Information Security: FDIC Needs to Improve Controls over Financial Systems and Information
Released: 2017-05-31T00:00:00

Letter

Background

FDIC was established by Congress to maintain the stability of and public confidence in the nation’s financial system by insuring deposits, examining and supervising financial institutions, and resolving troubled institutions. Congress created FDIC in 1933 in response to the thousands of bank failures that had occurred throughout the late 1920s and early 1930s.

The Bank Insurance Fund and the Savings Association Insurance Fund were established as FDIC responsibilities under the Financial Institutions Reform, Recovery, and Enforcement Act of 1989, which sought to reform, recapitalize, and consolidate the federal deposit insurance system. The Bank Insurance Fund and the Savings Association Insurance Fund merged into the Deposit Insurance Fund on February 8, 2006, as a result of the passage of the Federal Deposit Insurance Reform Act of 2005. As administrator of the Deposit Insurance Fund, FDIC insures the deposits of banks and savings associations (insured depository institutions). In cooperation with other federal and state agencies, the FDIC promotes the safety and soundness of insured depository institutions by identifying, monitoring, and addressing risks to the Deposit Insurance Fund.

FDIC is also the administrator of the Federal Savings and Loan Insurance Corporation Resolution Fund. This fund was created to close out the business of the former Federal Savings and Loan Insurance Corporation and liquidate the assets and liabilities transferred from the former Resolution Trust Corporation.

FDIC Relies on Computer Systems to Support Its Mission and Financial Reporting

FDIC relies extensively on computerized systems to support its mission, including financial operations, and to store the sensitive information that it collects. The corporation uses local and wide area networks to interconnect its systems.

To support its financial management functions, FDIC uses, among other things, the following information technology (IT) resources: a corporate-wide system that functions as a unified set of financial and payroll systems that are managed and operated in an integrated fashion; a system to calculate and collect FDIC deposit insurance premiums and Financing Corporation interest amounts from insured institutions; a Web-based application that provides full functionality to support franchise marketing, asset marketing, and asset management; an application and Web portal to provide acquiring institutions with a secure method for submitting required data files to FDIC; computer programs used to derive the corporation’s estimate of losses from shared loss agreements; a system to request access to and receive permission for the computer applications and resources available to its employees, contractors, and other authorized personnel; and a primary receivership and subsidiary financial processing and reporting system.

Cyber Threats Facing Federal Systems Continue to Evolve

The federal government has seen a marked increase in the number of information security incidents affecting the integrity, confidentiality, and availability of government information, systems, and services. Without proper safeguards, computer systems are vulnerable to individuals and groups with malicious intentions who can intrude and use their access to obtain sensitive information, commit fraud and identity theft, disrupt operations, or launch attacks against other computer systems and networks. Cyber-based threats to information systems and cyber-related critical infrastructure can come from sources internal and external to the organization. External threats include the ever-growing number of cyber- based attacks that can come from a variety of sources such as individuals, groups, and countries who wish to do harm to an organization’s systems. Internal threats include errors or mistakes, as well as fraudulent or malevolent acts by employees or contractors working within an organization.

Federal Law and Guidance Provide a Framework for Protecting FDIC’s Federal Information and Systems

Under the Federal Information Security Modernization Act of 2014 (FISMA), the Chairman of FDIC is responsible for, among other things, (1) providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the agency’s information systems and information; (2) ensuring that senior agency officials provide information security for the information and information systems that support the operations and assets under their control; and (3) delegating to the corporation’s Chief Information Officer (CIO) the authority to ensure compliance with the requirements imposed on the agency under FISMA.

FISMA states that the CIO is responsible for developing and maintaining a corporate-wide information security program and for developing and maintaining information security policies, procedures, and control techniques that address all applicable requirements. FISMA also states that the CIO is to designate a senior agency information security officer to carry out the CIO’s responsibilities for information security under the law. In most federal organizations, this official is referred to as the Chief Information Security Officer.

