Information Security: Securities and Exchange Commission Needs to Continue to Improve Its Program
Published: 2006-03-31T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Securities and Exchange Commission (SEC) has a demanding responsibility enforcing securities laws, regulating the securities markets, and protecting investors. In enforcing these laws, SEC issues rules and regulations to provide protection for investors and to help ensure that the securities markets are fair and honest. It relies extensively on computerized systems to support its financial and mission-related operations. Information security controls affect the integrity, confidentiality, and availability of sensitive information maintained by SEC. As part of the audit of SEC's fiscal year 2005 financial statements, GAO assessed (1) the status of SEC's actions to correct or mitigate previously reported information security weaknesses and (2) the effectiveness of the commission's information system controls in protecting the confidentiality, integrity, and availability of its financial and sensitive information.
section_title: What GAO Found
paragraphs: Although SEC has taken steps to strengthen its information security program, most of the previously reported information security controls and program weaknesses persist. Specifically, the commission has corrected or mitigated 8 of the 51 weaknesses that GAO reported as unresolved in last year's report. Among the corrective actions SEC has taken include replacing a vulnerable, publicly accessible workstation and developing and implementing change control procedures for a major application. However, the commission has not yet effectively controlled remote access to its servers, established controls over passwords, managed access to its systems and data, securely configured network devices and servers, or implemented auditing and monitoring mechanisms to detect and track security incidents. Overall, SEC has not effectively implemented information security controls to properly protect the confidentiality, integrity, and availability of its financial and sensitive information and information systems. In addition to the 43 previously reported weaknesses that remain uncorrected, GAO identified 15 new information security weaknesses. Most identified weaknesses pertained to electronic access controls such as user accounts and passwords, access rights and permissions, and network devices and services. These weaknesses increase the risk that financial and sensitive information will be inadequately protected against disclosure, modification, or loss, possibly without detection, and place SEC operations at risk of disruption. A key reason for SEC's information security controls weaknesses is that the commission has not fully developed, implemented, or documented key elements of an information security program to ensure that effective controls are established and maintained. Until SEC implements such a program, its facilities and computing resources and the information that is processed, stored, and transmitted on its systems will remain vulnerable.

section_title: Letter
paragraphs: The Securities and Exchange Commission (SEC) has a demanding  responsibility enforcing securities laws, regulating the securities markets,  and protecting investors. In enforcing these laws, SEC issues rules and  regulations to provide protection for investors and to help ensure that the  securities markets are fair and honest. The commission relies extensively  on computerized systems to support its financial and mission-related  operations.
Effective controls over information security affect the integrity,  confidentiality, and availability of sensitive information—such as personnel  and regulatory information—maintained by SEC. These controls are  essential to ensure that financial information is adequately protected from  inadvertent or deliberate misuse, fraudulent use, improper disclosure, or  destruction.
As part of our audit of SEC’s fiscal year 2005 financial statements, we  assessed the effectiveness of SEC’s information security controls over key  financial systems, data, and networks. Our specific objectives were to  assess (1) the status of SEC’s actions to correct or mitigate previously  reported weaknesses and (2) whether controls over key financial systems  and data have been effective in ensuring the confidentiality, integrity, and  availability of financial systems and data. We are also issuing a report for  “Limited Official Use Only,” which describes in more detail the information  security weaknesses identified, our specific recommendations for  correcting them, and SEC’s plan for implementing corrective actions.
We performed our review at SEC headquarters in Washington, D.C. and at  its computer facility in Alexandria, Virginia, from June 2005 through  October 2005. Our review was performed in accordance with generally  accepted government auditing standards.
subsections: section_title: Background
paragraphs: Information security is a critical consideration for any organization that  depends on information systems and computer networks to carry out its  mission or business. It is especially important for government agencies,  where the public’s trust is essential. The dramatic expansion in computer  interconnectivity and the rapid increase in the use of the Internet are  changing the way our government, the nation, and much of the world  communicate and conduct business. Without proper safeguards, systems  are unprotected from individuals and groups with malicious intent to  intrude and use the access to obtain sensitive information, commit fraud,  disrupt operations, or launch attacks against other computer systems and  networks. These concerns are well founded for a number of reasons,  including the dramatic increase in reports of security incidents, the ease of  obtaining and using hacking tools, the steady advance in the sophistication  and effectiveness of attack technology, and the dire warnings of new and  more destructive attacks to come.
