Information Security: FDIC Implemented Many Controls over Financial Systems, but Opportunities for Improvement Remain
Published: 2015-04-09T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: FDIC has a demanding responsibility enforcing banking laws, regulating financial institutions, and protecting depositors. Because of the importance of FDIC's work, effective information security controls are essential to ensure that the corporation's systems and information are adequately protected from inadvertent or deliberate misuse, improper modification, unauthorized disclosure, or destruction.
As part of its audits of the 2014 financial statements of the Deposit Insurance Fund and the Federal Savings and Loan Insurance Corporation Resolution Fund administered by FDIC, GAO assessed the effectiveness of the corporation's controls in protecting the confidentiality, integrity, and availability of its financial systems and information. To do so, GAO examined security policies, procedures, reports, and other documents; tested controls over key financial applications; and interviewed FDIC personnel.
section_title: What GAO Found
paragraphs: The Federal Deposit Insurance Corporation (FDIC) has implemented numerous information security controls intended to protect its key financial systems; nevertheless, weaknesses remain that place the confidentiality, integrity, and availability of financial systems and information at risk. During 2014, the corporation implemented 27 of the 36 GAO recommendations pertaining to previously reported security weaknesses that were unaddressed as of December 31, 2013; actions to implement the remaining 9 recommendations were in progress. The table below details the status of these recommendations.
Although FDIC developed and implemented elements of its information security program, shortcomings remain in key program activities. For example:
FDIC had taken steps to improve its security policies and procedures, but important activities were not always required by its policies. For example, although FDIC had a policy on controlling physical access to its primary data center, the policy did not apply to all FDIC data centers.
FDIC did not consistently remediate agency-identified weaknesses in a timely manner. However, to its credit, the corporation created a strategy outlining planned actions to address weaknesses in its remedial action processes.
Additionally, FDIC has designed and documented numerous information security controls intended to protect its key financial systems; nevertheless, controls were not always consistently implemented. For example, the corporation had not always (1) ensured that passwords for a financial application complied with FDIC policy for password length or (2) centrally collected audit logs on certain servers.
These weaknesses individually or collectively do not constitute either a material weakness or a significant deficiency for financial reporting purposes. Nonetheless, by mitigating known information security weaknesses and consistently applying information security controls, FDIC could continue to reduce risks and better protect its sensitive financial information and resources from inadvertent or deliberate misuse, improper modification, unauthorized disclosure, or destruction.
section_title: What GAO Recommends
paragraphs: GAO is making two recommendations to FDIC to improve its implementation of its information security program. FDIC concurred with GAO's recommendations. In a separate report with limited distribution, GAO is recommending that FDIC take five specific actions to address weaknesses in security controls.

section_title: Letter
paragraphs: The Federal Deposit Insurance Corporation (FDIC) has a demanding  responsibility enforcing banking laws, regulating banking institutions, and  protecting depositors. In carrying out its financial and mission-related  operations, FDIC relies extensively on computerized systems. Because  the corporation plays an important role in maintaining public confidence in  the nation’s financial system, issues that affect the confidentiality,  integrity, and availability of the sensitive information maintained on its  systems are of paramount concern. In particular, effective information  security controls are essential to ensure that FDIC systems and  information are being adequately protected from inadvertent or deliberate  misuse, fraudulent use, improper disclosure, or destruction.
As part of our audit of FDIC’s 2014 financial statements of the Deposit  Insurance Fund and the Federal Savings and Loan Insurance Corporation  Resolution Fund, we assessed the effectiveness of FDIC’s information  security controls over key financial systems, data, and networks. In our  audit report, we concluded that FDIC maintained, in all material respects,  effective internal control over financial reporting as of December 31,  2014, based on criteria established under the Federal Managers’  Financial Integrity Act of 1982.
In this report, we provide additional details on FDIC’s information security  controls over its computerized financial systems during 2014. Our  objective was to determine the effectiveness of the corporation’s controls  in protecting the confidentiality, integrity, and availability of its financial  systems and information. To do this, we examined FDIC information  security policies, plans, and procedures; tested controls over its key  financial applications; reviewed our prior reports to identify previously  reported weaknesses and assess the effectiveness of corrective actions  taken; and interviewed agency officials. This work was performed to  support our opinion on FDIC’s internal control over financial reporting as  of December 31, 2014.
