FDIC Had Developed and Documented Many Controls to Secure Its Financial Information and Systems, but Improvements Are Still Needed

Although FDIC developed and implemented elements of its information  security program, the corporation did not always implement key program  activities. Additionally, FDIC has designed and documented numerous  information security controls intended to protect its key financial systems;  however, shortcomings existed in the implementation of other information  security controls. By mitigating known information security weaknesses  and ensuring that information security controls are consistently applied,  FDIC could continue to reduce risks and better protect its sensitive  financial information and resources from inadvertent or deliberate misuse,  improper modification, unauthorized disclosure, or destruction. FISMA requires  each agency to develop, document, and implement an information  security program that, among other things, includes plans for providing adequate information security for networks,  facilities, and systems;  security awareness training to inform personnel of information security  risks and of their responsibilities in complying with agency policies  and procedures, as well as training personnel with significant security  responsibilities for information security; policies and procedures that (1) are based on risk assessments, (2)  cost effectively reduce information security risks to an acceptable  level, (3) ensure that information security is addressed throughout the  life cycle of each system, and (4) ensure compliance with applicable  requirements; a process for planning, implementing, evaluating, and documenting  remedial actions to address any deficiencies in its information security  policies, procedures, or practices; and periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls  for every system identified in the agency’s required inventory of major  information systems. Specifically,  during 2014, FDIC implemented 27 of the 36 recommendations  pertaining to unaddressed security weaknesses that we previously  reported, and actions to correct or mitigate the remaining 9  weaknesses were in progress. However, although FDIC had a policy on controlling  physical access to its primary data center, the corporation did not  recertify access to its backup data center because the policy did not  apply to all FDIC data centers. The Office  also reported that FDIC has taken steps to improve its remedial action  processes by creating a strategy outlining planned actions to address  weaknesses in the corporation’s plan of action and milestones  processes. Although FDIC had implemented  numerous controls in these areas, weaknesses continue to challenge the  corporation in ensuring the confidentiality, integrity, and availability of its  information and information systems. In  addition, FDIC did not always effectively monitor server security logs. Although we do not consider these  weaknesses individually or collectively to be either a material weakness  or a significant deficiency for financial reporting purposes, we are  nevertheless making five recommendations in a separate product with  limited distribution for FDIC to address new weaknesses we identified in  this review. Until FDIC takes further steps to mitigate these weaknesses,  the corporation’s sensitive financial information and resources will remain  unnecessarily exposed to increased risk of inadvertent or deliberate  misuse, improper modification, unauthorized disclosure, or destruction. Appendix I: Objective, Scope, and Methodology

The objective of this information security review was to determine the  effectiveness of the Federal Deposit Insurance Corporation’s (FDIC)  controls in protecting the confidentiality, integrity, and availability of its  financial systems and information. The review was conducted as part of  our audit of the FDIC financial statements of the Deposit Insurance Fund  and the Federal Savings and Loan Insurance Corporation Resolution  Fund. To determine whether controls over key financial systems and information  were effective, we considered the results FDIC’s actions to mitigate  previously reported weaknesses that remained open as of December 31,  2013, and performed audit work at FDIC facilities in Arlington, Virginia.
Why GAO Did This Study

FDIC has a demanding responsibility enforcing banking laws, regulating financial institutions, and protecting depositors. Because of the importance of FDIC's work, effective information security controls are essential to ensure that the corporation's systems and information are adequately protected from inadvertent or deliberate misuse, improper modification, unauthorized disclosure, or destruction.
As part of its audits of the 2014 financial statements of the Deposit Insurance Fund and the Federal Savings and Loan Insurance Corporation Resolution Fund administered by FDIC, GAO assessed the effectiveness of the corporation's controls in protecting the confidentiality, integrity, and availability of its financial systems and information. To do so, GAO examined security policies, procedures, reports, and other documents; tested controls over key financial applications; and interviewed FDIC personnel.

What GAO Found

The Federal Deposit Insurance Corporation (FDIC) has implemented numerous information security controls intended to protect its key financial systems; nevertheless, weaknesses remain that place the confidentiality, integrity, and availability of financial systems and information at risk. During 2014, the corporation implemented 27 of the 36 GAO recommendations pertaining to previously reported security weaknesses that were unaddressed as of December 31, 2013; actions to implement the remaining 9 recommendations were in progress. The table below details the status of these recommendations.
Although FDIC developed and implemented elements of its information security program, shortcomings remain in key program activities. For example:
FDIC had taken steps to improve its security policies and procedures, but important activities were not always required by its policies. For example, although FDIC had a policy on controlling physical access to its primary data center, the policy did not apply to all FDIC data centers.
FDIC did not consistently remediate agency-identified weaknesses in a timely manner. However, to its credit, the corporation created a strategy outlining planned actions to address weaknesses in its remedial action processes.
Additionally, FDIC has designed and documented numerous information security controls intended to protect its key financial systems; nevertheless, controls were not always consistently implemented. For example, the corporation had not always (1) ensured that passwords for a financial application complied with FDIC policy for password length or (2) centrally collected audit logs on certain servers.
These weaknesses individually or collectively do not constitute either a material weakness or a significant deficiency for financial reporting purposes. Nonetheless, by mitigating known information security weaknesses and consistently applying information security controls, FDIC could continue to reduce risks and better protect its sensitive financial information and resources from inadvertent or deliberate misuse, improper modification, unauthorized disclosure, or destruction.

What GAO Recommends

GAO is making two recommendations to FDIC to improve its implementation of its information security program. FDIC concurred with GAO's recommendations. In a separate report with limited distribution, GAO is recommending that FDIC take five specific actions to address weaknesses in security controls.