk of inadvertent or deliberate misuse, improper modification, unauthorized disclosure, or destruction. The combination of the continuing and new information security control deficiencies in access and configuration management controls, considered collectively, represent a significant deficiency in FDIC's internal control over financial reporting as of December 31, 2016.

What GAO Recommends

GAO is recommending that FDIC take one action to more fully implement its information security program. In a separate report with limited distribution, GAO made six recommendations to FDIC to address newly identified weaknesses in access and configuration management controls. In commenting on a draft of this report, FDIC agreed with GAO’s recommendation and stated that corrective actions to implement the recommendation will be completed by July 2017.