We performed our work in accordance with U.S. generally accepted  government auditing standards. We believe that our audit work provided a  reasonable basis for our conclusion in this report. See appendix I for  more details on our objective, scope, and methodology.
subsections: section_title: Background
paragraphs: Information security is a critical consideration for any agency that  depends on information systems and computer networks to carry out its  mission and is especially important for a government corporation such as  FDIC, which has responsibilities to oversee the financial institutions that  are entrusted with safeguarding the public’s money. While the use of  interconnected electronic information systems allows the corporation to  accomplish its mission more quickly and effectively, this also exposes  FDIC’s information to threats from sources internal and external to the  agency. Internal threats include errors, as well as fraudulent or  malevolent acts by employees or contractors working within the agency.  External threats include the ever-growing number of cyber-based attacks  that can come from a variety of sources such as hackers, criminals,  foreign nations, terrorists, and other adversarial groups.
Potential cyber attackers have a variety of techniques at their disposal,  which can vastly enhance the reach and impact of their actions. For  example, cyber attackers do not need to be physically close to their  targets, their attacks can easily cross state and national borders, and they  can preserve their anonymity. Additionally, advanced persistent threats— where an adversary that possesses sophisticated levels of expertise and  significant resources can attack using physical and cyber methods to  achieve its objectives — pose increasing risks. Further, the  interconnectivity among information systems presents increasing  opportunities for such attacks. Indeed, reports of security incidents from  federal agencies are on the rise. Specifically, the number of incidents  reported by federal agencies to the United States Computer Emergency  Readiness Team  (US-CERT) has increased dramatically in recent years:  from 5,503 incidents reported in fiscal year 2006 to 67,168 incidents in  fiscal year 2014.
Compounding the growing number and types of threats are the  deficiencies in security controls on the information systems at federal  agencies, which have resulted in vulnerabilities in both financial and  nonfinancial systems and information. These deficiencies continue to  place assets at risk of inadvertent or deliberate misuse, financial  information at risk of unauthorized modification or destruction, and critical  operations at risk of disruption. Accordingly, we have designated  information security as a government-wide high-risk area since 1997, a  designation that remains in force today.
Federal law and guidance specify requirements for protecting federal  information and information systems. The Federal Information Security  Management Act of 2002 (FISMA) provides a comprehensive framework  for ensuring the effectiveness of information security controls over  information resources that support federal operations and assets. To  accomplish this, FISMA requires each agency to develop, document, and  implement an agency-wide information security program to provide  information security for the information and systems that support its  operations and assets, using a risk-based approach to information  security management. Such a program includes assessing risk;  developing and implementing cost-effective security plans, policies, and  procedures; providing specialized training; testing and evaluating the  effectiveness of controls; planning, implementing, evaluating, and  documenting remedial actions to address information security  deficiencies; and ensuring continuity of operations.
FISMA also assigned to the National Institute of Standards and  Technology (NIST) the responsibility for developing standards and  guidelines that include minimum information security requirements. To  this end, NIST has issued several publications to provide guidance for  agencies in implementing an information security program. For example,  NIST Federal Information Processing Standard (FIPS) 199 provides  requirements on how agencies should categorize their information and  information system(s) and NIST special publication (SP) 800-53guidance to agencies on the selection and implementation of information  security and privacy controls for systems.
subsections: section_title: FDIC Is a Key Protector of Bank and Thrift Deposits
paragraphs: FDIC was created by Congress to maintain the stability of and public  confidence in the nation’s financial system by insuring deposits,  examining and supervising financial institutions, and resolving troubled  institutions. FDIC is an independent agency of the federal government,  which Congress created in 1933  in response to the thousands of bank  failures that had occurred throughout the late 1920s and early 1930s.
FDIC insures deposits in banks and thrift institutions for at least $250,000;  identifies, monitors, and addresses risks to the deposit insurance funds;  and limits the effect on the economy and the financial system when a  bank or thrift institution fails.
FDIC administers two funds in carrying out its mission:
The Deposit Insurance Fund (DIF) has the primary purposes of (1)  insuring the deposits and protecting the depositors of banks and  savings associations (insured depository institutions) and (2) resolving  failed insured depository institutions in a manner that will result in the  least possible cost to the fund. In cooperation with other federal and  state agencies, FDIC promotes the safety and soundness of insured  depository institutions by identifying, monitoring, and addressing risks  to the DIF.
The Federal Savings and Loan Insurance Corporation Resolution  Fund (FRF) is responsible for the sale of the remaining assets and the  satisfaction of the liabilities associated with the former Federal  Savings and Loan Insurance Corporation and the former Resolution  Trust Corporation.