Computer-supported federal operations are likewise at risk. Our previous  reports, and those of agency inspectors general, describe persistent  information security weaknesses that place a variety of federal operations  at risk of disruption, fraud, and inappropriate disclosure. We have  designated information security as a governmentwide high-risk area since  1997—a designation that remains today.
Recognizing the importance of securing federal information systems, in  December 2002, Congress enacted the Federal Information Security  Management Act (FISMA) to strengthen the security of information and  systems within federal agencies. FISMA requires each agency to develop,  document, and implement an agencywide information security program to  provide information security for the information and systems that support  the operations and assets of the agency, using a risk-based approach to  information security management.
subsections: section_title: SEC Is a Key Protector of Securities Investors
paragraphs: Following the stock market crash of 1929, Congress passed the Securities  Exchange Act of 1934, which established SEC to enforce securities laws,  to regulate the securities markets, and to protect investors. In enforcing  these laws, SEC issues rules and regulations to provide protection for  investors and to help ensure that the securities markets are fair and honest.  This is accomplished primarily by promoting adequate and effective  disclosure of information to the investing public. The commission also  oversees and requires the registration of other key participants in the  securities industry, including stock exchanges, broker-dealers, clearing  agencies, depositories, transfer agents, investment companies, and public  utility holding companies. SEC is an independent, quasi-judicial agency that  operates under a bipartisan commission appointed by the President and  confirmed by the Senate.
SEC had a budget of about $888 million and staff of 3,865 to monitor and  regulate the securities industry in fiscal year 2005. In 2003, the volume  traded on U.S. exchanges and NASDAQ exceeded $22 trillion and 850  billion shares. Each year the commission accepts, processes, and  disseminates to the public more than 600,000 documents from companies  and individuals, including annual reports from more than 12,000 reporting  companies. In fiscal year 2005, SEC collected $595 million for filing fees  and $1.6 billion in penalties and disgorgements. In addition, the  commission uses other systems that maintain sensitive personnel  information for its employees, filing data for corporations, and legal  information on enforcement activities.
SEC relies extensively on computerized systems to support its financial  operations and store the sensitive information it collects. Its local and wide  area networks interconnect these systems. To support the commission’s  financial management functions, it relies on several financial systems to  process and track financial transactions such as filing fees paid by  corporations and penalties from enforcement activities.
According to FISMA, the Chairman of SEC has responsibility for, among  other things, (1) providing information security protections commensurate  with the risk and magnitude of the harm resulting from unauthorized  access, use, disclosure, disruption, modification, or destruction of the  agency’s information systems and information; (2) ensuring that senior  agency officials provide information security for the information and  information systems that support the operations and assets under their  control; and (3) delegating to the agency CIO the authority to ensure  compliance with the requirements imposed on the agency under FISMA.  SEC’s CIO is responsible for developing and maintaining a departmentwide  information security program and for developing and maintaining  information security policies, procedures, and control techniques that  address all applicable requirements.
section_title: Objectives, Scope, and Methodology
paragraphs: The objectives of our review were to assess (1) the status of SEC’s actions  to correct or mitigate previously reported information security and (2) the  effectiveness of the commission’s information system controls for ensuring  the confidentiality, integrity, and availability of its information systems and  information. Our evaluation was based on our Federal Information System  Controls Audit Manual, which contains guidance for reviewing  information system controls that affect the confidentiality, integrity, and  availability of computerized data.
Specifically, we evaluated information security controls that are intended  to   prevent, limit, and detect electronic access to computer resources (data,  programs, and systems), thereby protecting these resources against  unauthorized disclosure, modification, and use;  provide physical protection of computer facilities and resources from  espionage, sabotage, damage, and theft;  prevent the exploitation of vulnerabilities;  prevent the introduction of unauthorized changes to application or  system software; and   ensure that work responsibilities for computer functions are segregated  so that one individual does not perform or control all key aspects of  computer-related operations and, thereby, have the ability to conduct  unauthorized actions or gain unauthorized access to assets or records  without detection.
