Information Security: Federal Deposit Insurance Corporation Needs to Sustain Progress
Published: 2005-05-19T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Federal Deposit Insurance Corporation (FDIC) relies extensively on computerized systems to support its financial and mission-related operations. As part of GAO's audit of the calendar year 2004 financial statements for the three funds administered by FDIC, GAO assessed (1) the progress FDIC has made in correcting or mitigating information system control weaknesses identified in our audits for calendar years 2002 and 2003 and (2) the effectiveness of the corporation's information system general controls.
section_title: What GAO Found
paragraphs: FDIC has made significant progress in correcting previously reported information system control weaknesses and has taken other steps to improve information security. Of the 22 weaknesses reported in GAO's 2003 audit, FDIC corrected 19 and is taking action to resolve the 3 that remain. In addition, it corrected the one weakness still open from GAO's 2002 audits. Although FDIC has made substantial improvements in its information system controls, GAO identified additional weaknesses that diminish FDIC's ability to effectively protect the integrity, confidentiality, and availability of its financial and sensitive information systems. These included weaknesses in electronic access controls, network security, segregation of computer functions, physical security, and application change control. Although these do not pose significant risks to FDIC's financial and sensitive systems, they warrant management's action to decrease the risk of unauthorized modification of data and programs, inappropriate disclosure of sensitive information, or disruption of critical operations. A key reason for FDIC's weaknesses in information system controls is that it had not fully implemented a complete test and evaluation process, which is a key element of a comprehensive agency information security program with effective controls. Although FDIC has made substantial progress in implementing its information security program and has enhanced its process to test and evaluate its information system controls, it did not ensure that all key control areas supporting FDIC's financial environment are routinely reviewed and tested. These control areas included electronic access, network security, and audit logging.

section_title: Letter
paragraphs: Effective information system controls are essential to ensuring that  financial information is adequately protected from inadvertent or  deliberate misuse, fraudulent use, improper disclosure, or destruction.  These controls also affect the integrity, confidentiality, and availability of  nonfinancial information maintained by Federal Deposit Insurance  Corporation (FDIC), such as personnel and bank examination information.
As part of our audit of the calendar year 2004 financial statements for  FDIC’s Bank Insurance Fund, Savings Association Fund, and FSLIC  (Federal Savings and Loan Insurance Corporation) Resolution Fund, we  assessed (1) the progress FDIC has made in correcting or mitigating  information system control weaknesses reported in our prior audits for  calendar years 2002 and 2003 and (2) the effectiveness of the  corporation’s information system general controls. In a separate report  designated for “Limited Official Use Only,” we are making  recommendations to correct the specific weaknesses identified.
We performed our review at FDIC headquarters in Washington, D.C., and its  computer facility in Arlington, Virginia, from September 2004 through  February 2005. Our review was performed in accordance with generally  accepted government auditing standards.
subsections: section_title: Background
paragraphs: Congress created FDIC in 1933 to restore and maintain public confidence  in the nation’s banking system. The Financial Institutions Reform,  Recovery, and Enforcement Act of 1989 sought to reform, recapitalize, and  consolidate the federal deposit insurance system. The act created the  Bank Insurance Fund and the Savings Association Insurance Fund, both of  which are responsible for protecting insured bank and thrift depositors.  The act also abolished the FSLIC and created the FSLIC Resolution Fund to  complete the affairs of the former FSLIC and liquidate the assets and  liabilities transferred from the former Resolution Trust Corporation. It also  designated FDIC as the administrator of these funds. As part of this  function, FDIC has an examination and supervision program to monitor the  safety of deposits held in member institutions.
FDIC insures deposits in excess of $10 trillion for about 8,900 institutions.  Together, the three funds—the Bank Insurance Fund, the Savings  Association Insurance Fund, and the FSLIC Resolution Fund—have about  $52 billion in assets. FDIC had a budget of about $1.1 billion for calendar  year 2004 to support its activities in managing the three funds. For that  year, it processed more than 3.8 million financial transactions.
FDIC relies extensively on computerized systems to support its financial  operations and store the sensitive information it collects. Its local and wide  area networks interconnect these systems. To support its financial  management functions, it relies on several financial systems to process and  track financial transactions that include premiums paid by its member  institutions and disbursements made to support operations. In addition,  FDIC uses other systems that maintain personnel information for its  employees, examination data for financial institutions, and legal  information on closed institutions. At the time of our review, about 6,200  individuals were authorized to use FDIC’s systems. The corporation’s key  official for computer security is the Chief Information Officer, who is  responsible for establishing, implementing, and overseeing a  corporatewide information security program.