FDIC maintains the DIF and the FRF separately to support their  respective functions.
section_title: FDIC Relies on Computer Systems to Support Its Mission and Financial Reporting
paragraphs: FDIC relies extensively on computerized systems to support its mission,  including financial operations, and to store the sensitive information that it  collects. The corporation uses local and wide area networks to  interconnect its systems and a layered approach to security defense.
To support its financial management functions, FDIC uses a corporate-wide system that functions as a unified set of financial  and payroll systems that are managed and operated in an integrated  fashion; a system to calculate and collect FDIC deposit insurance premiums  and Financing Corporationinsured financial institutions;   bond principal and interest amounts from a web-based application that provides full functionality to support  franchise marketing, asset marketing, and asset management; an application and web portal to provide acquiring institutions with a  secure method for submitting required data files to FDIC;  computer programs used to derive the corporation’s estimate of  losses from shared loss agreements; a system to request access to and receive permission for the  computer applications and resources available to its employees,  contractors, and other authorized personnel; and a primary receivership and subsidiary financial processing and  reporting system.
Under FISMA, the Chairman of FDIC is responsible for, among other  things, providing information security protections commensurate with the risk  and magnitude of the harm resulting from unauthorized access, use,  disclosure, disruption, modification, or destruction of the agency’s  information systems and information; ensuring that senior agency officials provide information security for  the information and information systems that support the operations  and assets under their control; and delegating to the corporation’s Chief Information Officer the authority  to ensure compliance with the requirements imposed on the agency  under FISMA.
The Chief Information Officer is responsible for developing and  maintaining a corporate-wide information security program and for  developing and maintaining information security policies, procedures, and  control techniques that address all applicable requirements. The Chief  Information Officer also serves as the authorizing official with the authority  to approve the operation of the information systems at an acceptable  level of risk to the corporation.
The Chief Information Security Officer reports to the Chief Information  Officer and serves as the Chief Information Officer’s designated  representative. The Chief Information Security Officer is responsible for  (1) the overall support of assessment and authorization activities; (2) the  development, coordination, and implementation of FDIC’s security policy;  and (3) the coordination of information security and privacy efforts across  the corporation.
section_title: FDIC Had Developed and Documented Many Controls to Secure Its Financial Information and Systems, but Improvements Are Still Needed
paragraphs: Although FDIC developed and implemented elements of its information  security program, the corporation did not always implement key program  activities. Additionally, FDIC has designed and documented numerous  information security controls intended to protect its key financial systems;  however, shortcomings existed in the implementation of other information  security controls. By mitigating known information security weaknesses  and ensuring that information security controls are consistently applied,  FDIC could continue to reduce risks and better protect its sensitive  financial information and resources from inadvertent or deliberate misuse,  improper modification, unauthorized disclosure, or destruction.
subsections: section_title: FDIC Continues to Make Progress in Implementing Its Information Security Program
paragraphs: An entity-wide information security management program is the  foundation of a security control structure and a reflection of senior  management’s commitment to addressing security risks. The security  management program should establish a framework and continuous cycle  of activity for assessing risk, developing and implementing effective  security procedures, and monitoring the effectiveness of these  procedures. Without a well-designed program, security controls may be  inadequate; responsibilities may be unclear, misunderstood, or improperly  implemented; and controls may be inconsistently applied. FISMA requires  each agency to develop, document, and implement an information  security program that, among other things, includes plans for providing adequate information security for networks,  facilities, and systems;  security awareness training to inform personnel of information security  risks and of their responsibilities in complying with agency policies  and procedures, as well as training personnel with significant security  responsibilities for information security; policies and procedures that (1) are based on risk assessments, (2)  cost effectively reduce information security risks to an acceptable  level, (3) ensure that information security is addressed throughout the  life cycle of each system, and (4) ensure compliance with applicable  requirements; a process for planning, implementing, evaluating, and documenting  remedial actions to address any deficiencies in its information security  policies, procedures, or practices; and periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls  for every system identified in the agency’s required inventory of major  information systems.
subsections: section_title: FDIC Developed and Documented Elements of Its Corporate Information Security Program
paragraphs: FDIC made improvements in developing and documenting many  elements of its corporate information security program. For example:
During 2014, FDIC completed actions to address two weaknesses we  previously reported related to system security planning. Specifically,  the corporation had ensured that the system security plans for three  applications thoroughly described each control and included all  required information, and ensured that descriptions of common  controls were adequately documented.
During 2014, FDIC addressed our prior recommendation to ensure  that those with administrative-level access have completed the  requisite rules of behavior training upon receiving access and each  year after that.
