Objectives, Scope, and Methodology

The objectives of our review were to assess (1) the progress FDIC has  made in correcting or mitigating remaining information system control  weaknesses reported as unresolved at the time of our prior review in  2005 and (2) the effectiveness of the corporation’s information system  controls for protecting the confidentiality, integrity, and availability of  financial and sensitive data. FDIC Has Made Substantial Progress Correcting Previously Reported Weaknesses

FDIC has taken steps to address security control weaknesses. The  corporation has corrected or mitigated 21 of the 26 weaknesses that we  previously reported as unresolved at the completion of our calendar year  2005 audit (see app. For example, the corporation has    developed and implemented procedures to prohibit the transmission of  mainframe user and administrator passwords in plaintext across the  network,   established and implemented a process to monitor and report on vendor- supplied account/password combinations, and improved mainframe security monitoring controls. FDIC Has Made Progress in Information System Controls, However Some Weaknesses Remain

Although FDIC made substantial improvements to its information system  controls, unresolved and newly identified weaknesses could limit its  ability to effectively protect the confidentiality, integrity, and availability  of its financial and sensitive information and information systems. NFE Was Not Fully Integrated into the Corporation’s Information Security Program

Although FDIC had taken steps to develop, document, and implement a  corporate information security program, it did not fully implement key  control activities for NFE. Although five weaknesses from prior reports remain unresolved and new  control weaknesses related to (1) e-mail security, (2) physical security,  and (3) configuration management were identified, the remaining  unresolved weaknesses previously reported and the newly identified  weaknesses did not pose significant risk of misstatement in the  corporation’s financial statements for calendar year 2006. However, the  old and new weaknesses do increase preventable risk to the corporation’s  financial and sensitive systems and information. Until FDIC fully integrates NFE into the security  program, its ability to maintain adequate information system controls over  its financial and sensitive information will be limited.
Why GAO Did This Study

The Federal Deposit Insurance Corporation (FDIC) has a demanding responsibility enforcing banking laws, regulating financial institutions, and protecting depositors. As part of its audit of the calendar year 2006 financial statements, GAO assessed (1) the progress FDIC has made in correcting or mitigating information security weaknesses previously reported and (2) the effectiveness of FDIC's system integrity controls to protect the confidentiality and availability of its financial information and information systems. To do this, GAO examined pertinent security policies, procedures, and relevant reports. In addition, GAO conducted tests and observations of controls in operation.

What GAO Found

FDIC has made substantial progress in correcting previously reported weaknesses in its information security controls. Specifically, it has corrected or mitigated 21 of the 26 weaknesses that GAO had reported as unresolved at the completion of the calendar year 2005 audit. Actions FDIC has taken include developing and implementing procedures to prohibit the transmission of mainframe user and administrator passwords in readable text across the network, implementing procedures to change vender-supplied account/passwords, and improving mainframe security monitoring controls. Although FDIC has made important progress improving its information system controls, old and new weaknesses could limit the corporation's ability to effectively protect the integrity, confidentiality, and availability of its financial and sensitive information and systems. In addition to the five previously reported weaknesses that are in the process of being mitigated, GAO identified new weaknesses in controls related to (1) e-mail security, (2) physical security, and (3) configuration management. Although these weaknesses do not pose significant risk of misstatement of the corporation's financial statements, they do increase preventable risk to the corporation's financial and sensitive systems and information. In addition, FDIC has not fully integrated its new financial system--the New Financial Environment (NFE)--into its information security program. For example, it did not fully implement key control activities for the NFE. Until FDIC fully integrates the NFE with the information security program, its ability to maintain adequate system controls over its financial and sensitive information will be limited.