Objective, Scope, and Methodology

The objective of our review was to assess the effectiveness of information  system controls in ensuring the confidentiality, integrity, and availability of  Treasury’s financial and sensitive auction information on key mainframe  and distributed-based systems that the FRBs maintain and operate on  behalf of BPD and that are relevant to the Schedule of Federal Debt. Our  assessment included a review of the supporting network infrastructure that  interconnects the mainframe and distributed-based systems. Security of Treasury Auction Systems Needs to Be Addressed

Although the FRBs established and implemented many controls to protect  the mainframe applications that they maintain and operate on behalf of  BPD, they did not consistently implement controls to prevent, limit, or  detect unauthorized access to sensitive data and computing resources for  the distributed-based systems and network environment that support  Treasury auctions. As a result, increased risk exists that unauthorized and  possibly undetected use, modification, destruction, and disclosure of  certain sensitive auction information could occur. Furthermore, other FRB  applications that share common network resources may also face  increased risk. These information system control weaknesses existed, in part, because the  FRBs did not have (1) an effective management structure for coordinating,  communicating, and overseeing information security activities across bank  organizational boundaries and (2) an environment to sufficiently test the  auction applications. Mainframe Control Environment

The FRBs had generally implemented effective information system  controls for the mainframe applications that they operate and maintain on  behalf of BPD in support of Treasury’s auctions and financial reporting. More specifically, the FRBs did not consistently (1)  identify and authenticate users to prevent unauthorized access; (2) enforce  the principle of least privilege to ensure that authorized access was  necessary and appropriate; (3) implement adequate boundary protections  to limit connectivity to systems that process BPD business; (4) apply strong  encryption technologies to protect sensitive data in storage and on the  Federal Reserve networks; (5) log, audit, or monitor security-related  events; and (6) maintain secure configurations on servers and  workstations. The GAO’s audit of the Treasury auction systems was conducted as part of its  review of the Bureau of the Public Debt’s FY 2005 Schedules of Federal Debt.
Why GAO Did This Study

The Federal Reserve System's Federal Reserve Banks (FRB) serve as fiscal agents of the U.S. government when they are directed to do so by the Secretary of the Treasury. In this capacity, the FRBs operate and maintain several mainframe and distributed-based systems--including the systems that support the Department of the Treasury's auctions of marketable securities--on behalf of the department's Bureau of the Public Debt (BPD). Effective security controls over these systems are essential to ensure that sensitive and financial information is adequately protected from inadvertent or deliberate misuse, disclosure, or destruction. In support of its audit of BPD's fiscal year 2005 Schedule of Federal Debt, GAO assessed the effectiveness of information system controls in protecting financial and sensitive auction information on key mainframe and distributed-based systems that the FRBs maintain and operate for BPD. To do this, GAO observed and tested FRBs' security controls.

What GAO Found

In general, the FRBs had implemented effective information system controls over the mainframe applications they maintain and operate for BPD in support of Treasury's auctions and financial reporting. On the distributed-based systems and supporting network environment used for Treasury auctions, however, they had not fully implemented information system controls to protect the confidentiality, integrity, and availability of sensitive and financial information. The FRBs did not consistently (1) identify and authenticate users to prevent unauthorized access; (2) enforce the principle of least privilege to ensure that access was authorized only when necessary and appropriate; (3) implement adequate boundary protections to limit connectivity to systems that process BPD business; (4) apply strong encryption technologies to protect sensitive data both in storage and on its networks; (5) log, audit, or monitor security-related events; and (6) maintain secure configurations on servers and workstations. Without consistent application of these controls, the auction information and computing resources for key distributed-based auction systems remain at increased risk of unauthorized and possibly undetected use, modification, destruction, and disclosure. Other FRB applications that share common network resources may also be at increased risk. Contributing to these weaknesses in information system controls were the Federal Reserve's lack of (1) an effective management structure for coordinating, communicating, and overseeing information security activities across bank organizational boundaries and (2) an adequate environment in which to sufficiently test the security of its auction applications.