In addition, we evaluated SEC’s information security program. Such a  program includes assessing risk; developing and implementing policies,  procedures, and security plans; providing security awareness and training;  testing and evaluating the effectiveness of controls; planning,  implementing, evaluating, and documenting remedial actions to address  information security deficiencies; detecting, reporting, and responding to  security incidents; and ensuring continuity of operations.
To evaluate SEC’s information security controls and program, we identified  and examined pertinent SEC security policies, procedures, guidance,  security plans, and relevant reports. In addition, we conducted tests and  observations of controls in operation and reviewed corrective actions  taken by the commission to address vulnerabilities identified during our  previous review. We also discussed whether information system controls  were in place, adequately designed, and operating effectively with key  security representatives, system administrators, and management officials.
section_title: SEC Has Made Limited Progress Correcting Previously Reported Weaknesses
paragraphs: Although SEC has taken steps to address its information security controls  weaknesses, most of the weaknesses persist. Specifically, the commission  has corrected or mitigated 8 of the 51 weaknesses that we previously  reported as unresolved. For example, SEC has  replaced a vulnerable, publicly accessible workstation with a terminal  that provides the minimum capabilities needed to accomplish its  purpose and a more secure configuration;   developed and implemented procedures to ensure that changes made to  a major financial system are reviewed, tested, and approved prior to  implementation; and  hired contractors to appropriately segregate change management and  security management functions for a major financial system.
While SEC has made some progress in strengthening its information  security controls, it has not completed actions to correct or mitigate the  remaining 43 of the 51 previously reported weaknesses. These weaknesses  include allowing remote access to production servers via unauthorized  accounts; permitting inadequate and insecure password storage and  configuration; allowing excessive access rights to Windows servers,  network system accounts, and sensitive information; and failing to  adequately secure access to sensitive computing environments. Failure to  resolve these issues will leave SEC’s sensitive data and facilities vulnerable  to unauthorized access, manipulation, and destruction.
section_title: Ineffective Controls Place Financial and Sensitive Data at Risk
paragraphs: SEC has not effectively implemented information security controls to  properly protect the confidentiality, integrity, and availability of its  financial and sensitive information and information systems. In addition to  the 43 previously reported weaknesses that remain uncorrected, we  identified 15 new information security weaknesses during this review. Most  of the 58 identified weaknesses pertained to electronic access controls, as  illustrated in figure 1. A primary reason for these weaknesses is that SEC  has not yet fully implemented its information security program. As a result,  weaknesses in controls over its financial and sensitive data increase the  risk of unauthorized disclosure, modification, or destruction of data.
subsections: section_title: Electronic Access Controls Were Not Always Effective
paragraphs: Protecting the resources that support critical operations from unauthorized  access is a basic management objective for any organization. Organizations  accomplish this objective by designing and implementing electronic  controls that are intended to prevent, limit, and detect unauthorized access  to computing resources, programs, and information. Electronic access  controls include user accounts and passwords, access rights and  permissions, network services and devices, and audit and monitoring of  security-related events. Inadequate electronic access controls diminish the  reliability of computerized information, and they increase the risk of  unauthorized disclosure, modification, and destruction of sensitive  information and of disruption of service.
subsections: section_title: User Accounts and Passwords
paragraphs: A computer system must be able to identify and differentiate users so that  activities on the system can be linked to specific individuals. When an  organization assigns unique user accounts to specific users, the system  distinguishes one user from another—a process called identification. The  system must also establish the validity of a user’s claimed identity through  some means of authentication, such as a password, that is known only to  its owner. The combination of identification and authentication, such as  user account/password combinations, provides the basis for establishing  individual accountability and for controlling access to the system.  Accordingly, agencies (1) implement procedures to control the creation,  use, and removal of user accounts and (2) establish password parameters,  such as length, life, and composition, to strengthen the effectiveness of  account/password combinations for authenticating the identity of users.
