Specifically, it has corrected or  mitigated 16 of the 21 weaknesses that we had previously reported as  unresolved at the completion of the 2006 audit (see app. FDIC stated it has initiated and completed some actions to mitigate the  remaining five prior year weaknesses. However, we have not verified that  these actions have been completed. Weaknesses Continue to Reduce the Security of Financial Information

Although FDIC has made significant progress improving its information  system controls, old and new weaknesses could limit the corporation’s  ability to effectively protect the confidentiality, integrity, and availability  of its financial systems and information. In addition to the five previously  reported weaknesses that remain unresolved, newly identified weaknesses  in access controls and configuration management controls introduce risk  to two key financial systems. Specifically, it did not adequately (1) maintain a full and complete baseline  for system requirements; (2) assign unique identifiers to configuration  items; (3) authorize, document, and report all configuration changes; and  (4) perform configuration audits. FDIC Has Not Fully Implemented Its Information Security Program

FDIC has made important progress in implementing the corporation’s  information security program; however, a key reason for these information  security weaknesses is that FDIC did not always fully implement key  information security program activities. For example, FDIC has  included nonmajor applications in major systems security plans and  developed a new security plan template;  implemented a risk assessment process that identified possible threats and  vulnerabilities to its systems and information, as well as the controls  needed to mitigate potential vulnerabilities;  implemented a test and evaluation process to assess the effectiveness of  information security policies, procedures, and practices;    ensured that vulnerabilities identified during its tests and evaluations are  addressed in its remedial action plans;    established a system for documenting and tracking corrective actions;  recognized that NFE users are not physically or logically separated in  terms of what they are allowed to access within NFE;  implemented an incident handling program, including establishing a team  and associated procedures for detecting, responding to, and reporting  computer security incidents;    developed an incident response policy to review events related to data  loss, disclose, inappropriate access and loss of equipment in the Division  of Finance to determine whether the events are computer security  incidents; and    developed the corporation’s business continuity of operations, updated the  contingency plans and business impact analyses, and assessed the  effectiveness of the plans through testing at a disaster recovery site. For example, it did not adequately  conduct configuration control testing or complete remedial action plans in  a timely manner to include key information. Until FDIC fully performs key  information security program activities, its risk is increased because it  may not be able to maintain adequate control over its financial systems  and information. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to assess (1) the progress the Federal  Deposit Insurance Corporation (FDIC) has made in mitigating previously  reported information security weaknesses and (2) the effectiveness of  FDIC’s controls in protecting the confidentiality, integrity, and availability  of its financial systems and information. FDIC did not use secure e-mail methods to protect the integrity of certain accounting  data transferred over an internal communication network. FDIC did not adequately control physical access to the Virginia Square computer  processing facility.
Why GAO Did This Study

The Federal Deposit Insurance Corporation (FDIC) has a demanding responsibility enforcing banking laws, regulating financial institutions, and protecting depositors. Effective information security controls are essential to ensure that FDIC systems and information are adequately protected from inadvertent misuse, fraudulent, or improper disclosure. As part of its audit of FDIC's 2007 financial statements, GAO assessed (1) the progress FDIC has made in mitigating previously reported information security weaknesses and (2) the effectiveness of FDIC's controls in protecting the confidentiality, integrity, and availability of its financial systems and information. To do this, GAO examined security policies, procedures, reports, and other documents; observed controls over key financial applications; and interviewed key FDIC personnel.

What GAO Found

FDIC has made significant progress in mitigating previously reported information security weaknesses. Specifically, it has corrected or mitigated 16 of the 21 weaknesses that GAO had previously reported as unresolved at the completion of the 2006 audit. For example, FDIC has improved physical security controls over access to its Virginia Square computer processing facility, instructed personnel to use more secure e-mail methods to protect the integrity of certain accounting data transferred over an internal communication network, and updated the security plan and contingency plan of a key financial system. In addition, FDIC stated it has initiated and completed some actions to mitigate the remaining five prior weaknesses. However, we have not verified that these actions have been completed. Although FDIC has made significant progress improving its information system controls, old and new weaknesses could limit the corporation's ability to effectively protect the confidentiality, integrity, and availability of its financial systems and information. In addition to the five previously reported weaknesses that remain unresolved, newly identified weaknesses in access controls and configuration management controls introduce risk to two key financial systems. For example, FDIC did not always implement adequate access controls. Specifically, multiple FDIC users shared the same login ID and password, had unrestricted access to application source code, and used passwords that were not adequately encrypted. In addition, FDIC did not adequately (1) maintain a full and complete baseline for system requirements; (2) assign unique identifiers to configuration items; (3) authorize, document, and report all configuration changes; and (4) perform configuration audits. Although these weaknesses do not pose significant risk of misstatement of the corporation's financial statements, they do increase preventable risk to the corporation's financial systems and information. A key reason for these weaknesses is that FDIC did not always fully implement key information security program activities. For example, it did not adequately conduct configuration control testing or complete the remedial action plan in a timely manner and did not include necessary and key information. Until FDIC fully performs key information security program activities, its ability to maintain adequate control over its financial systems and information will be limited.