FDIC had taken steps to document, implement, and improve policies  for information security. Specifically, in June 2014, the corporation  formalized a new policy on security patch management. The policy  defines risk categories for patches, time frames for applying patches  based on the risk categories and platform-specific requirements, and  roles and responsibilities for patch management. Additionally, the  FDIC Office of the Inspector General reported in November 2014 that  FDIC had drafted a new information technology (IT) security risk  management program policy that was designed to align with NIST and  Office of Management and Budget guidance and reflect the  corporation’s information security risk management program and  governance structure.
FDIC addressed many weaknesses that we previously identified in its  information systems supporting financial processing. Specifically,  during 2014, FDIC implemented 27 of the 36 recommendations  pertaining to unaddressed security weaknesses that we previously  reported, and actions to correct or mitigate the remaining 9  weaknesses were in progress.
section_title: Information Security Program Continues to Present Opportunities for Improvement
paragraphs: Although FDIC continues to improve its implementation of its corporate  information security program, shortcomings existed in other information  security program elements. Specifically:
FDIC’s information security policies and procedures did not always  include important requirements. NIST special publication (SP) 800-53  Revision 4 recommends that agencies regularly review individuals’  physical access to facilities and remove that access when it is no  longer required. However, although FDIC had a policy on controlling  physical access to its primary data center, the corporation did not  recertify access to its backup data center because the policy did not  apply to all FDIC data centers. Additionally, although FDIC policy  states that access to IT resources is to be provided only after proper  authorization has been provided, the corporation did not document  that it had verified access to a system supporting the marketing of  failed banks’ assets because its existing procedures did not require  the access verifications to be documented. As a result, there is an  increased risk that individuals who no longer need access to  information systems could accidentally or intentionally damage critical  resources.
Improvements are needed in the corporation’s continuous monitoring  program. To its credit, the corporation conducted control assessments  of the major applications and general support systems we reviewed  and addressed a weakness we previously identified by assessing  security controls for two systems in accordance with its assessment  schedule. In addition, the FDIC Office of Inspector General reported in  November 2014 that FDIC had performed a number of continuous  monitoring activities, developed an assessment methodology that  defined a risk-focused approach for performing continuous monitoring  on information systems, and reported various continuous monitoring  metrics to senior managers. However, the office reported that the  corporation had not yet developed a written, corporate-wide  information security continuous monitoring strategy that included key  elements from NIST guidance for continuous monitoring. The office  recommended that FDIC develop and approve a written continuous  monitoring strategy consistent with Office of Management and Budget  and NIST guidance. Until this recommendation is addressed, FDIC  will have limited assurance that the controls are operating effectively  to protect its financial systems and information.
Improvements are needed in the corporation’s remedial action  processes. Specifically, at the time of our review, 25 of the 285  remedial action plans applicable to agency information systems in our  audit scope were past their expected closure dates by between about  2 weeks and 10 months, including 4 high-risk items. In addition, the  FDIC Office of Inspector General reported in November 2014 that, as  of July 2014, the corporation’s remedial action management system  contained a large number of high- and moderate-risk security  vulnerabilities, many of which had planned corrective actions that  were significantly past their scheduled completion dates. The Office  also reported that FDIC has taken steps to improve its remedial action  processes by creating a strategy outlining planned actions to address  weaknesses in the corporation’s plan of action and milestones  processes. Nevertheless, until FDIC fully addresses shortcomings in  its remedial action processes, the corporation’s financial information  and systems will remain at increased and unnecessary risk. Because  the FDIC Office of Inspector General has already made  recommendations to address shortcomings in FDIC’s remedial action  processes, we are not making additional recommendations in this  area.
section_title: FDIC Implemented Many Controls, but Shortcomings Still Warrant Management Attention
paragraphs: An agency can protect the resources that support its critical operations  and assets from unauthorized access, disclosure, modification, or loss by  designing and implementing controls for segregating incompatible duties,  identifying and authenticating users, restricting user access to only what  has been authorized, encrypting sensitive data, auditing and monitoring  systems to detect potentially malicious activity, managing and controlling  system configurations, and conducting employee background  investigations, among other things. Although FDIC had implemented  numerous controls in these areas, weaknesses continue to challenge the  corporation in ensuring the confidentiality, integrity, and availability of its  information and information systems.
subsections: section_title: Controls for Segregation of Incompatible Duties Improved
paragraphs: To reduce the risk of error or fraud, duties and responsibilities for  authorizing, processing, recording, and reviewing transactions should be  separated to ensure that one user does not control all of the critical  stages of a process. NIST SP 800-53 Revision 4 states that, to prevent  malevolent activity without collusion, organizations should separate the  duties of users as necessary and implement separation of duties through  defined information system access authorizations. Additionally, consistent  with NIST guidance, FDIC policy on access control for IT resources states  that, where required, access controls shall be used to enforce the  principle of separation of duties to restrict the level of access and ability  provided to any single user.