SEC has not adequately controlled user accounts and passwords to ensure  that only authorized individuals are granted access to its systems and data.  For example, SEC has not finalized policies and procedures to enforce  strong password management or ensure the most appropriate and secure  password settings are used. Similarly, it did not complete efforts to develop  and implement a policy and process to prevent unauthorized remote access  to security accounts. As a result, there is increased risk that unauthorized  users could gain authorized user identification and password combinations  to claim a user identity and then use that identity to gain access to SEC  systems.
section_title: Access Rights and Permissions
paragraphs: A basic underlying principle for security computer systems and data is the  concept of least privilege, which means that users are granted only those  access rights and permissions they need to perform their official duties.  User rights are allowable actions that can be assigned to users or groups.  File and directory permissions are rules associated with a particular file or  directory; they regulate which users can access the file or directory and in  what manner. Organizations establish access rights and permissions to  restrict legitimate users’ access to only those programs and files that they  need to do their work. Assignment of rights and permissions must be  carefully considered to avoid giving users unnecessary access to sensitive  files and directories.
SEC routinely permitted excessive access to the computer systems that  support its critical financial and regulatory information. For example, SEC  permitted users to modify sensitive information or critical system files and  directories, although the users did not need such permissions to perform  their job-related duties. Further, the commission did not implement a  methodology to ensure that user rights were assigned on the basis of job  function on all its servers. As a result, there is increased risk that SEC’s  financial and sensitive data and applications may be compromised.
section_title: Network Services and Devices
paragraphs: Networks are collections of interconnected computer systems and devices  that allow individuals to share resources such as computer programs and  information. Because sensitive programs and information are stored on or  transmitted along networks, effectively securing networks is essential to  protecting computing resources and data from unauthorized access,  manipulation, and use. Organizations secure their networks, in part, by  installing and configuring network devices that permit authorized network  service requests, deny unauthorized requests, and limit the services that are  available on the network. Devices used to secure networks include (1)  firewalls that prevent unauthorized access to the network, (2) routers that  filter and forward data along the network, (3) switches that forward  information among segments of a network, and (4) servers that host  applications and data. Network services consist of protocols for  transmitting data between network devices. Insecurely configured network  services and devices can make a system vulnerable to internal or external  threats, such as denial-of-service attacks. Because networks often include  both external and internal access points for electronic information assets,  failure to secure these assets increases the risk of unauthorized  modification of sensitive information and systems, or of disruption of  service.
SEC did not securely control network services to prevent unauthorized  access to, and ensure the integrity of, SEC’s computer networks, systems,  and sensitive information. For example, SEC’s network infrastructure was  not securely configured, access to sensitive files on its network devices  was not adequately controlled, and SEC workstations were not adequately  configured. Further, SEC did not establish procedures for securing external  connections to its network or provide guidance for implementing secure  wireless networks. The commission’s network security weaknesses could  result in unauthorized and inappropriate access to SEC systems and  sensitive information.
section_title: Audit and Monitoring of Security-Related Events
paragraphs: To establish individual accountability, monitor compliance with security  policies, and investigate security violations, it is crucial to determine what,  when, and by whom specific actions are taken on a system. Organizations  accomplish this by implementing system or security software that provides  an audit trail that they can use to determine the source of a transaction or  attempted transaction and to monitor users’ activities. The way in which  organizations configure system or security software determines the nature  and extent of information that can be provided by the audit trail. To be  effective, organizations should configure their software to collect and  maintain audit trails that are sufficient to track security events.
SEC did not adequately audit and monitor security events. For example,  SEC has not enabled audit trails for two of its financial applications; it has  not deployed an effective intrusion detection system; and it does not have a  process to analyze security incidents. In addition, at least two of the servers  under our review lacked virus protection software. As a result, if a system  were modified or disrupted, the commission’s capability to trace or  recreate events would be diminished.
section_title: Other Information System Controls Were Not Always Effective
paragraphs: In addition to electronic access controls, other important controls should  be in place to ensure the security and reliability of an organization’s data.  These controls include policies, procedures, and control techniques to  physically secure computer resources, prevent exploitation of  vulnerabilities, appropriately segregate incompatible duties, and prevent  unauthorized changes to application software. Weaknesses in these areas  increase the risk of unauthorized use, disclosure, modification, or loss of  SEC’s financial systems and sensitive information.
subsections: section_title: Physical Security
paragraphs: Physical security controls are important for protecting computer facilities  and resources from espionage, sabotage, damage, and theft. These controls  restrict physical access to computer resources, usually by limiting access  to the buildings and rooms in which the resources are housed and by  periodically reviewing the access granted in order to ensure that access  continues to be appropriate. At SEC, physical access control measures  (such as guards, badges, and locks—used alone or in combination) are vital  to protecting the agency’s sensitive computing resources from both  external and internal threats.
