In enforcing  these laws, SEC issues rules and regulations to provide protection for  investors and to help ensure that the securities markets are fair and honest. SEC relies extensively on computerized systems to support its financial  operations and store the sensitive information it collects. Objectives, Scope, and Methodology

The objectives of our review were to assess (1) the status of SEC’s actions  to correct or mitigate previously reported information security and (2) the  effectiveness of the commission’s information system controls for ensuring  the confidentiality, integrity, and availability of its information systems and  information. SEC Has Made Limited Progress Correcting Previously Reported Weaknesses

Although SEC has taken steps to address its information security controls  weaknesses, most of the weaknesses persist. Specifically, the commission  has corrected or mitigated 8 of the 51 weaknesses that we previously  reported as unresolved. Ineffective Controls Place Financial and Sensitive Data at Risk

SEC has not effectively implemented information security controls to  properly protect the confidentiality, integrity, and availability of its  financial and sensitive information and information systems. In addition to  the 43 previously reported weaknesses that remain uncorrected, we  identified 15 new information security weaknesses during this review. Electronic access  controls include user accounts and passwords, access rights and  permissions, network services and devices, and audit and monitoring of  security-related events. Weaknesses in these areas  increase the risk of unauthorized use, disclosure, modification, or loss of  SEC’s financial systems and sensitive information. A  key reason for SEC’s information security controls weaknesses is that the  commission has not fully developed or implemented an information  security program to ensure that effective controls are established and  maintained. FISMA requires agencies to develop, document, and implement an  information security program that includes the following:  periodic assessments of the risk and the magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems;  policies and procedures that (1) are based on risk assessments, (2) cost- effectively reduce risks, (3) ensure that information security is  addressed throughout the life cycle of each system, and (4) ensure  compliance with applicable requirements;  security awareness training to inform personnel—including contractors  and other users of information systems—of information security risks  and their responsibilities in complying with agency policies and  procedures;  at least annual testing and evaluation of the effectiveness of information  security policies, procedures, and practices relating to management,  operational, and technical controls of every major information system  that is identified in the agencies’ inventories;  a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in their information security  policies, procedures, or practices;  procedures for detecting, reporting, and responding to security   plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency. SEC has not developed a reporting and tracking mechanism for its remedial  action plans. SEC does not have a program to handle security incidents. Until SEC fully develops,  documents, and implements a comprehensive agencywide information  security program that includes enhanced policies, procedures, plans,  training, and continuity of operations, its facilities and computing  resources and the information that is processed, stored, and transmitted on  its systems will remain vulnerable to unauthorized access, modification, or  destruction.
Why GAO Did This Study

The Securities and Exchange Commission (SEC) has a demanding responsibility enforcing securities laws, regulating the securities markets, and protecting investors. In enforcing these laws, SEC issues rules and regulations to provide protection for investors and to help ensure that the securities markets are fair and honest. It relies extensively on computerized systems to support its financial and mission-related operations. Information security controls affect the integrity, confidentiality, and availability of sensitive information maintained by SEC. As part of the audit of SEC's fiscal year 2005 financial statements, GAO assessed (1) the status of SEC's actions to correct or mitigate previously reported information security weaknesses and (2) the effectiveness of the commission's information system controls in protecting the confidentiality, integrity, and availability of its financial and sensitive information.

What GAO Found

Although SEC has taken steps to strengthen its information security program, most of the previously reported information security controls and program weaknesses persist. Specifically, the commission has corrected or mitigated 8 of the 51 weaknesses that GAO reported as unresolved in last year's report. Among the corrective actions SEC has taken include replacing a vulnerable, publicly accessible workstation and developing and implementing change control procedures for a major application. However, the commission has not yet effectively controlled remote access to its servers, established controls over passwords, managed access to its systems and data, securely configured network devices and servers, or implemented auditing and monitoring mechanisms to detect and track security incidents. Overall, SEC has not effectively implemented information security controls to properly protect the confidentiality, integrity, and availability of its financial and sensitive information and information systems. In addition to the 43 previously reported weaknesses that remain uncorrected, GAO identified 15 new information security weaknesses. Most identified weaknesses pertained to electronic access controls such as user accounts and passwords, access rights and permissions, and network devices and services. These weaknesses increase the risk that financial and sensitive information will be inadequately protected against disclosure, modification, or loss, possibly without detection, and place SEC operations at risk of disruption. A key reason for SEC's information security controls weaknesses is that the commission has not fully developed, implemented, or documented key elements of an information security program to ensure that effective controls are established and maintained. Until SEC implements such a program, its facilities and computing resources and the information that is processed, stored, and transmitted on its systems will remain vulnerable.