	Background

Information security is a critical consideration for any organization that  depends on information systems and computer networks to carry out its  mission or business. The act also gave FHFA the responsibility for, among other  things, the supervision and oversight of Fannie Mae, Freddie Mac, and the  12 federal home loan banks. If left  uncorrected, the deficiencies increase the risk that unauthorized  individuals may gain access to FHFA computing resources, programs,  information, and facilities. Finally, FHFA policy  requires that information systems enforce the most restrictive set of rights  needed by users to perform their assigned duties. FHFA implemented numerous controls to prevent, limit, and detect logical  access to its financial systems and information. For example, FHFA did not always maintain authorization records for  network and system access, enforce the most restrictive access needed by  users on shared network files and directories, and restrict access to  sensitive system resources. However, numerous instances existed in which FHFA did not sufficiently  secure its facilities. During our testing, we were able to obtain  unauthorized access from outside FHFA facilities into its interior space  containing sensitive information and IT equipment. Because these spaces were not sufficiently secured, FHFA has  less assurance that computer operations are protected from inadvertent or  deliberate misuse including fraud or destruction. To their credit, senior FHFA officials acknowledged these physical  security and environmental safety control shortcomings and told us that  they have taken steps or are planning to take steps to mitigate most of the  deficiencies. FHFA Has Not Fully Implemented All Elements of Its Information Security Program

A key reason for the information security deficiencies in FHFA’s  information systems discussed previously is that it has not yet fully  implemented its agencywide information security program to ensure that  controls are appropriately designed and operating effectively. The agency has begun putting procedures from the handbook in place and  expects to fully implement these in fiscal year 2010. Although FHFA made important progress in developing and documenting  elements of its information security program, its policies, procedures,  plans, and technical standards related to separation of duties,  configuration management, and continuity of operations do not reflect the  current operating environment. Appropriate policies and procedures should be developed to  ensure that the activities performed by external third parties are  documented, agreed upon, implemented, and monitored for compliance. Recommendations for Executive Action

To help strengthen access controls and other information system controls  over key financial systems, information, and networks, we recommend  that the Acting Director of the Federal Housing Finance Agency implement  the following 16 recommendations for strengthening logical access  controls, physical access controls, and the agency’s information security  program. To strengthen controls over physical access, we recommend that the  Acting Director ensures FHFA:  (4)  secures areas that contain IT equipment and sensitive  (5)  completes sufficient physical security policies to address  protection of agency assets, including incident response, access  authorizations, and environmental safety controls;  (6)  performs physical security risk assessments at key facilities;  (7)  develops, documents, and implements monitoring procedures to  ensure that physical access authorizations to secure areas  containing sensitive computer resources, including server rooms  and sensitive information, are current and controlled;  (8)  develops, documents, and implements monitoring procedures  and installs appropriate equipment to ensure that FHFA can  detect and respond to potential physical security incidents;  (9) implements and enforces visitor control practices at all facilities;  (10)  increases employees’ awareness of the need to enforce physical  security safeguards; and  (11)  secures and removes construction materials from  telecommunications and electrical closets that support computer  operations. Appendix I: Objective, Scope, and Methodology

The objective of our review was to determine whether controls over key  financial systems were effective in ensuring the confidentiality, integrity,  and availability of financial information.
Why GAO Did This Study

The Federal Housing Finance Agency (FHFA) relies extensively on computerized systems to carry out its mission to provide effective supervision, regulation, and housing mission oversight of the Federal National Mortgage Association (Fannie Mae), the Federal Home Loan Mortgage Corporation (Freddie Mac), and the federal home loan banks. Effective information security controls are essential to ensure that FHFA's financial information is protected from inadvertent or deliberate misuse, disclosure, or destruction. As part of its audit of FHFA's fiscal year 2009 financial statements, GAO assessed the effectiveness of the agency's information security controls to ensure the confidentiality, integrity, and availability of the agency's financial information. To do this, GAO examined FHFA information security policies, procedures, and other documents; tested controls over key financial applications; and interviewed key agency officials.

What GAO Found

Although FHFA has implemented important information security controls, it has not always implemented appropriate controls to sufficiently protect the confidentiality, integrity, and availability of financial information stored on and transmitted over its key financial systems, databases, and computer networks. The agency's financial system computing environment had deficiencies in several areas and the controls that were in place were not always effectively implemented to prevent, limit, and detect unauthorized access to the agency network and systems. Specifically, FHFA did not always maintain authorization records for network and system access, enforce the most restrictive access needed by users on shared network files and directories, and enforce the most restrictive set of rights needed by users to perform their assigned duties. Further, it did not effectively implement physical protection and environmental safety controls over its facilities and information technology resources. GAO identified numerous instances in which FHFA facilities were not adequately secured and was able to obtain unauthorized access from outside agency facilities into the agency's interior space containing sensitive information and information technology equipment. FHFA officials acknowledged these shortcomings and indicated that the agency has taken steps or is planning to take steps to mitigate these deficiencies. A key reason for the control deficiencies in FHFA's financial system computing environment is that the agency has not yet fully implemented its agencywide information security program to ensure that controls are appropriately designed and operating effectively. Although FHFA made important progress in developing and documenting elements of its information security program, written policies, procedures, and technical standards do not reflect the current operating environment. Further, the agency has not yet developed, documented, and implemented sufficient policies and procedures to ensure that the activities performed by external third parties are monitored for compliance with FHFA's policies. Although these deficiencies were not considered significant deficiencies for financial reporting purposes, if left uncorrected they unnecessarily increase the risk that sensitive and financial information is subject to unauthorized disclosure, modification, or destruction.