SEC has taken steps to improve its physical security, such as relocating its  headquarters operations to a newly constructed building that employs  various technologies to control physical access. Further, SEC has  recognized the need for physical security enhancements and has included a  gated entry and an updated card access system in its future plans. However,  SEC did not always effectively protect and control physical access to  sensitive work areas in its facilities. For example, we found that many  personnel at an SEC facility had unneeded access to the on-site computer  room. Further, SEC did not always lock wiring closets and permitted  individuals unnecessary access to the data center. Until SEC fully  addresses its physical security vulnerabilities, there is increased risk that  unauthorized individuals could gain access to sensitive computing  resources and data and inadvertently or deliberately misuse or destroy  them.
section_title: Patch Management
paragraphs: Patch management is a critical process that can help to alleviate many of  the challenges of securing computing systems. As vulnerabilities in a  system are discovered, attackers may attempt to exploit them, possibly  causing significant damage. Malicious acts can range from defacing Web  sites to taking control of entire systems and thereby being able to read,  modify, or delete sensitive information; disrupt operations; or launch  attacks against other organizations’ systems. When a software vulnerability  is discovered, the software vendor may develop and make a patch or work- around to mitigate the vulnerability.
SEC does not have an effective patch management program. For example,  SEC has not installed patches for critical vulnerabilities on two audit log  servers and a network device. Because SEC has not installed and  maintained the latest patches, its computing systems are more vulnerable  to attackers taking advantage of outdated, less secure software.
section_title: Segregation of Computer Functions
paragraphs: Segregation of duties refers to the policies, procedures, and organizational  structure that help ensure that no single individual can independently  control all key aspects of a process or computer-related operation and  thereby gain unauthorized access to assets or records. Often segregation of  duties is achieved by dividing responsibilities among two or more  individuals or organizational groups. This division of responsibilities  diminishes the likelihood that errors and wrongful acts will go undetected,  because the activities of one individual or group will serve as a check on  the activities of the other. Inadequate segregation of duties increases the  risk that erroneous or fraudulent transactions could be processed,  improper program changes could be implemented, and computer resources  could be damaged or destroyed.
Although SEC has taken action to enhance the segregation of incompatible  security and change management functions for one of its financial  applications, we identified instances in which duties were not adequately  segregated to ensure that no individual had complete authority or system  access. For example, SEC did not adequately segregate incompatible  security and administrative functions within one of its financial  applications. Specifically, financial management staff have been assigned  roles that allow them to perform both security and systems administration  duties for the application. Without adequate segregation of duties or  appropriate mitigating controls, SEC is at increased risk that fraudulent  activities could occur without detection.
section_title: Application Change Controls
paragraphs: It is important to ensure that only authorized and fully tested application  programs are placed in operation. To ensure that changes to application  programs are necessary, work as intended, and do not result in the loss of  data or program integrity, such changes should be documented, authorized,  tested, and independently reviewed. In addition, test procedures should be  established to ensure that only authorized changes are made to the  application’s program code.
SEC did not establish and implement effective application change controls.  For example, SEC did not finalize procedures to ensure that only  authorized changes were made to the production version of application  code for all applications. Further, SEC did not appropriately document the  authorizations for software modifications, conduct independent reviews of  software changes, or adequately control its software libraries. As a result,  the risk of unauthorized, untested, or inaccurate application modifications  is increased.
section_title: Information Security Program Not Yet Fully Implemented at SEC
paragraphs: SEC has made limited progress in developing and implementing the  elements of FISMA’s mandated information security program. In response  to our prior recommendations, the commission has established a central  security management group; appointed a senior information security  officer to manage the program; increased the number of security personnel;  certified and accredited several major applications; and established a  backup data center for service continuity. However, other key elements of  an information security program have not been fully or consistently  developed, documented, or implemented for SEC’s information systems. A  key reason for SEC’s information security controls weaknesses is that the  commission has not fully developed or implemented an information  security program to ensure that effective controls are established and  maintained. Without a strong information security program, SEC cannot  protect its information and its information systems.
