The  act also designated FDIC as the administrator of the Federal Savings &  Loan Insurance Corporation Resolution Fund, which was created to  complete the affairs of the former Federal Savings & Loan Insurance  Corporation and liquidate the assets and liabilities transferred from the  former Resolution Trust Corporation. Information Security Weaknesses Place Financial and Other Sensitive Information at Risk

FDIC did not sufficiently implement access and other controls intended to  protect the confidentiality, integrity, and availability of its financial  systems and information and other sensitive information. A key reason for  these weaknesses is that FDIC did not always fully implement key  information security program activities such as effectively developing and  implementing security policies, and implementing an effective continuous  monitoring program. FDIC did not consistently enforce identification and authentication  controls for its users and systems. FDIC did not always ensure that sensitive information transmitted over its  network was adequately encrypted. FDIC did not always sufficiently review audit and monitoring of security- relevant events. Until all key elements of its information security  program have been fully and consistently implemented, FDIC will not have  sufficient assurance that its financial information and assets are  adequately safeguarded from inadvertent or deliberate misuse, fraudulent  use, improper disclosure, or destruction. FDIC Has Mitigated Previously Reported Weaknesses

Despite the newly identified weaknesses, FDIC has made progress in  mitigating previously reported information security weaknesses. To its credit, the corporation  has made improvements to the configuration management controls and  aspects of its security management. For example, it maintained a full and  complete requirements baseline for two systems and included key  information in a remedial action plan. In addition, FDIC has corrected the  FDIC Inspector General findings from the 2009 report. The weaknesses also represent a  significant deficiency in internal controls over the information systems  and data used for financial reporting. Until FDIC (1) mitigates known information security weaknesses in access  controls and other information system controls and (2) fully implements a  comprehensive agencywide information security program that includes  developing, documenting, and implementing security policies and  implementing an effective continuous monitoring program, its financial  and other sensitive information will remain at increased risk of  unauthorized disclosure, modification, or destruction, and its management  decisions may be based on unreliable or inaccurate information. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to assess (1) the effectiveness of the  Federal Deposit Insurance Corporation’s (FDIC) controls in protecting the  confidentiality, integrity, and availability of its financial systems and  information, and (2) the progress FDIC has made in mitigating previously  reported information security weaknesses. Using the requirements of the Federal Information Security Management  Act (FISMA), which establishes key elements for an effective agencywide  information security program, we evaluated FDIC’s implementation of its  security program by  reviewing FDIC’s risk assessment process and risk assessments for key  FDIC systems that support the preparation of financial statements to  determine whether risks and threats were documented consistent with  federal guidance; analyzing FDIC’s policies, procedures, practices, and standards to  determine their effectiveness in providing guidance to personnel  responsible for securing information and information systems;    analyzing security plans to determine if management, operational, and  technical controls were in place or planned and that security plans were  updated;  examining training records for personnel with significant security  responsibilities to determine if they had received training commensurat with those responsibilities; analyzing configuration management plans and procedures to determine if  configurations were being m anaged appropriately;  analyzing security testing and evaluation results for four key FDIC system to determine whether management, operational, and technical controls  were tested at least annually and based on risk;    examining remedial action plans to determine whether they addressed  vulnerabilities identified in FDIC’s security testing and evaluations; a  examining contingency plans for four key FDIC systems to determine  whether those plans had been tested or updated.
Why GAO Did This Study

The Federal Deposit Insurance Corporation (FDIC) has a demanding responsibility enforcing banking laws, regulating financial institutions, and protecting depositors. Because of the importance of its work, the corporation must employ strong information security controls to ensure that its information systems are adequately protected from inadvertent misuse, fraud, and improper disclosure. As part of its audit of the 2009 financial statements of the Deposit Insurance Fund and the Federal Savings & Loan Insurance Corporation Resolution Fund administrated by FDIC, GAO assessed (1) the effectiveness of FDIC's controls in protecting the confidentiality, integrity, and availability of its financial systems and information and (2) the progress FDIC has made in mitigating previously reported information security weaknesses. To perform the audit, GAO examined security policies, procedures, reports, and other documents; tested controls over key financial applications; and interviewed key FDIC personnel.

What GAO Found

FDIC did not sufficiently implement access and other controls intended to protect the confidentiality, integrity, and availability of its financial systems and information. For example, it did not always (1) sufficiently restrict user access to systems, (2) ensure strong system boundaries, (3) consistently enforce strong controls for identifying and authenticating users, (5) encrypt sensitive information, or (4) audit and monitor security-relevant events. In addition, FDIC did not have policies, procedures, and controls in place to ensure the appropriate segregation of incompatible duties, adequately manage the configuration of its financial information systems, and update contingency plans. A key reason for these weaknesses is that FDIC did not always fully implement key information security program activities such as effectively developing, documenting, and implementing security policies, and implementing an effective continuous monitoring program. Until these weaknesses and program deficiencies are corrected, the corporation will not have sufficient assurance that its financial information and assets are adequately safeguarded from inadvertent or deliberate misuse, fraudulent use, improper disclosure, or destruction. Despite the newly identified weaknesses, FDIC has mitigated each of the information security weaknesses previously reported by GAO. To its credit, the corporation has made improvements to its configuration management controls and aspects of its security management. For example, it maintained a full and complete requirements baseline for two systems and included key information in a remedial action plan. Nevertheless, GAO concluded that weaknesses in information security controls constituted a significant deficiency in internal controls over the information systems and data used for financial reporting. Until FDIC corrects the security weaknesses identified during this year's audit, it will face an elevated risk of the misuse of federal assets, unauthorized modification or destruction of financial information, inappropriate disclosure of other sensitive information, and disruption of critical operations.

What GAO Recommends

GAO is recommending that FDIC improve key information activities to enhance the corporation's information security program. FDIC generally agreed with GAO's recommendations and stated that it plans to address the identified weaknesses.