To support its financial operations and store the sensitive information it  collects, SEC relies extensively on computerized systems interconnected  by local and wide-area networks. SEC Has Made Important Progress Correcting Previously Reported Weaknesses and Improving Security

SEC has corrected or mitigated 18 of the 34 security control weaknesses  that we had reported as unresolved at the time of our prior audit report in  2008. For example, it has    adequately validated electronic certificates from connections to its    physically secured the perimeter of the operations center,    monitored unusual and suspicious activities at its operations center, and  removed network system accounts and data center access rights from  separating employees. For example, the commission has developed, documented, and  implemented a policy on remedial action plans to help ensure that  deficiencies are mitigated in an effective and timely manner, and provided  individuals with training for incident handling. While SEC has made important progress in strengthening its information  security controls, it has not completed actions to correct or mitigate 16 of  the previously reported weaknesses. For example, SEC has not adequately  documented access privileges for the EDGAR application, always  implemented patches on vulnerable workstations and enterprise database  servers, or always sufficiently protected passwords. Control Weaknesses Continue to Place Financial Information at Risk

In addition to the 16 previously reported weakness that remain  uncorrected, we identified 23 new weaknesses in controls intended to  restrict access to data and systems, as well as weaknesses in other  information security controls, that continue to jeopardize the  confidentiality, integrity, and availability of SEC’s financial and sensitive  information and information systems. Organizations accomplish this by designing and implementing  controls that are intended to prevent, limit, and detect unauthorized  access to computer resources (e.g., data, programs, equipment, and  facilities), thereby protecting them from unauthorized disclosure,  modification, and loss. SEC did not consistently enforce identification and authentication  controls for its users and systems. SEC did not adequately configure several database systems to enable  auditing and monitoring of security-relevant events. Specifically, it did not always document,  evaluate, or approve changes to a system’s baseline. SEC Has Not Fully Implemented Its Information Security Program

SEC has made important progress in implementing its information security  program. However, a key reason for the information  security weaknesses is that it has not effectively or fully implemented key  program activities. However, SEC did not sufficiently conduct periodic testing and evaluation  of controls. A key reason for these weaknesses is that the agency has not yet fully  implemented critical elements of its agencywide information security  program. Recommendations for Executive Action

To assist the commission in improving the implementation of its  agencywide information security program, we recommend that the SEC  Chairman direct the CIO to take the following four actions:    designate a senior agency information security officer who will be  responsible for managing SEC’s information security program,    provide full information for management oversight of information security    conduct comprehensive periodic testing and evaluation of the  effectiveness of security controls for the general support system and key  financial applications, and   certify and accredit subsystems that support the production of SEC’s  financial statements. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were (1) to determine the status of the  Securities and Exchange Commission’s (SEC) actions to correct or  mitigate previously reported information security weaknesses and (2) to  determine whether controls over key financial systems were effective in  ensuring the confidentiality, integrity, and availability of financial and  sensitive information.
Why GAO Did This Study

In carrying out its mission to ensure that securities markets are fair, orderly, and efficiently maintained, the Securities and Exchange Commission (SEC) relies extensively on computerized systems. Effective information security controls are essential to ensure that SEC's financial and sensitive information is protected from inadvertent or deliberate misuse, disclosure, or destruction. As part of its audit of SEC's financial statements, GAO assessed (1) the status of SEC's actions to correct previously reported information security weaknesses and (2) the effectiveness of SEC's controls for ensuring the confidentiality, integrity, and availability of its information systems and information. To do this, GAO examined security policies and artifacts, interviewed pertinent officials, and conducted tests and observations of controls in operation.

What GAO Found

SEC has made important progress toward correcting previously reported information security control weaknesses. Specifically, it has corrected or mitigated 18 of 34 weaknesses previously reported as unresolved at the time of our prior audit. For example, SEC has adequately validated electronic certificates from connections to its network, physically secured the perimeter of its operations center and put in place a process to monitor unusual and suspicious activities, and removed network system accounts and data center access rights from separating employees. In addition, the commission has made progress in improving its information security program. To illustrate, it has developed, documented, and implemented a policy on remedial action plans to ensure that deficiencies are mitigated in an effective and timely manner, and provided individuals with training for incident handling. Nevertheless, SEC has not completed actions to correct 16 previously reported weaknesses. For example, it did not adequately document access privileges granted to users of a key financial application, and did not always implement patches on vulnerable workstations and enterprise database servers. In addition to the 16 previously reported weakness that remain uncorrected, GAO identified 23 new weaknesses in controls intended to restrict access to data and systems, as well as weaknesses in other information security controls, that continue to jeopardize the confidentiality, integrity, and availability of SEC's financial and sensitive information and information systems. The commission has not fully implemented effective controls to prevent, limit, or detect unauthorized access to computing resources. For example, it did not always (1) consistently enforce strong controls for identifying and authenticating users, (2) sufficiently restrict user access to systems (3) encrypt network services, (4) audit and monitor security-relevant events for its databases, and (5) physically protect its computer resources. SEC also did not consistently ensure appropriate segregation of incompatible duties or adequately manage the configuration of its financial information systems. A key reason for these weaknesses is that the commission has not yet fully implemented its information security program to ensure that controls are appropriately designed and operating as intended. Specifically, SEC has not effectively or fully implemented key program activities. For example, it has not (1) filled the vacancy for a senior agency information security officer, (2) fully reported or assessed risks, (3) sufficiently tested and evaluated the effectiveness of its information system controls, and (4) certified and accredited a key intermediary subsystem. Although progress has been made, significant and preventable information security control deficiencies create continuing risks of the misuse of federal assets, unauthorized modification or destruction of financial information, inappropriate disclosure of other sensitive information, and disruption of critical operations.