Information system controls are a critical consideration for any  organization that depends on computerized systems and networks to carry  out its mission or business. Without proper safeguards, there is risk that  individuals and groups with malicious intent may intrude into inadequately  protected systems and use this access to obtain sensitive information,  commit fraud, disrupt operations, or launch attacks against other computer  systems and networks.
We have reported information security as a governmentwide high-risk area  since February 1997. Our previous reports, and those of agency inspectors  general, describe persistent information security weaknesses that place a  variety of federal operations, including those at FDIC, at risk of disruption,  fraud, and inappropriate disclosure.
Congress and the executive branch have taken action to address the risks  associated with persistent information security weaknesses. In December  2002, the Federal Information Security Management Act (FISMA) of 2002,  which is intended to strengthen information security, was enacted as Title  III of the E-Government Act of 2002. In addition, the administration  undertook important actions to improve security, such as integrating  information security into the President’s Management Agenda Scorecard.  Moreover, the Office of Management and Budget and the National Institute  of Standards and Technology (NIST) have issued information security  guidance to agencies.
section_title: Objectives, Scope, and Methodology
paragraphs: The objectives of our review were to assess (1) the progress FDIC had  made in correcting or mitigating weaknesses reported in connection with  our financial statement audits for calendar years 2002 and 2003 and (2)  the effectiveness of the corporation’s information system controls. Our  evaluation was based on (1) our Federal Information System Controls  Audit Manual (FISCAM), which contains guidance for reviewing  information system controls that affect the integrity, confidentiality, and  availability of computerized data and (2) our May 1998 report on security  management best practices at leading organizations, which identifies key  elements of an effective information security program.
Specifically, we evaluated information system controls intended to  prevent, limit, and detect electronic access to computer resources (data,  programs, and systems), thereby protecting these resources against  unauthorized disclosure, modification, and use;  provide physical protection of computer facilities and resources from  espionage, sabotage, damage, and theft;   ensure that work responsibilities for computer functions are segregated  so that no one individual controls all key aspects of a computer-related  operation and thereby has the ability to conduct unauthorized actions or  gain unauthorized access to assets or records without detection by  another individual performing assigned responsibilities;  prevent the implementation of unauthorized changes to application or   ensure recovery of computer process operations and data in case of  disaster or other unexpected interruption; and  ensure an adequate information security program.
To evaluate these controls, we identified and reviewed pertinent FDIC  security policies and procedures, guidance, plans, and reports. We also  discussed whether information system controls were in place, adequately  designed, and operating effectively with key security representatives,  system administrators, and management officials. In addition, we  conducted tests and observations of controls in operation and reviewed  corrective actions taken by the corporation to address vulnerabilities  identified in our audits for calendar years 2002 and 2003.
section_title: FDIC Has Made Significant Progress in Correcting Weaknesses and Implementing Controls
paragraphs: FDIC has made significant progress in correcting previously reported  information system control weaknesses. Of the 22 weaknesses reported in  our 2003 audit, FDIC corrected 19 and is taking action to resolve the 3 that  remain. In addition, the corporation corrected the one weakness still open  from our 2002 audit. FDIC’s actions included resolving weaknesses  related to its key access controls, network security, and monitoring  capabilities. For example, the corporation  restricted user access to critical financial and sensitive data and   strengthened security configurations of network devices, including  firewalls, routers, switches, and servers; and   enhanced its monitoring of security-relevant events by fully  implementing its intrusion detection system to monitor its computer  network traffic for unusual or suspicious access activities.
In addition to addressing previously reported weaknesses, FDIC took other  steps to improve information security. For example, the corporation  strengthened its oversight of contractor connections to its network by  requiring contractors to develop security plans to protect these  connections and to perform periodic inspections of contractor facilities to  ensure security effectiveness. Further, FDIC established certification and  accreditation guidelines that outline requirements for performing this  process as part of each system’s life cycle and certified and accredited each  of its key systems. In addition, the corporation updated its disaster  recovery procedures and has been routinely performing different types of  tests of its disaster recovery plan.