FISMA requires agencies to develop, document, and implement an  information security program that includes the following:  periodic assessments of the risk and the magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems;  policies and procedures that (1) are based on risk assessments, (2) cost- effectively reduce risks, (3) ensure that information security is  addressed throughout the life cycle of each system, and (4) ensure  compliance with applicable requirements;  security awareness training to inform personnel—including contractors  and other users of information systems—of information security risks  and their responsibilities in complying with agency policies and  procedures;  at least annual testing and evaluation of the effectiveness of information  security policies, procedures, and practices relating to management,  operational, and technical controls of every major information system  that is identified in the agencies’ inventories;  a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in their information security  policies, procedures, or practices;  procedures for detecting, reporting, and responding to security   plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency.
subsections: section_title: Risk Assessments
paragraphs: Identifying and assessing information security risks are essential steps in  determining what controls are required. Moreover, by increasing awareness  of the risks, these assessments can generate support for the policies and  controls that are adopted in order to help ensure that these policies and  controls operate as intended. Further, Office of Management and Budget  (OMB) Circular A-130, appendix III, prescribes that risk be reassessed  when significant changes are made to computerized systems—or at least  every 3 years.
Although SEC had risk assessments for the systems we reviewed, it did not  follow a documented process for risk assessments. Specifically, SEC did  not have policies and procedures on how to perform risk assessments.  Until the commission’s risk assessment process is completed and  institutionalized, risks may not be adequately assessed and  countermeasures may not be properly identified. As a result, inadequate or  inappropriate security controls may be implemented that do not address  the system’s true risk and efforts to implement effective controls later on  may be more costly.
section_title: Policies and Procedures
paragraphs: Another key task in developing, documenting, and implementing an  effective information security program is to establish and implement risk- based policies, procedures, and technical standards that cover security  over an agency’s computing environment. If properly implemented, policies  and procedures can help to reduce the risk that could come from  unauthorized access or disruption of services. Because security policies  are the primary mechanism by which management communicates its views  and requirements, it is important to establish and implement them.
SEC had no finalized policies governing its information security program.  Since the completion of our review, SEC has finalized SEC Regulation 24- 04, the first level of its policy framework that provides high-level policy,  requirements, and governance for security over its information systems.  However, policies and procedures for password management, remote  access to security accounts, external connections to networks, application  change controls, and patch management remain in draft. As a result, SEC  has less assurance that its systems and information are sufficiently  protected.
section_title: Security Awareness Training
paragraphs: Another FISMA requirement for an information security program is that it  promote awareness and provide required training for users so that they can  understand the system security risks and their role in implementing related  policies and controls to mitigate those risks. Computer intrusions and  security breakdowns often occur because computer users fail to take  appropriate security measures. For this reason, it is vital that employees  and contractors who use computer resources in their day-to-day operations  be made aware of the importance and sensitivity of the information they  handle, as well as the business and legal reasons for maintaining its  confidentiality, integrity, and availability. FISMA mandates that all federal  employees and contractors who use agency information systems be  provided with periodic training in information security awareness and  accepted information security practice. SEC policy requires that employees  and contractors take annual security awareness training.
SEC could not ensure that all system users complied with the annual  security awareness training requirement. The training contractor who  provided information security awareness training supplied SEC with  training reports that contained reporting inaccuracies, making it difficult  for SEC to determine if its users had complied with the training  requirement. After the completion of our review, SEC contracted with a  new vendor for security awareness training and is striving to meet its goal  of 100 percent compliance for all employees, contractors, and agency  detailees. Until SEC can ensure that each employee, contractor, and agency  detailee receives annual security awareness training, security lapses due to  user activity are more likely to occur.
section_title: Tests and Evaluations of Control Effectiveness
paragraphs: Testing and evaluating systems is a key element of an information security  program that ensures that an agency is in compliance with policies and that  policies and controls are both appropriate and effective. This type of  oversight is a fundamental element because it demonstrates management’s  commitment to the security program, reminds employees of their roles and  responsibilities, and identifies and mitigates areas of noncompliance and  ineffectiveness. Although control tests and evaluations may encourage  compliance with security policies, the full benefits are not achieved unless  the results improve the security program. Analyzing the results of security  reviews provides security specialists and business managers with a means  of identifying new problem areas, reassessing the appropriateness of  existing controls, and identifying the need for new controls. FISMA  requires that the frequency of tests and evaluations be based on risks, but  occur no less than annually.
