The corporation relies extensively on computerized systems to support its  financial operations and store the sensitive information it collects. Objectives, Scope, and Methodology

The objectives of our review were to assess (1) the progress FDIC has  made in correcting or mitigating remaining information system control  weaknesses reported as unresolved at the time of our prior review in 2004  and (2) the effectiveness of the corporation’s information system controls  for protecting the confidentiality, integrity, and availability of computerized  data. FDIC Has Made Progress Correcting Previously Reported Weaknesses

FDIC has taken steps to address security control weaknesses. The  corporation has corrected or mitigated 18 of the 24 weaknesses that we  previously reported as unresolved. Control Weaknesses Place Financial and Sensitive Data at Risk

FDIC has not effectively implemented information security controls to  properly protect the confidentiality, integrity, and availability of its  financial and sensitive information and information systems. In addition to  the 6 previously reported weaknesses that remain uncorrected, we  identified 20 new information security weaknesses during this review. Most  of the identified weaknesses pertain to access controls. Organizations  accomplish this objective by designing and implementing controls that are  intended to prevent, limit, and detect unauthorized access to computing  resources, programs, and information. Access controls include (1) user  accounts and passwords, (2) access rights and permissions, (3) network  services, (4) configuration assurance, (5) audit and monitoring of security- related events, and (6) physical security. As reported in calendar year 2004, and once again recurring this year, the  corporation did not consistently implement effective application change  controls. However, a key reason for the weaknesses in FDIC’s information system  controls is that the corporation has not fully implemented elements of its  information security program. As a result, FDIC  has less assurance that its systems and information are sufficiently  protected. The severity of these weaknesses was  such that we reported information system control weaknesses to be a  reportable condition in our 2005 financial audit report since financial and  sensitive information are at increased risk of unauthorized access,  modification, and/or disclosure, possibly without detection. Recommendations for Executive Action

To help fully implement the corporation’s information security program, we  recommend that the FDIC Chairman take the following five actions:  consistently implement the corporation’s documented policies and  procedures related to information security,  include security plans or requirements for nonmajor applications into  the plans for general support systems,  provide specialized training to individuals with significant security   report weaknesses as closed in remedial action plans only when  corrective actions have been completed, and  update continuity of operations plans and test them for the New  Financial Environment.
Why GAO Did This Study

The Federal Deposit Insurance Corporation (FDIC) has a demanding responsibility enforcing banking laws, regulating financial institutions, and protecting depositors. The corporation relies extensively on computerized systems to support and carry out its financial and mission-related operations. As part of the audit of the calendar year 2005 financial statements, GAO assessed (1) the progress FDIC has made in correcting or mitigating information security weaknesses previously reported and (2) the effectiveness of the corporation's information system controls to protect the confidentiality, integrity, and availability of its key financial information and information systems.

What GAO Found

FDIC has made progress in correcting previously reported weaknesses. Specifically, the corporation has corrected or mitigated 18 of the 24 weaknesses that GAO previously reported as unresolved at the time of the last review. Among actions FDIC has taken are developing and implementing procedures to comply with its computer file naming convention standards and developing and implementing automated procedures for limiting access to sensitive information. Nevertheless, FDIC has not consistently implemented information security controls to properly protect the confidentiality, integrity, and availability of its financial and sensitive information and information systems. In addition to the remaining six previously reported weaknesses for which FDIC has not completed corrective actions, GAO identified 20 new information security weaknesses. Most identified weaknesses pertain to access controls over (1) user accounts and passwords; (2) access rights and permissions; (3) network services; (4) configuration assurance; (5) audit and monitoring of security-related events; and (6) physical security that are to prevent, limit, or detect access to its critical financial and sensitive systems and information. In addition, weaknesses exist in other information security controls relating to segregation of duties and application change controls. A key reason for these weaknesses is that FDIC has not fully implemented elements of its information security program. For example, it has not consistently implemented its security-related policies, addressed security plans for certain applications, provided specialized training to individuals with significant security responsibilities, implemented remedial action plans for resolving known weaknesses, and updated or tested continuity plans in light of its implementation of the new financial environment. As a result, financial and sensitive information are at increased risk of unauthorized access, modification, and/or disclosure, possibly without detection. Because of this, GAO reported information system control weaknesses to be a reportable condition in 2005.