section_title: Weaknesses in Information System Controls
paragraphs: Although FDIC made substantial improvements in its information system  controls, we identified 20 additional weaknesses that diminish its ability to  effectively protect the integrity, confidentiality, and availability of its  financial and sensitive information and information systems. Specifically,  we identified weaknesses in electronic access controls, network security,  physical security, segregation of computer functions, and application  change controls. Although these information system control weaknesses  do not pose significant risks to FDIC’s financial and sensitive systems, they  warrant management’s action to decrease the risk of unauthorized  modification of data and programs, inappropriate disclosure of sensitive  information, or disruption of critical operations.
subsections: section_title: Electronic Access Controls
paragraphs: A basic management control objective for any organization is the  protection of its information systems and critical data from unauthorized  access. Organizations accomplish this objective by granting employees the  authority to read, create, or modify only those programs and data that they  need to perform their duties. Effective electronic access controls should be  designed to restrict access to computer programs and data and detect  unauthorized access. These controls include assigning user access rights  and permissions and reviewing audit logs to ensure that access privileges  are used appropriately.
Although FDIC restricted access to programs and information, we found  instances in which access was not sufficiently controlled. For example,  about 250 users were inadvertently granted access to read, create, or  modify critical production programs and data for financial,  payroll/personnel, and bank regulatory systems. The risk of weakening  security access was further heightened because the access activities of  these users were not being logged for review. In addition, emergency  access accounts with broad system access to all critical system and  security resources intended to be used solely to manage problems or  emergencies that interrupt the system’s 24-hour-a-day operation were  routinely used by four system and operations staff. Further, FDIC did not  configure security software to appropriately restrict, log, and monitor  access to certain sensitive system software libraries. As a result, increased  risk exists that individuals could circumvent security controls to read,  create, or modify critical or sensitive programs and data, possibly without  detection.
In response to these weaknesses, FDIC’s Chief Information Officer said  that they have taken steps to restrict access to critical financial data and  program and related sensitive information. Further, the corporation stated  that it has restricted access to sensitive system software libraries and plans  to generate monthly audit reports for review and follow-up action as  needed.
section_title: Network Security
paragraphs: Networks are a series of interconnected devices and software that allow  individuals to share data and computer programs. Because sensitive  programs and data are stored on network servers or transmitted along  networks, effectively securing networks is essential to protecting  computing resources and data from unauthorized access, manipulation,  and use. Organizations secure their networks, in part, by installing and  configuring network devices that permit authorized network service  requests and deny unauthorized requests and by limiting the services that  are available on the network. Network devices include (1) firewalls  designed to prevent unauthorized access to and from the network, (2)  routers that filter and forward data along the network, (3) switches that  forward information among parts of a network, and (4) servers that host  applications and data. Network services consist of protocols for  transmitting data between network devices. In addition, effective network  controls, such as passwords, should be established to authenticate  authorized users who access the network from local and remote locations.  Since networks often provide the entry point for access to electronic  information assets, failure to secure them increases the risk of  unauthorized use of sensitive data and systems.
Although FDIC’s network controls were generally effective, we identified  instances where FDIC did not adequately secure specific network services  and devices or protect passwords. For example, database server  configurations for some of the corporation’s financial applications were not  adequately secured. These servers had insecure settings that could have  allowed an unauthorized user to gain access without providing  authentication. In addition, FDIC did not have controls in place to  consistently ensure that data transmitted between network devices were  secure. Further, the passwords of local network administrators who had  broad system access privileges were not adequately secured. As a result,  increased risk exists that a malicious user could gain unauthorized access  to some of FDIC’s sensitive network systems, read and modify sensitive  system data, and disrupt or deny computer processing services to  corporation employees.
In response to these weaknesses, FDIC’s Chief Information Officer said  that the corporation had taken steps to improve network security including  strengthening server settings, data transmission, and administrator  passwords.
section_title: Physical Security
paragraphs: Physical security controls are important for protecting computer facilities  and resources from espionage, sabotage, damage, and theft. These controls  involve restricting physical access to computer resources, usually by  limiting access to the buildings and rooms in which the resources are  housed and by periodically reviewing access rights granted to ensure that  access continues to be appropriate based on criteria established for  granting it. At FDIC, physical access control measures (such as guards,  badges, and locks, used either alone or in combination) are vital to  protecting computing resources and the sensitive data it processes from  external and internal threats.
Although FDIC had taken numerous actions to strengthen its physical  security over its computing environment, certain weaknesses reduced its  effectiveness in protecting and controlling physical access to sensitive  work areas. For example, 4 employees and contractors had access to the  computer data center even though they had changed their job  responsibilities and no longer required this access. As a result, there is an  increased risk that unauthorized individuals could gain access to sensitive  computing resources and data and inadvertently or deliberately misuse or  destroy them.