FDIC improved its implementation of segregation of duties controls by  implementing four recommendations we had previously made pertaining  to segregation of duties. For example, FDIC identified and documented  incompatible roles and established processes and procedures to enforce  segregation of duties for several applications and systems supporting  financial processing. Additionally, the corporation had restricted users  with access to source code for a financial system from having access to  that system’s production environment. As a result, FDIC has reduced its  risk that users could conduct fraudulent activity by bypassing intended  controls.
section_title: Improvements Made in Controls for Identifying and Authenticating Users, but Password Controls Were Not Always Implemented
paragraphs: Information systems need to effectively control user accounts and identify  and authenticate users. Users and devices should be appropriately  identified and authenticated through the implementation of adequate  logical access controls. Users can be authenticated using mechanisms  such as a password and user ID combination. Consistent with NIST SP  800-53 Revision 4, FDIC policy establishes minimum password length  and complexity requirements.
During 2014, FDIC improved controls for identifying and authenticating  the identity of users by implementing two recommendations that we had  previously made and that were still unresolved as of December 31, 2013.  For example, FDIC had disallowed the use of default credentials for  access to an application supporting FDIC’s process for managing cash  and investment transactions and had provided password lifetime and  complexity controls to user accounts for a database that supported  financial processing.
However, FDIC did not fully implement password controls on the  application supporting its process for managing cash and investment  transactions in accordance with its policy. Specifically, passwords for the  application did not comply with the minimum length standards established  by FDIC’s password policy. As a result, there is an increased likelihood  that passwords could potentially be compromised and used to gain  unauthorized access to financial information in the application.
section_title: Controls for Restricting Access to Only What Users Needed Were Largely Effective, but Shortcomings Remain
paragraphs: Authorization encompasses access privileges granted to a user, program,  or process. It is used to allow or prevent actions by that user based on  predefined rules. Authorization includes the principles of legitimate use  and least privilege. NIST SP 800-53 Revision 4 recommends that  organizations employ the principle of least privilege by allowing only  authorized access for users (or processes acting on behalf of users)  which are necessary to accomplish assigned tasks in accordance with  organizational missions and business functions, periodically review the  privileges assigned to users to validate the need for such privileges and  reassign or remove privileges when necessary, and disable access to  information systems within a defined period when individuals are  terminated. NIST also recommends that organizations develop, approve,  and maintain a list of individuals with authorized access to facilities where  information systems reside, periodically review the list, and remove  individuals from the list when access to the facility is no longer required.  Consistent with NIST guidance, FDIC policy also states that access to IT  resources shall be terminated immediately after an employee or  contractor exits the FDIC and that periodic reviews of access settings  shall be conducted to ensure that appropriate controls remain consistent  with existing authorizations and current business needs.
During 2014, FDIC improved controls for authorizing users’ access by  implementing 11 of 12 recommendations we had previously made  pertaining to authorization controls and that were still unresolved as of  December 31, 2013. For example, FDIC had ensured that accounts belonging to users who had not accessed  certain applications and systems in a predefined period of time were  disabled, discontinued the use of shared user IDs for several applications and  databases supporting financial processing,  removed certain users’ excessive access to an application supporting  FDIC’s process for estimating potential losses from litigation, and  restricted access to the network shared folder where annual financial  statements and footnotes were maintained.
Although improvements were made, FDIC did not always implement  sufficient authorization controls. For example, as discussed earlier, the  corporation did not recertify the need for data center access on a periodic  basis to ensure that individuals’ access remained appropriate, and did not  always recertify account access to an application used by FDIC to store  loan data for failing financial institutions. Additionally, the corporation had  not yet completed actions to implement our prior-year recommendation to  ensure that accounts for users who have access to the network and who  have been separated from employment are removed immediately upon  separation.
