SEC Has Made Important Progress Correcting Previously Reported Weaknesses and Improving Security

SEC has corrected or mitigated 8 of the 20 security control weaknesses  that we had reported as unresolved at the time of our previous audit. For  example, SEC has    documented authorizations for software modifications,    developed a comprehensive program for monitoring access activities to  its computer network environment, and tested and evaluated the effectiveness of controls for the general ledger  system. SEC has also  developed remedial action plans to mitigate identified weaknesses in its  systems and developed a mechanism to track the progress of the actions  taken to correct deficiencies. A key reason for its progress in these areas is that SEC senior management  has been actively engaged in mitigating the previously reported  weaknesses. While SEC has made important progress in strengthening its information  security controls, it has not completed actions to correct or mitigate 12  previously reported weaknesses. In addition, SEC has not adequately controlled access to  its facility. Significant Control Deficiencies Place SEC’s Internal Financial Information at Risk

Controls intended to restrict access to data and systems, as well as in  other information security controls, insufficiently protect the  confidentiality, integrity, and availability of SEC financial systems and  information. Specifically, SEC did not adequately restrict user privileges to the  minimum access employees needed to perform their job-related duties on  several of its enterprise databases. SEC did not always ensure that sensitive data was protected by  encryption. As a result, increased risk  exists that unauthorized individuals could gain access to sensitive  computing resources and data and inadvertently or deliberately misuse or  destroy them. SEC continues to have difficulty implementing certain configuration  management controls. SEC Has Not Fully Implemented Its Information Security Program

Although SEC has made important progress in implementing its  information security program, a key reason for these weaknesses is that  SEC has not effectively or fully implemented key program activities. Among other things, FISMA requires agencies to develop,  document, and implement    periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information or information systems;   plans for providing adequate information security for networks,  facilities, and systems;   security awareness training to inform personnel of information security  risks and of their responsibilities in complying with agency policies and  procedures, as well as training personnel with significant security  responsibilities for information security;    periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices performed with a  frequency depending on risk, but no less than annually, that includes  testing of management, operational, and technical controls for every  system identified in the agency’s required inventory of major  information systems;   a process for planning, implementing, evaluating, and documenting  remedial actions to address any deficiencies in information security  policies, procedures, and practices of the agency;   procedures for detecting, reporting, and responding to security    plans and procedures to ensure continuity of operations for  information systems that support the operations and assets of the  agency. For example, security plans for  certain enterprise database applications were incomplete, information  security training for key personnel was not sufficiently documented and  monitored, security tests and evaluations of enterprise database  applications were not comprehensive, and continuity of operations plans  were not always complete. 2. 3. 4. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were (1) to determine the status of the  Securities and Exchange Commission’s (SEC) actions to correct or  mitigate previously reported information security weaknesses and (2) to  determine whether controls over key financial systems were effective in  ensuring the confidentiality, integrity, and availability of financial and  sensitive information.
Why GAO Did This Study

In carrying out its mission to ensure that securities markets are fair, orderly, and efficiently maintained, the Securities and Exchange Commission (SEC) relies extensively on computerized systems. Integrating effective information security controls into a layered control strategy is essential to ensure that SEC's financial and sensitive information are protected from inadvertent or deliberate misuse, disclosure, or destruction. As part of its audit of SEC's fiscal year 2007 financial statements, GAO assessed (1) the status of SEC's actions to correct previously reported information security weaknesses and (2) the effectiveness of SEC's controls for ensuring the confidentiality, integrity, and availability of its information systems and information. To do this, GAO examined security plans, policies, and practices; interviewed pertinent officials; and conducted tests and observations of controls in operation.

What GAO Found

SEC has made important progress toward correcting previously reported information security control weaknesses. Specifically, it has corrected or mitigated 8 of 20 weaknesses previously reported as unresolved at the time of our prior audit. For example, SEC has documented authorizations for software modifications, developed a comprehensive program for monitoring access activities to its computer network environment, and tested and evaluated the effectiveness of controls for the general ledger system. In addition, the commission has made progress in improving its information security program. To illustrate, it has developed remedial action plans to mitigate identified weaknesses in its systems and developed a mechanism to track the progress of actions to correct deficiencies. A key reason for its progress is that SEC senior management has been actively engaged in implementing information security activities. Nevertheless, SEC has not completed actions to correct 12 previously reported weaknesses. For example, SEC workstations are susceptible to malicious code attacks and perimeter security is not properly implemented at its Operations Center. Significant control weaknesses intended to restrict access to data and systems, as well as other information security controls, continue to threaten the confidentiality, integrity, and availability of SEC's financial and sensitive information and information systems. SEC has not consistently implemented effective controls to prevent, limit, or detect unauthorized access to computing resources. For example, it did not always (1) consistently enforce strong controls for identifying and authenticating users, (2) limit user access to only those individuals who need such access to perform their job functions, (3) encrypt sensitive data, (4) log and monitor security related events, (5) physically protect its computer resources, and (6) fully implement certain configuration management controls. A key reason for these weaknesses is that SEC has not yet fully implemented its information security program to ensure that controls are appropriately designed and operating effectively. Specifically, SEC has not effectively or fully implemented key program activities. For example, security plans for certain enterprise database applications were incomplete, information security training for certain key personnel was not sufficiently documented and monitored, security tests and evaluations of enterprise database applications were not comprehensive, and continuity of operations plans were not always complete. As a result, SEC is at increased risk of unauthorized access to and disclosure, modification, or destruction of its financial information, as well as inadvertent or deliberate disruption of its financial systems, operations, and services.