At FDIC, the CIO is responsible for, among other things, (1) establishing the information security risk management program and ensuring that it is properly implemented; (2) establishing the overall strategy for how the corporation frames, assesses, responds to, and monitors information security risks; and (3) establishing and promulgating agency-wide information security risk awareness programs and practices. The responsibilities of the FDIC Chief Information Security Officer include, among other things, (1) overseeing the corporation’s information technology security risk management program; (2) providing information security standards, control frameworks, security policy, best practices, and security architecture oversight; (3) ensuring appropriate staffing and support of all information security positions that support the risk management program; and (4) managing and maintaining the continuous monitoring program.

FDIC Continues to Implement Controls, but Collective Weaknesses Require Management Attention

For calendar years 2016 and 2015, FDIC implemented numerous information security controls intended to protect its key financial systems. In addition, the corporation addressed 15 of 21 recommendations to mitigate control weaknesses that we had previously identified in our reports in 2013, 2014, 2015, and 2016. Nevertheless, weaknesses remained in FDIC’s implementation of access, configuration management, and information security program controls that threaten the confidentiality, integrity, and availability of its financial systems and information.

As we have previously reported, the collective effect of weaknesses in access and configuration management controls, both new and unresolved from previous audits, contributed to our determination that FDIC had a significant deficiency in internal control over financial reporting as of December 31, 2016.

Access Control Weaknesses Increased the Risk of Inappropriate Data Access

An agency can better protect the resources that support its critical operations and assets from unauthorized access, disclosure, modification, or loss by designing and implementing controls for protecting information system boundaries, identifying and authenticating users, restricting user access to only what has been authorized, encrypting sensitive data, and auditing and monitoring systems to detect potentially malicious activity, among other actions. Although FDIC had implemented numerous controls in these areas, weaknesses nevertheless continued to challenge the corporation in ensuring the confidentiality, integrity, and availability of its information and information systems.

Financial Systems Were Not Sufficiently Isolated

Boundary protection controls are intended to restrict logical access into and out of networks and control connectivity to and from network- connected devices. Any connections to the Internet or to other external and internal networks or information systems should occur through controlled interfaces (for example, gateways, routers, switches, and firewalls). In addition, networks should be appropriately configured to adequately protect access paths between systems; this can be accomplished through the use of access control lists and firewalls.

National Institute of Standards and Technology (NIST) guidance recommends that organizations employ boundary protection mechanisms to separate organization-defined information system components supporting organization-defined missions and/or business functions. Such isolation limits unauthorized information flows among system components and also provides the opportunity to deploy greater levels of protection for selected components. Consistent with NIST guidance, Office of Management and Budget Circular A-130 requires agencies to isolate sensitive or critical information resources (e.g., information systems, system components, applications, databases, and information) into separate security domains with appropriate levels of protection based on the sensitivity or criticality of those resources.

FDIC did not implement sufficient internal boundary protection controls on its network to isolate financial systems from other parts of its network. Although the corporation partially isolated financial systems from other parts of the environment using virtual local area networks, it did not always implement controls on network devices to prevent unauthorized users and systems from communicating with the financial systems.

According to FDIC, a plan to isolate sensitive systems had been made, but implementation of the plan had been delayed due to other competing priorities. Until it appropriately isolates its financial systems, FDIC faces increased risk that unauthorized or malicious attempts to communicate with its financial systems could go undetected.

FDIC Did Not Adequately Ensure Accountability for the Use of A Key Privileged Account

Identification is the process of distinguishing one user from all others, usually through user identifications (ID). These are important because they are the means by which specific access privileges are assigned and recognized by the computer. However, because the confidentiality of a user ID is typically not protected, other means of authenticating users— that is, determining whether individuals are who they say they are—are typically implemented. The combination of identification and authentication—such as user account-password combinations—provides the basis for establishing accountability and for controlling access to the system. NIST SP 800-53, revision 4 recommends that agency information systems uniquely identify and authenticate organizational users or processes acting on behalf of organizational users.