Although these weaknesses did not materially impact FDIC’s financial  statements, they nevertheless increase the risk that individuals may have  greater access to data centers or to financial information and systems  than they need to fulfill their responsibilities, or that user accounts for  departed individuals could be used to gain unauthorized access to  systems that process sensitive financial information.
section_title: FDIC Used Strong Encryption for Two Systems, but Did Not Always Sufficiently Encrypt Sensitive Connections
paragraphs: Cryptography controls can be used to help protect the integrity and  confidentiality of data and computer programs by rendering data  unintelligible to unauthorized users and/or protecting the integrity of  transmitted or stored data. Cryptography involves the use of  mathematical functions called algorithms and strings of seemingly  random bits called keys to, among other things, encrypt a message or file  so that it is unintelligible to those who do not have the secret key needed  to decrypt it, thus keeping the contents of the message or file confidential.  NIST Special Publication 800-53 Revision 4 recommends that  organizations employ cryptographic mechanisms to prevent unauthorized  disclosure of information during transmission, encrypt passwords while  being stored and transmitted, and establish a trusted communications  path between users and security functions of information systems. The  NIST standard for an encryption algorithm is Federal Information  Processing Standard (FIPS) 140-2.
FDIC improved its encryption controls by implementing our prior-year  recommendation to use FIPS 140-2-compliant encryption for protection of  authentication and session data for two systems supporting financial  processing. However, FDIC had not completed actions to implement our  prior recommendation to use FIPS-compliant encryption for all mainframe  connections. As a result, sensitive data transmitted over these  connections could be exposed to potential compromise.
section_title: Audit and Monitoring Controls Improved, but Opportunities for Improvement Remain
paragraphs: Audit and monitoring involves the regular collection, review, and analysis  of auditable events for indications of inappropriate or unusual activity, and  the appropriate investigation and reporting of such activity. Automated  mechanisms may be used to integrate audit monitoring, analysis, and  reporting into an overall process for investigation and response to  suspicious activities. Audit and monitoring controls can help security  professionals routinely assess computer security, perform investigations  during and after an attack, and even recognize an ongoing attack. Audit  and monitoring technologies include network and host-based intrusion  detection systems, audit logging, security event correlation tools, and  computer forensics. NIST SP 800-53 revision 4 states that organizations  should review and analyze information system audit records for  indications of inappropriate or unusual activity and report the findings to  designated agency officials. Additionally, NIST states that audit records  should contain information on individual audit events, including their type,  source, and outcome, as well as the date and time that they occurred and  any individuals or subjects associated with the events, among other  things.
FDIC improved its audit and monitoring controls by implementing three of  six recommendations pertaining to audit and monitoring that we had  previously identified and that were still unresolved as of December 31,  2013. For example, the corporation had ensured that log history for  privileged accounts on key servers supporting financial processing were  sufficient to aid incident response and forensic investigations.
However, FDIC had not yet completed actions to address three  weaknesses related to auditing and monitoring controls we previously  identified. For example, the corporation had not yet ensured that, for  certain systems, sensitive and high-risk events are consistently logged. In  addition, FDIC did not always effectively monitor server security logs.  Specifically, three servers supporting financial processing did not send  log output to the corporation’s centralized audit logging system.
While the three outstanding recommendations and the additional  weakness identified this year did not materially affect the corporation’s  financial statements, they nevertheless increase the risk that the incident  response team would not detect malicious activity occurring on these  systems supporting financial processing, or that sufficient data would not  be available, hindering efforts to investigate potential security incidents  after the fact.
section_title: Configuration Management Shortcomings Increase Risk to Financial Systems and Information
paragraphs: Configuration management is an important control that involves the  identification and management of security features for all hardware and  software components of an information system at a given point and  systematically controls changes to that configuration during the system’s  life cycle. Configuration management involves, among other things, (1)  verifying the correctness of the security settings in the operating systems,  applications, or computing and network devices and (2) obtaining  reasonable assurance that systems are configured and operating  securely and as intended. Patch management, a component of  configuration management, is important for mitigating the risks associated  with software vulnerabilities. When a software vulnerability is discovered,  the software vendor may develop and distribute a patch or work-around to  mitigate the vulnerability. Without the patch, an attacker can exploit the  vulnerability to read, modify, or delete sensitive information; disrupt  operations; or launch attacks against other systems.
NIST SP 800-53 Revision 4 states that organizations should establish a  baseline configuration for the information system and its constituent  components. Additionally, FDIC policy states that FDIC must establish  and document mandatory configuration settings for IT products employed  within the information system using information-system-defined security  configuration checklists. Further, NIST SP 800-128 states that patch  management procedures should define how the organization’s patch  management process is integrated into configuration management  processes, how patches are prioritized and approved through the  configuration change control process, and how patches are tested for  their impact on existing secure configurations.