In response, FDIC’s management plans to update procedures to ensure that  physical access to the data center is limited to authorized individuals.
section_title: Segregation of Computer Functions
paragraphs: Segregation of computer functions refers to the policies, procedures, and  organizational structure that helps ensure that one individual cannot  independently control all key aspects of a process or computer-related  operation and, thereby, gain unauthorized access to assets or records.  Often segregation of computer functions is achieved by dividing  responsibilities among two or more organizational groups. Dividing duties  among two or more individuals or groups diminishes the likelihood that  errors and wrongful acts will go undetected because the activities of one  individual or group will serve as a check on the activities of the others.  Inadequate segregation of computer functions increases the risk that  erroneous or fraudulent transactions could be processed, improper  program changes implemented, and computer resources damaged or  destroyed.
Although computer responsibilities were generally properly segregated at  FDIC, we identified one instance in which responsibilities were not  adequately segregated: system administrators were also serving as  database administrators for systems that maintained FDIC’s key financial  information. The risk associated with this weakness was further  heightened because these administrators could take full control over the  financial applications and databases that include audit and reconciliation  data. Consequently, there is an increased risk that these individuals could  perform unauthorized system activities without being detected.
In response to this weakness, FDIC’s Chief Information Officer said that  the corporation plans to segregate the duties of system and database  administrator functions.
section_title: Application Change Controls
paragraphs: It is important to ensure that only authorized and fully tested application  programs are placed in operation. To ensure that changes to application  programs are needed, work as intended, and do not result in the loss of  data or program integrity, such changes should be authorized, tested, and  independently reviewed.
Although FDIC had application change control procedures for its general  ledger and accounts payable mainframe applications, it did not have  procedures for documenting tests performed or independent reviews made  for changes made to other key mainframe and client/server financial  applications. In addition, the corporation did not have a process for  authorizing changes to Web-based financial applications. Without adequate  application change control procedures, changes may be implemented that  are not authorized, tested, or independently reviewed.
In response, FDIC’s Chief Information Officer plans to establish procedures  for documenting tests performed and independent reviews made for  application software changes made to all mainframe and client/server  application software. In addition, the corporation plans to establish a  process for authorizing changes to Web-based financial applications.
section_title: FDIC Has Made Substantial Progress Implementing Information Security Program but Has Not Completed Key Element
paragraphs: A key reason for FDIC’s weaknesses in information system controls is that  it had not fully implemented a complete test and evaluation process, which  is a key element of a comprehensive agency information security program.  Our May 1998 study of security management best practices determined  that a comprehensive information security program is essential to ensuring  that information system controls work effectively on a continuing basis.  Also, FISMA, consistent with our study, requires an agency’s information  security program to include certain key elements. These elements include  a central information security management structure to provide overall  security policy and guidance along with oversight to ensure compliance  with established policies and reviews of the effectiveness of the  information security environment;  periodic assessments of the risk and magnitude of the harm that could  result from unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems;  policies and procedures that (1) are based on risk assessments, (2) cost  effectively reduce risks, (3) ensure that information security is  addressed throughout the life cycle of each system, and (4) ensure  compliance with applicable requirements;  security awareness training to inform personnel, including contractors  and other users of information systems, of information security risks  and their responsibilities in complying with agency policies and  procedures; and  a process of tests and evaluations of the effectiveness of information  security policies, procedures, and practices relating to management,  operational, and technical controls of every major information system  identified in the agency’s inventories.
FDIC has made substantial progress in establishing a comprehensive  information security program. The corporation strengthened its central  information security management structure by providing additional staff  resources to oversee the program. Further, the corporation initiated a  program to routinely perform risk assessments on all major systems. In  addition, FDIC updated its overall security policies covering network  security, computer center access, and security management and it  developed security plans for all key systems. Also, the corporation  continued to enhance its security awareness program by adding specialized  training for selected technical staff.
Although FDIC enhanced its process to test and evaluate its information  system controls, it did not ensure that all key control areas supporting the  corporation’s financial environment were routinely reviewed and tested.  These areas included electronic access controls, network security, and  audit logging. During the past year, FDIC strengthened its test and  evaluation process to cover additional key information system control  areas, provide for independent tests of corrective actions, and assess and  test newly-identified weaknesses and emerging security threats. Although  FDIC established a process to test and evaluate network and mainframe  information system controls, its program did not include routine  evaluations of network desktop and database application controls. Further,  the process did not include comprehensive tests to ensure that electronic  access to key financial programs and data (1) were restricted to only those  users who need it to perform their job functions and (2) had appropriate  audit logs maintained to record security-relevant events for subsequent  review. Without routine tests and evaluations of all key information system  control areas, FDIC will have limited assurance that its financial and  sensitive information is adequately protected.