FDIC did not implement sufficient controls to ensure that users would be held accountable for the use of a key privileged account. Although the corporation employed a software tool to control access to privileged accounts, it did not use the tool to control access to a privileged account that was used by multiple engineers to manage the corporation’s virtual environment. As a result, FDIC’s ability to attribute authorized, as well as unauthorized, system activity to specific individuals could be diminished.

Authorization Controls Were Improved, but More Consistent Implementation is Needed

Authorization is the process of granting or denying access rights and privileges to a protected resource, such as a network, system, application, function, or file. A key component of granting or denying access rights is the concept of “least privilege,” which refers to granting a user only the access rights and permissions needed to perform official duties.

To restrict a legitimate user’s access to only those programs and files needed, organizations establish user access rights: allowable actions that can be assigned to a user or to groups of users. File and directory permissions are rules that are associated with a particular file or directory, regulating which users can access it—and the extent of their access rights. To avoid unintentionally giving a user unnecessary access to sensitive files and directories, an organization should give careful consideration to its assignment of rights and permissions.

NIST SP 800-53, revision 4 recommends that organizations employ the principle of least privilege by allowing only authorized users (or processes acting on behalf of users) access permission that is necessary to accomplish assigned tasks in accordance with organizational missions and business functions. NIST also recommends periodic reviews of user accounts for compliance with account management requirements. In addition, FDIC policy requires administrators to use designated administrator accounts when conducting administrative tasks. FDIC policy also requires removal of user permissions if the job responsibilities of the user change, if the user transfers to a different organization, or the user no longer requires access for any other reason. Further, the policy requires that access settings be reviewed periodically to ensure that they remain consistent with existing authorizations and current business needs.

During 2016, FDIC improved controls for authorizing users’ access by addressing all nine of the weaknesses pertaining to authorization that we had previously identified and that were still unresolved as of December 31, 2015. For example, FDIC implemented processes for reviewing individuals with access to its data centers; ensuring that users of a key financial application do not conduct access reviews of their own accounts; and removing users’ access to another financial application in a timely manner.

However, while it addressed these weaknesses from prior years, the corporation did not always consistently implement authorization controls. Specifically, FDIC database administrators for one database management system did not use designated administrative accounts when performing administrative tasks on certain databases. Additionally, although the corporation had a process for conducting periodic reviews of access settings on mainframe accounts, it did not include all mainframe accounts in the access review process. Further, about one-fifth of the user accounts we reviewed on a key financial application were granted additional privileges that had not been authorized by the users’ supervisors. This occurred because the official granting the access had institutional knowledge of the privileges that the users would need, and because FDIC’s procedures for granting access to the application did not include responsibilities and procedures for ensuring that the level of access provided had been approved by the users’ supervisor. As a result, these systems are more vulnerable to unauthorized access and modification of data.

FDIC Did Not Employ Strong Encryption on Connections to Sensitive Mainframe Resources

Cryptography controls can be used to help protect the integrity and confidentiality of data and computer programs by rendering data unintelligible to unauthorized users and/or protecting the integrity of transmitted or stored data. Cryptography involves the use of mathematical functions called algorithms and strings of seemingly random bits called keys. Among other things, the algorithms and keys are used to encrypt a message or file so that it is unintelligible to those who do not have the secret key needed to decrypt it, thus keeping the contents of the message or file confidential. NIST SP 800-53, revision 4 recommends that organizations employ encryption to protect information from unauthorized disclosure and modification during transmission. The NIST standard for an encryption algorithm is Federal Information Processing Standards Publication (FIPS Pub.) 140-2.

FDIC had not completed actions to implement our prior recommendation to use FIPS-compliant encryption for all mainframe connections. Although FDIC officials stated that they initially intended to implement a tool to enable mainframe encryption in 2016, the corporation determined that the tool would not encrypt all of the information within its planned scope. FDIC officials from the Division of Information Technology stated that the corporation is continuing to consider feasible options for encrypting mainframe connections. In the meantime, sensitive data— such as user IDs and passwords—continue to be transmitted over the network in clear text, exposing them to potential compromise.