SEC lacks a program to test and evaluate the effectiveness of information  system controls. SEC conducts security tests and evaluations as part of its  certification and accreditation process, which is required every 3 years or  when significant changes occur to the system. However, SEC had not  completed testing of its security controls in its general support system.  SEC’s Inspector General noted in its latest FISMA report that the general  support system is a critical security component for all of SEC’s major  applications. The effectiveness of the general support system controls is a  significant factor in the effectiveness of security controls for its major  applications. Since the commission has not tested the security controls in  the general support system, it cannot be assured that tests and evaluations  are sufficient to assess whether its security policies and controls are  appropriate and working as intended.
section_title: Remedial Actions
paragraphs: Remedial action plans are a key component described in FISMA. They  assist agencies in identifying, assessing, prioritizing, and monitoring the  progress in correcting security weaknesses that are found in information  systems. According to OMB Circular A-123, agencies should take timely  and effective action to correct deficiencies that they have identified  through a variety of information sources. To accomplish this, remedial  action plans should be developed for each deficiency and progress should  be tracked for each.
SEC has not developed a reporting and tracking mechanism for its remedial  action plans. Further, our review of remedial action plans for five of the  applications certified and accredited during fiscal year 2005 noted that  some of the control deficiencies had been labeled “waiver granted” and  therefore had been exempted from remedial actions. The waivers had been  granted based on future plans to replace the application or other cost- based reasons. However, the remedial plans lacked complete justifications,  risk mitigation, and cost-benefit analysis for the deficiencies that had been  waived. Nevertheless, these applications had been certified and accredited  and granted full authority to operate. As a result, SEC did not have  assurance that all known information security weaknesses had been  mitigated or corrected.
section_title: Incident Handling
paragraphs: Even strong controls may not block all intrusions and misuse, but  organizations can reduce the risks associated with such events if they  promptly take steps to detect and respond to them before significant  damage is done. In addition, accounting for and analyzing security  problems and incidents are effective ways for organizations to gain a better  understanding of the threats to their information and the costs of their  security-related problems. Such analyses can pinpoint vulnerabilities that  need to be eliminated so that they will not be exploited again. Problem and  incident reports can provide valuable input for risk assessments, can help  in prioritizing security improvement efforts, and can be used to illustrate  risks and related trends for senior management.
SEC does not have a program to handle security incidents. The commission  has drafted an incident response program plan that provides general  guidance on handling security incidents; however, it lacks a comprehensive  program to collect, document, and analyze incident information to  determine if trends exist that could be mitigated through user awareness,  training, or the addition of technical security controls. As previously  reported, SEC has acknowledged the importance of security incident  reporting and analysis, however, it does not perform trend analysis of its  security incidents. Until SEC formalizes its process for handling security  incidents, it remains at risk of not being able to detect or respond quickly to  them.
section_title: Continuity of Operations
paragraphs: Continuity of operations controls should be designed to ensure that, when  unexpected events occur, key operations continue without interruption or  are promptly resumed, and critical and sensitive data are protected. These  controls include environmental controls and procedures designed to  protect information resources and minimize the risk of unplanned  interruptions, along with a well-tested plan to recover critical operations  should interruptions occur. If service continuity controls are inadequate,  even relatively minor interruptions can result in lost or incorrectly  processed data, which can cause financial losses, expensive recovery  efforts, and inaccurate or incomplete financial or management information.
SEC accomplished some elements of disaster recovery planning, but it did  not complete all the tasks necessary to establish and maintain an effective  continuity of operations program. To its credit, SEC set up a backup data  center in a separate contractor facility to replicate its operations center  functionality and has drafted contingency plans for many of its major  applications, so that recovery steps are documented in the event of a  disaster. SEC also conducted a partially successful test to validate the  sufficiency of the plans and assess SEC’s ability to recover operations.  However, SEC successfully tested the recovery of only 12 of 20 of its major  applications. Despite SEC’s accomplishments in the disaster recovery area,  SEC must test its service continuity plans to ensure its ability to continue  and/or recover operations in the event of a disaster.