Although improvements were made, shortcomings remain in FDIC’s  implementation of configuration management controls. FDIC had made  progress toward addressing our prior recommendation to establish  baseline configurations for all FDIC information systems by establishing  agency-wide configuration settings for three platforms. According to  officials, FDIC plans to establish baselines for the majority of its platforms  by the end of 2015. In addition, FDIC had begun to implement actions  intended to improve its process for managing vulnerabilities and applying  patches, including establishing a Patch and Vulnerability Group to  facilitate the identification and distribution of patches; however, the  corporation had not yet completed actions to address our prior  recommendation to apply patches to remediate known vulnerabilities in  third-party software.
These issues did not materially affect the corporation’s financial  statements. Nevertheless, until our previously identified weaknesses are  addressed, FDIC faces increased risk that unpatched vulnerabilities in  systems and applications could be exploited, potentially exposing the  corporation’s financial systems and information to unauthorized access or  modification.
section_title: FDIC Had Not Yet Corrected Employee Background Investigation Issue
paragraphs: Policies related to hiring and management of personnel are important  considerations in securing information systems. If personnel policies are  not adequate, an entity runs the risk of (1) hiring unqualified or  untrustworthy individuals; (2) providing terminated employees  opportunities to sabotage or otherwise impair entity operations or assets;  (3) failing to detect continuing unauthorized employee actions; (4)  lowering employee morale, which may in turn diminish employee  compliance with controls; and (5) allowing staff expertise to decline.  Personnel procedures should include contacting references, performing  background investigations, and ensuring that periodic reinvestigations are  consistent with the sensitivity of the position, in accordance with criteria  from the Office of Personnel Management. FDIC policy states that  personnel in moderate- and low-risk positions should be subject to a  background reinvestigation every 5 and 7 years, respectively.
In 2014, we reported that background reinvestigations were not being  performed in accordance with FDIC policy; specifically, background  reinvestigations had not been performed prior to Fall 2013 for users with  a security rating less than high risk. During our current review, FDIC  officials stated that their planned efforts to address this weakness will not  be completed until April 2016. Until this weakness is fully addressed,  FDIC will continue to face elevated risk that it will not identify malicious  users of financial applications who would commit or attempt to commit  fraud.
section_title: Conclusions
paragraphs: FDIC had developed, documented, and implemented many elements of  its corporate information security program. For example, the corporation  had formalized a new policy for information security patch management  and had ensured that administrators completed required training. In  addition, FDIC had implemented and strengthened many information  security controls over its financial systems and information. For example,  the corporation had taken steps to improve controls for segregating  incompatible duties, identifying and authenticating users, restricting user  access to only what has been authorized, encrypting of sensitive data,  and auditing and monitoring systems for potentially malicious activity, by  addressing many of the weaknesses that we previously reported.
However, management attention is still needed to address shortcomings  in the corporation’s information security program. For example,  shortcomings in certain security policies and procedures led to  weaknesses in conducting and documenting reviews of user access.  Additionally, further actions are needed to address weaknesses in  identification and authentication, authorization, and audit and monitoring  controls. Given the important role that information systems play in FDIC’s  internal controls over financial reporting, it is vitally important that FDIC  address the remaining weaknesses in information security controls—both  old and new—as part of its ongoing efforts to mitigate the risks from cyber  attacks and to ensure the confidentiality, integrity, and availability of its  financial and sensitive information. Although we do not consider these  weaknesses individually or collectively to be either a material weakness  or a significant deficiency for financial reporting purposes, we are  nevertheless making five recommendations in a separate product with  limited distribution for FDIC to address new weaknesses we identified in  this review. Until FDIC takes further steps to mitigate these weaknesses,  the corporation’s sensitive financial information and resources will remain  unnecessarily exposed to increased risk of inadvertent or deliberate  misuse, improper modification, unauthorized disclosure, or destruction.
section_title: Recommendations for Executive Action
paragraphs: To help improve the corporation’s implementation of its information  security program, we recommend that the Chairman of FDIC direct the  Chief Information Officer to take the following two actions:
Ensure that physical access policies require periodic review of access  to all FDIC data centers.
Update existing procedures to require that access verifications to the  system supporting the marketing of failed banks’ assets be  documented.
Additionally, in a separate report with limited distribution, we are making  five recommendations consisting of actions to implement and correct  specific information security weaknesses related to identification and  authentication, authorization, and audit and monitoring.
section_title: Agency Comments
paragraphs: In providing written comments (reprinted in app. II) on a draft of this  report, FDIC stated that corrective actions for the two new  recommendations have already been or will be completed during 2015.  FDIC also provided an attachment detailing its actions to implement our  recommendations as well as technical comments that we addressed in  our report as appropriate.
We are sending copies of this report to interested congressional parties.  In addition, this report is available at no charge on the GAO website at  http://www.gao.gov.