FDIC Did Not Scan All Servers for Vulnerabilities or Sufficiently Monitor Changes to Critical Files

Audit and monitoring involves the regular collection, review, and analysis of auditable events for indications of inappropriate or unusual activity, and the appropriate investigation and reporting of such activity. Automated mechanisms may be used to integrate audit monitoring, analysis, and reporting into an overall process for investigation and response to suspicious activities. Audit and monitoring controls can help security professionals routinely assess computer security, perform investigations during and after an attack, and even recognize an ongoing attack.

NIST SP 800-53, revision 4 states that organizations should review and analyze information system audit records for indications of inappropriate or unusual activity and report the findings to designated agency personnel. Additionally, NIST states that information systems should produce audit records that establish the type of event, when the event occurred, and the identity of any individuals or subjects associated with the event, among other things.

FDIC improved its audit and monitoring controls by implementing four of the five recommendations pertaining to audit and monitoring that we had previously identified and that were still unresolved as of December 31, 2015. For example, the corporation had ensured that data on successful logins was being captured for each of its database systems for investigation of potential security incidents; implemented a centralized audit monitoring capability for its databases; improved the logging and monitoring process for several key systems; and documented all critical files on key servers that required real-time monitoring.

However, other weaknesses existed in FDIC’s implementation of audit and monitoring controls. Specifically:

FDIC had not performed vulnerability scans of all servers in its IT environment. In its November 2016 report on the effectiveness of the corporation’s information security program in accordance with the requirements of FISMA, the FDIC Office of Inspector General (OIG) reported that, at the time of its audit, FDIC was not performing vulnerability scans for more than 900 production servers within one of its general support systems. In addition, we found that FDIC had not scanned several production servers in another of its general support systems during the 3-month time period (July, August, and September 2016) that we reviewed.

According to FDIC officials, these conditions occurred because the corporation did not have an inventory of network assets that included all servers and because its legacy scanning and discovery tool had failed to identify all servers. The officials added that the scanning and discovery tool had since been replaced. Without regularly scanning all servers, FDIC cannot reasonably be assured that vulnerabilities in its servers are identified and corrected in a timely manner, increasing the risk that its systems and information may be compromised.

FDIC had not completed actions to address our prior year recommendation to ensure that changes made to critical files on certain key servers are adequately monitored. Although the corporation specified which directories on the servers were to be monitored, the logs that were generated did not provide sufficient detail to identify the individuals making changes.

According to officials in FDIC’s Division of Information Technology, the corporation plans to implement a new solution in 2017 to enable security personnel to identify users making file system changes. Until FDIC fully addresses this recommendation by ensuring that users making changes to critical files are identified and logged, increased risk continues to exist that an unauthorized individual could inappropriately modify these files without being identified.

FDIC Did Not Fully Implement Configuration Management Controls

In addition to access controls, agencies should implement policies, procedures, and techniques for managing the configuration of information systems. Configuration management controls are intended to prevent unauthorized changes to information system resources (for example, software programs and hardware configurations) and to provide reasonable assurance that systems are configured and operating securely and as intended. NIST SP 800-53, revision 4 recommends, among other things, that agencies develop and document an inventory of information system components that accurately reflects the current system and includes all components within the system’s authorization boundary; establish a baseline configuration for the information system and its constituent components; and identify and correct information system flaws, including installing security relevant software updates within a defined time period of their release.

Consistent with NIST guidelines, FDIC policy states that mandatory configuration settings must be established and documented for IT products employed within the information system using information system-defined security configuration checklists. The policy also states that applicable vendor-released software patches designed to address security vulnerabilities are to be implemented in accordance with the CIO organization’s security patching schedule.

