Information Security Weaknesses Placed SEC Financial Data at Risk

Although SEC had implemented and made progress in strengthening  information security controls, weaknesses limited their effectiveness in  protecting the confidentiality, integrity, and availability of a key financial  system. SEC did not consistently control access to this financial system’s  network, servers, applications, and databases; manage its configuration;  segregate duties; and plan for contingencies and disasters. Consequently, SEC’s financial information and systems were exposed to  increased risk of unauthorized access, disclosure, modification, and  disruption. Although SEC had issued policies and implemented controls based on  those policies, it did not consistently protect its network boundary from  possible intrusions; identify and authenticate users; authorize access to  resources; ensure that sensitive data are encrypted; audit and monitor  actions taken on the commission’s systems and network; and restrict  physical access to sensitive assets. During fiscal year 2013, SEC implemented segregation of duties controls  for key information technology processes. However, production servers for the key financial system had active  development user accounts. Although SEC had developed contingency and disaster recovery plans  and implemented controls for this planning, it did not (1) update its  contingency and disaster recovery plans to reflect its computing  environment, (2) test disaster recovery procedures to ascertain recovery  after the move to its newly built data center, and (3) ensure redundancy of  a critical server for the key financial system. SEC Did Not Effectively Oversee and Manage the Implementation of Information Security Controls during Migration of a Key Financial System

The information security weaknesses existed in the key financial system,  in part, because SEC did not effectively oversee and manage the  implementation of information security controls during the migration of the  system to a new production environment. Specifically, (1)  SEC’s Information Security Risk Committee did not identify and convey  risks related to the data center move (and to the system) to the agency’s  Operational Risk Management Program Office, which is responsible for  developing and overseeing SEC’s operational risk management and  internal control program and evaluating the results of internal control  reviews and information technology system reviews performed by the  internal control divisions and offices; (2) SEC did not perform a security  impact analysis after the system servers were rebuilt and major changes  were made to the systems; and (3) SEC did not act to mitigate security- related risks identified and communicated in the system’s weekly status  reports by the contractor prior to the go-live date. Until SEC mitigates its control deficiencies and strengthens oversight of  contractors performing security-related tasks as part of its information  security program, it will continue to be at risk of ongoing deficiencies in  the security controls over its financial and support systems and the  information they contain. II), SEC generally agreed with  our recommendations. This report contains recommendations to you. Appendix I: Objective, Scope, and Methodology

As part of our audit of the Securities and Exchange Commission’s (SEC)  fiscal years 2012 and 2013 financial statements, we assessed the  commission’s information security controls. The objective was to  determine the effectiveness of SEC’s information security controls for  ensuring the confidentiality, integrity, and availability of its key financial  systems and information.
Why GAO Did This Study

SEC is responsible for enforcing securities laws, issuing rules and regulations that protect investors, and helping to ensure that securities markets are fair and honest. In carrying out its mission, the commission relies extensively on computerized systems that collect and process financial and sensitive information. Accordingly, it is essential that SEC have effective information security controls in place to protect this information from misuse, fraudulent use, improper disclosure, manipulation, or destruction.
As part of its audit of SEC's fiscal years 2013 and 2012 financial statements, GAO assessed the commission's information security controls. The objective was to determine the effectiveness of information security controls for protecting the confidentiality, integrity, and availability of SEC's key financial systems and information. To do this, GAO assessed security controls in key areas by reviewing SEC documents, testing selected systems, and interviewing relevant officials.

What GAO Found

Although the Securities and Exchange Commission (SEC) had implemented and made progress in strengthening information security controls, weaknesses limited their effectiveness in protecting the confidentiality, integrity, and availability of a key financial system. For this system's network, servers, applications, and databases, weaknesses in several controls were found, as the following examples illustrate:
Access controls: SEC did not consistently protect its system boundary from possible intrusions; identify and authenticate users; authorize access to resources; encrypt sensitive data; audit and monitor actions taken on the commission's networks, systems, and databases; and restrict physical access to sensitive assets.
Configuration and patch management: SEC did not securely configure the system at its new data center according to its configuration baseline requirements. In addition, it did not consistently apply software patches intended to fix vulnerabilities to servers and databases in a timely manner.
Segregation of duties: SEC did not adequately segregate its development and production computing environments. For example, development user accounts were active on the system's production servers.
Contingency and disaster recovery planning: Although SEC had developed contingency and disaster recovery plans, it did not ensure redundancy of a critical server.
The information security weaknesses existed, in part, because SEC did not effectively oversee and manage the implementation of information security controls during the migration of this key financial system to a new location. Specifically, during the migration, SEC did not (1) consistently oversee the information security-related work performed by the contractor and (2) effectively manage risk.
Until SEC mitigates control deficiencies and strengthens the implementation of its security program, its financial information and systems may be exposed to unauthorized disclosure, modification, use, and disruption. These weaknesses, considered collectively, contributed to GAO's determination that SEC had a significant deficiency in internal control over financial reporting for fiscal year 2013.

What GAO Recommends

GAO is recommending that SEC take two actions to (1) more effectively oversee contractors performing security-related tasks and (2) improve risk management. In a separate report for limited distribution, GAO is recommending that SEC take 49 specific actions to address weaknesses in security controls. In commenting on a draft of this report, SEC generally agreed with GAO's recommendations and described steps it is taking to address them.