Although SEC Strengthened Its Controls, Information Security Deficiencies Placed Financial Data at Risk

During GAO’s fiscal year 2016 audit, SEC had demonstrated  considerable progress in improving information security by implementing  47 of the 58 recommendations we had made in prior audits that had not  been implemented by the conclusion of the fiscal year 2015 audit. In addition, 15 deficiencies identified during the fiscal year 2016 audit  limited the effectiveness of SEC’s controls for protecting the  confidentiality, integrity, and availability of its information systems. For  example, the commission did not consistently control logical access to its  financial and general support systems. It also used unsupported software  to process financial data. These  deficiencies existed, in part, because the commission did not fully  implement key elements of its information security program. The newly identified deficiencies resulted in 2 recommendations to SEC  to more fully implement aspects of its information security program and  13 recommendations to enhance access controls and other security  controls over its financial systems. Cumulatively, the deficiencies decreased assurance about the reliability  of the data processed by key SEC financial systems. While not  individually or collectively constituting a material weakness or significant  deficiency, these deficiencies warrant SEC management’s attention. Until  SEC mitigates these deficiencies, its financial and support systems and  the information they contain will continue to be at unnecessary risk of  compromise. Nevertheless, SEC had not fully mitigated 11 of the 58 previously  reported deficiencies affecting its financial and general support systems. Although SEC had issued policies and implemented controls based on  those policies, it did not consistently: (1) protect its network boundaries  from possible intrusions; (2) identify and authenticate users; (3) authorize  access to resources; (4) audit and monitor actions taken on the  commission’s systems and network; and (5) encrypt sensitive information  while in transmission. SEC improved several configuration management controls for its financial  information systems. In  particular, SEC did not always update system security plans or fully  implement its continuous monitoring capability. Further, deficiencies exist in part because SEC did not maintain up-to- date network diagrams and asset inventories in the system security plans  for GSS and a key financial system to accurately and completely reflect  the current operating environment, and it also did not fully implement and  continuously monitor GSS and the key financial system’s secure  configurations. Appendix I: Objective, Scope, and Methodology

Pursuant to statutory authority, GAO assesses the effectiveness of the  Securities and Exchange Commission’s (SEC) internal control structure  and procedures for financial reporting. Our objective was to determine the  effectiveness of SEC’s information security controls for ensuring the  confidentiality, integrity, and availability of its key financial systems and  information. To assess information systems controls, we identified and  reviewed SEC information systems control policies and procedures,  conducted tests of controls, and held interviews with key security  representatives and management officials concerning whether  information security controls were in place, adequately designed, and  operating effectively. This work was performed to support our opinion on  SEC’s internal control over financial reporting as of September 30, 2016.
Why GAO Did This Study

SEC enforces securities laws, issues rules and regulations that provide protection for investors, and helps to ensure that securities markets are fair and honest. SEC uses computerized information systems to collect, process, and store sensitive information, including financial data. Having effective information security controls in place is essential to protecting these systems and the information they contain.
Pursuant to statutory authority, GAO assesses the effectiveness of SEC's internal control structure and procedures for financial reporting. As part of its audit of SEC's fiscal years 2016 and 2015 financial statements, GAO assessed whether controls were effective in protecting the confidentiality, integrity, and availability of key financial systems and information. To do this, GAO examined SEC's information security policies and procedures, tested controls, and interviewed key officials on whether controls were in place, adequately designed, and operating effectively.

What GAO Found

The Securities and Exchange Commission (SEC) improved the security controls over its key financial systems and information. In particular, as of September 2016, the commission had resolved 47 of the 58 recommendations we had previously made that had not been implemented by the conclusion of the FY 2015 audit. However, SEC had not fully implemented 11 recommendations that included consistently protecting its network boundaries from possible intrusions, identifying and authenticating users, authorizing access to resources, auditing and monitoring actions taken on its systems and network, or encrypting sensitive information while in transmission.
In addition, 15 newly identified control deficiencies limited the effectiveness of SEC's controls for protecting the confidentiality, integrity, and availability of its information systems. For example, the commission did not consistently control logical access to its financial and general support systems. In addition, although the commission enhanced its configuration management controls, it used unsupported software to process financial data. Further, SEC did not adequately segregate incompatible duties for one of its personnel. These weaknesses existed, in part, because SEC did not fully implement key elements of its information security program. For example, SEC did not maintain up-to-date network diagrams and asset inventories in its system security plans for its general support system and its key financial system application to accurately and completely reflect the current operating environment. The commission also did not fully implement and continuously monitor those systems' security configurations. Twenty-six information security control recommendations related to 26 deficiencies found in SEC's financial and general support systems remained unresolved as of September 30, 2016. (See table.)
Cumulatively, the deficiencies decreased assurance about the reliability of the data processed by key SEC financial systems. While not individually or collectively constituting a material weakness or significant deficiency, these deficiencies warrant SEC management's attention. Until SEC mitigates these deficiencies, its financial and support systems and the information they contain will continue to be at unnecessary risk of compromise.

What GAO Recommends

In addition to the 11 prior recommendations that have not been fully implemented, GAO recommends that SEC take 13 actions to address newly identified control deficiencies and 2 actions to more fully implement its information security program. In commenting on a draft of this report, SEC concurred with GAO's recommendations.