Nevertheless, FDIC had not consistently implemented configuration management controls. For example, although the corporation used multiple tools to track and validate its IT assets, it had not established a single, authoritative, accurate listing of all IT assets in its environment. This occurred because FDIC had not established a process to reasonably assure that a complete, accurate inventory was developed and maintained. Additionally, although the corporation had defined baseline configuration settings for its information systems and had conducted configuration scans of its systems, it had not yet fully implemented processes for verifying that configurations are consistently applied. Further, although FDIC had applied patches to certain third-party applications supporting financial processing and had made significant progress in identifying and tracking vulnerabilities related to third-party software, it had not yet fully implemented processes to ensure that assets that require patching are identified correctly.

Without establishing a reliable, authoritative listing of its IT assets and documenting, implementing, and monitoring security configurations, FDIC has reduced assurance that its information supporting financial processing is securely configured. Additionally, unless known vulnerabilities in FDIC’s systems and applications are patched, increased risk exists that they could be exploited, potentially exposing the corporation’s financial systems and information to unauthorized access or modification.

FDIC Developed and Documented Elements of Its Corporate Information Security Program, but Shortcomings Still Existed

An entitywide information security management program is the foundation of a security control structure and a reflection of senior management’s commitment to addressing security risks. The security management program should establish a framework and continuous cycle of activity for assessing risk, developing and implementing effective security procedures, and monitoring the effectiveness of these procedures. Without a well-designed program, security controls may be inadequate; responsibilities may be unclear, misunderstood, or improperly implemented; and controls may be inconsistently applied.

FISMA requires each agency to develop, document, and implement an information security program to provide security for the information and information systems that support the agency’s operations and assets, including those provided or managed by another agency, contractor, or other organization on its behalf. Agency programs are to include, among other things, the following elements: periodic assessments of risk, including the magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the organization; plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency; policies and procedures that are based on risk assessments, cost- effectively reduce information security risks to an acceptable level, and ensure that information security is addressed throughout the life cycle of each organizational information system; periodic testing and evaluation of the effectiveness of information security policies, procedures, practices, and security controls to be performed with a frequency depending on risk, but no less than annually; a process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in the information security policies, procedures, and practices of the organization; and procedures for detecting, reporting, and responding to security incidents.

In addition, FISMA requires the head of each federal agency to ensure that information security management processes are integrated with agency strategic and operational planning processes.

FDIC had developed, documented, and implemented many elements of its corporate information security program. For example, it had defined security categories for the general support systems we reviewed based on risk using NIST guidance, assessed the risk from control deficiencies identified during security control tests, and ensured that the general support systems we reviewed were authorized to operate; and conducted a disaster recovery test of its general support systems and mission-critical applications.

However, FDIC had not fully or consistently implemented aspects of its information security program, which was an underlying reason for many of the information security weaknesses identified during our review. Specifically, FDIC had not included all necessary information in procedures for granting access to a key financial application; fully addressed the FDIC OIG’s finding that security control assessments of outsourced service providers had not been completed in a timely manner; fully addressed key previously identified weaknesses related to establishing agencywide configuration baselines and monitoring changes to critical server files; and completed actions to address the FDIC OIG’s finding that the corporation had not ensured that major security incidents are identified and reported in a timely manner.

In addition, in November 2016, the FDIC OIG reported that the corporation had not yet developed and documented an up-to-date information security strategic plan or completed actions to address weaknesses in its Information Security Managers program. These shortcomings are discussed in more detail in the following section.

FDIC Developed Many Security Policies, but A Key Procedure Was Lacking

A key element of an effective information security program is to develop, document, and implement risk-based policies, procedures, and technical standards that govern the security over an agency’s computing environment. Information security policy is essential to establishing roles, responsibilities, and requirements necessary for implementing an information security program. The supporting procedures provide the information and guidance on implementing the policies. According to NIST SP 800-53, revision 4, organizations should develop and document procedures to facilitate the implementation of access and configuration management policies and associated controls.