Incorporating these key areas into its test and evaluation process should  allow FDIC to better identify and correct security problems, such as those  identified in our 2004 audit. Further, the corporation’s implementation of  new financial systems in the coming year will significantly change the  nature of its information systems environment and of the related  information systems controls necessary for their effective operation.  Consequently, a comprehensive test and evaluation process that includes  these areas will be essential to ensure that the corporation’s financial and  sensitive information will be adequately protected in this new environment.
In response, FDIC’s Chief Information Officer said that the corporation will  continue to take steps to enhance its overall test and evaluation process to  ensure an effective security environment.
section_title: Conclusions
paragraphs: FDIC has made significant progress in correcting the information system  control weaknesses we previously identified and has taken other steps to  improve information security. Although we identified weaknesses in  information system controls involving electronic access, network security,  segregation of computer functions, physical security, and application  change control, these weaknesses do not pose significant risks to FDIC’s  financial and sensitive systems. Accordingly, we concluded that  weaknesses in information system controls at the corporation no longer  constitute a reportable condition, as stated in our audit of the calendar  year 2004 financial statements for FDIC’s three funds. However, they  warrant action by the FDIC management to decrease the risk of  unauthorized modification of data and programs, inappropriate disclosure  of sensitive information, or disruption of critical operations.
A key reason for FDIC’s weaknesses in information system controls is that  it had not fully implemented a complete test and evaluation process, which  is a key element of a comprehensive agency information security program.  Although the corporation has made substantial progress in implementing  its information security program and enhanced its process to test and  evaluate its information system controls, it did not ensure that all key  control areas supporting its financial environment were routinely reviewed  and tested. These areas included electronic access controls, network  security, and audit logging. Until FDIC fully implements a comprehensive  test and evaluation process, its ability to maintain adequate information  system controls over its financial and sensitive information will be limited.  This will be especially crucial as the corporation implements new financial  systems in the coming year.
section_title: Recommendation for Executive Action
paragraphs: To strengthen FDIC’s information security program, we recommend that  the Chairman direct the Chief Information Officer to broaden its process of  tests and evaluations to ensure that all key control areas supporting FDIC’s  financial environment are routinely reviewed and tested. This process  should include routine tests and evaluations of key control areas such as  electronic access, network security, and audit logging.
We are also making recommendations in a separate report designated for  “Limited Official Use Only.” These recommendations address actions  needed to correct specific information security weaknesses related to  electronic access, network security, physical security, segregation of  computer functions, and application change controls.
section_title: Agency Comments
paragraphs: In providing written comments on a draft of this report, FDIC’s Chief  Financial Officer (CFO) agreed with our recommendations. His comments  are reprinted in appendix I of this report. Specifically, FDIC plans to  correct all weaknesses identified and broaden the testing and evaluation  element of its computer management program by February 28, 2006.  According to the CFO, significant progress has already been made in  addressing the identified weaknesses.
We are sending copies of this report to the Chairman and Ranking Minority  Member of the Senate Committee on Banking, Housing, and Urban Affairs;  the Chairman and Ranking Minority Member of the House Committee on  Financial Services; members of the FDIC Audit Committee; officials in  FDIC’s divisions of information resources management, administration,  and finance; and the FDIC inspector general. We also will make copies  available to others upon request. In addition, this report will be available at  no charge on the GAO Web site at http://www.gao.gov.
If you have any questions regarding this report, please contact me at (202)  512-6244 or David W. Irvin, Assistant Director, at (214) 777-5716. We can  also be reached by e-mail at wilshuseng@gao.gov and irvind@gao.gov,  respectively. Key contributors to this report are listed in appendix II.
section_title: Comments from the Federal Deposit Insurance Corporation
section_title: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, Edward Alexander Jr., Gerald  Barnes, Jason Carroll, Lon Chin, Debra Conner, Anh Dang, Kristi Dorsey,  Edward Glagola Jr., Nancy Glover, Rosanna Guerrero, David Hayes, Harold  Lewis, Leena Mathew, Kevin Metcalfe, Duc Ngo, Eugene Stevens, Charles  Vrabel, and Christopher Warweg made key contributions to this report.