If you have any questions regarding this report, please contact Gregory  C. Wilshusen at (202) 512-6244 or Dr. Nabajyoti Barkakati at (202) 512-  4499. We can also be reached by e-mail at wilshuseng@gao.gov and  barkakatin@gao.gov. Key contributors to this report are listed in appendix  III.
section_title: Appendix I: Objective, Scope, and Methodology
paragraphs: The objective of this information security review was to determine the  effectiveness of the Federal Deposit Insurance Corporation’s (FDIC)  controls in protecting the confidentiality, integrity, and availability of its  financial systems and information. The review was conducted as part of  our audit of the FDIC financial statements of the Deposit Insurance Fund  and the Federal Savings and Loan Insurance Corporation Resolution  Fund.
The scope of our audit included an examination of FDIC information  security policies and plans; controls over key financial systems; and  interviews with agency officials in order to (1) assess the effectiveness of  corrective actions taken by FDIC to address weaknesses we previously  reported and (2) determine whether any additional weaknesses existed.  This work was performed in support of our opinion on internal control over  financial reporting as it relates to our audits of the calendar year 2014 and  2013 financial statements of the two funds administered by FDIC.
GAO used an independent public accounting firm, under contract, to  evaluate and test certain FDIC information systems controls, including the  follow-up on the status of FDIC’s corrective actions during calendar year  2014 to address open recommendations from our prior years’ reports. We  agreed on the scope of the audit work, monitored the firm’s progress, and  reviewed the related audit documentation to determine whether the firm’s  findings were adequately supported.
To determine whether controls over key financial systems and information  were effective, we considered the results FDIC’s actions to mitigate  previously reported weaknesses that remained open as of December 31,  2013, and performed audit work at FDIC facilities in Arlington, Virginia.  We concentrated our evaluation primarily on the controls for systems and  applications associated with financial processing. Our selection of the  systems to evaluate was based on consideration of systems that directly  or indirectly support the processing of material transactions that are  reflected in the funds’ financial statements.
Our audit methodology was based on the Federal Information System  Controls Audit Manual, which contains guidance for reviewing  information system controls that affect the confidentiality, integrity, and  availability of computerized information.
Using standards and guidance from the National Institute of Standards  and Technology as well as FDIC’s policies and procedures, we evaluated  controls by examining access responsibilities to determine whether incompatible  functions were segregated among different individuals;  reviewed password settings to determine if password management  was being enforced in accordance with agency policy; analyzing user system authorizations to determine whether users had  more permissions than necessary to perform their assigned functions; observing methods for providing secure data transmissions to  determine whether sensitive data were being encrypted; assessing configuration settings to evaluate settings used to audit  inspecting vulnerability scans for in-scope systems to determine  whether patches, service packs, and hot fixes were appropriately  installed on affected systems.
Using the requirements of the Federal Information Security Management  Act of 2002, which establishes elements for an agency-wide information  security program, we evaluated FDIC’s implementation of its security  program by analyzing security plans for key financial systems to determine  whether management, operational, and technical controls had been  documented and whether security plans had been updated regularly  in accordance with NIST requirements;  reviewing training records for administrators to determine if they had  received training appropriate to their responsibilities;  reviewing information security policies to determine whether they were  adequately documented and implemented; examining an FDIC Office of Inspector General report for information  on FDIC’s implementation of risk management policies;  reviewing ongoing assessments of security controls to determine if  they had been completed as scheduled;  reviewing an FDIC Office of Inspector General report for information  on the corporation’s information security continuous monitoring  program; examining remedial action plans to determine whether FDIC  addressed identified vulnerabilities in a timely manner; and examining an FDIC Office of Inspector General report for information  on findings related to FDIC’s remedial action process.
To determine the status of FDIC’s actions to correct or mitigate previously  reported information security weaknesses, we reviewed prior GAO  reports to identify previously reported weaknesses and examined FDIC’s  corrective action plans to determine which weaknesses FDIC had  reported as being corrected. For those instances where FDIC reported it  had completed corrective actions, we assessed the effectiveness of those  actions.
We performed our work from June 2014 to April 2015 in accordance with  U.S. generally accepted government auditing standards. We believe that  our audit work provided a reasonable basis for our conclusion in this  report.
section_title: Appendix II: Comments from the Federal Deposit Insurance Corporation
section_title: Appendix III: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to the individuals named above, Gary Austin and Nick Marinos  (assistant directors), William Cook, Thomas J. Johnson, George  Kovachick, and Lee McCracken made key contributions to this report.