section_title: Conclusions
paragraphs: Information security weaknesses—both old and new—continue to impair  SEC’s ability to ensure the confidentiality, integrity, and availability of  financial and other sensitive data. While the commission has made some  progress in addressing our previous recommendations, the many  outstanding weaknesses place its systems at risk. Until SEC fully develops,  documents, and implements a comprehensive agencywide information  security program that includes enhanced policies, procedures, plans,  training, and continuity of operations, its facilities and computing  resources and the information that is processed, stored, and transmitted on  its systems will remain vulnerable to unauthorized access, modification, or  destruction.
section_title: Recommendations for Executive Action
paragraphs: To help establish effective information security over key financial systems,  data, and networks, we recommend that the SEC Chairman direct the Chief  Information Officer to take the following seven actions to fully develop,  document, and implement an effective agencywide information security  program:  Fully document and implement a process for assessing risks for its  information systems.
Finalize comprehensive information security policies and procedures.
Ensure that all system users comply with annual security awareness  training requirements.
Institute a testing and evaluation program that includes testing the  controls within the general support system.
Develop a mechanism to track remedial action plans that incorporates  all identified weaknesses and related risks.
Establish a program for handling security incidents with detection,  response, analysis, and reporting capabilities.
Maintain a continuity of operations program that includes fully tested  plans for restoring operations.
We are also making additional recommendations in a separate report  designated for “Limited Official Use Only.” These recommendations  address actions needed to correct specific information security  weaknesses related to electronic access controls and other information  system controls.
section_title: Agency Comments
paragraphs: In providing written comments on a draft of this report, the SEC Chairman  agreed with our recommendations. Specifically, he stated that our  recommended actions are appropriate and actionable and that SEC’s  current efforts are focused on fully implementing them. The Chairman’s  comments are reprinted in appendix I of this report.
The Chairman’s comments also addressed several achievements in  advancing SEC’s information security program, including certifying and  accrediting 16 of 20 major applications, implementing a new automated  system for tracking plans of action and milestones, and successfully testing  continuity of operations planning efforts for 12 major applications. He also  highlighted SEC’s annual security awareness training compliance rate  exceeding 90 percent and a new computer security incident response team  in place to implement and test SEC’s incident response program.
The Chairman stated that he has identified information security as the  commission’s highest information technology priority and will continue to  implement corrective actions. SEC plans to complete the corrective actions  for specific weaknesses we identified, as well as implement recommended  information security program enhancements to address the agency’s  program deficiencies.
This report contains recommendations to you. As you know, 31 U.S.C. 720  requires that the head of a federal agency submit a written statement of the  actions taken on our recommendations to the Senate Committee on  Homeland Security and Governmental Affairs and to the House Committee  on Government Reform not later than 60 days from the date of the report  and to the House and Senate Committees on Appropriations with the  agency’s first request for appropriations made more than 60 days after the  date of this report. Because agency personnel serve as the primary source  of information on the status of recommendations, GAO requests that the  agency also provide us with a copy of your agency’s statement of action to  serve as preliminary information on the status of open recommendations.
We are sending copies of this report to the Chairmen and Ranking Minority  Members of the Senate Committee on Banking, Housing, and Urban Affairs;  the Subcommittee on Oversight of Government Management, the Federal  Workforce and the District of Columbia, Senate Committee on Homeland  Security and Governmental Affairs; House Committee on Financial  Services; the Subcommittee on Government Management, Finance, and  Accountability, House Committee on Government Reform; and SEC’s  Office of Managing Executive for Operations; Office of the Executive  Director; Office of Financial Management; Office of Information  Technology; and the SEC’s Inspector General. We will also make copies  available to others on request. In addition, this report will be available at no  charge on the GAO Web site at http://www.gao.gov.
If you have any questions regarding this report, please contact me at (202)  512-6244 or by e-mail at wilshuseng@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on the  last page of this report. Key contributors to this report are listed in  appendix II.
section_title: Comments from the Securities and Exchange Commission
section_title: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, Suzanne Lightman, Assistant  Director; Jason Carroll; Lon Chin; West Coile; Anh Dang; Kristi Dorsey;  Nancy Glover; Kenneth Johnson; Stephanie Lee; Duc Ngo; Eugene Stevens;  Charles Vrabel; and Chris Warweg made key contributions to this report.