Although FDIC developed and documented many information security policies and procedures that were consistent with the NIST Risk Management Framework, its procedure for granting users access to a key financial application did not include responsibilities and steps for ensuring that the level of access provided had been approved by the users’ supervisor. As a result, the official granting access to the application—who had institutional knowledge of the privileges that the users would need—granted additional privileges to some users for which they had not been previously approved. Until it updates its procedure to include these responsibilities and steps, FDIC will continue to face increased risk that users may be granted access to privileges in the application for which they have not been approved.

FDIC Assessed Security Controls, but Outsourced Service Providers Were Not Always Assessed Timely

A key element of an information security program is to test and evaluate policies, procedures, and controls to determine whether they are effective and operating as intended. Security control testing should include management, operational, and technical controls for every system identified in the agency’s required inventory of major systems. Although control tests and evaluations may encourage compliance with security policies, the full benefits are not achieved unless the results are used to improve security. FISMA requires that the frequency of tests and evaluations of management, operational, and technical controls be based on risks and occur no less than annually.

The Office of Management and Budget (OMB) directs agencies to meet their FISMA-required controls testing by drawing on security control assessment results that include, but are not limited to, continuous monitoring activities. According to NIST SP 800-53, revision 4, continuous monitoring programs facilitate ongoing awareness of threats, vulnerabilities, and information security to support organizational risk management decisions. NIST also recommends that organizations monitor security control compliance by external service providers on an ongoing basis.

FDIC developed a continuous control assessment methodology that defined the controls tested for each information system and the frequency that each control is to be tested. In addition, the corporation tested the effectiveness of the security controls for the three general support systems we reviewed in accordance with the methodology.

However, the FDIC OIG has previously reported weaknesses in FDIC’s assessments of its outsourced service providers. Specifically, in October 2015, it reported that the corporation had not always ensured that security assessments of outsourced service providers were completed in a timely manner. In November 2016, the OIG reported that FDIC had made meaningful progress towards completing timely assessments of its outsourced service providers, but noted that continued management attention was warranted in this area to ensure outstanding assessments are completed timely.

FDIC Resolved Many Previously Identified Weaknesses, but Key Weaknesses Remain

When security weaknesses are identified, the related risks should be assessed, appropriate corrective or remediation actions should be taken, and follow-up monitoring should be performed to make certain that corrective actions are effective. FISMA specifically requires that agencywide information security programs include a process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in the information security policies, procedures, and practices of the agency.

NIST SP 800-53, revision 4 recommends that organizations develop a plan of action and milestones (POA&M) for information systems to document the planned remedial actions to correct weaknesses or deficiencies identified during security control assessments. A POA&M should also be updated based on the findings from the security controls assessment, security impact analysis, and continuous monitoring activities.

FDIC documented POA&Ms for weaknesses identified during internal control assessments and implemented an effective process for tracking and mitigating identified weaknesses for each of the systems that we reviewed. In addition, as of December 31, 2016, FDIC had addressed 15 of the 21 previously reported information system weaknesses that were unresolved at the end of our prior audit. For example, FDIC had improved controls for authorizing users’ access to financial applications and for logging and monitoring financial systems to detect potentially malicious activity. However, six previously identified weaknesses remained unresolved. Until it completes actions to address previously identified weaknesses, FDIC will continue to face increased risk that its systems may not be adequately or consistently protected against unauthorized access to systems or data. Appendix II details the status of weaknesses that were unaddressed as of December 31, 2015 or were initially reported in 2016.

Shortcomings Existed in FDIC’s Incident Response Process

Comprehensive monitoring and incident response controls are necessary for rapidly detecting incidents, minimizing loss and destruction, mitigating the weaknesses that were exploited, and restoring computing services. While strong controls may not prevent all incidents, agencies can reduce the risks associated with these events by detecting and promptly responding before significant damage is done. FISMA requires federal agencies to develop and implement procedures for detecting, reporting, and responding to security incidents. NIST SP 800-53, revision 4 further recommends that agencies develop, document, and disseminate procedures to facilitate the implementation of the incident response policy and associated incident response controls.

FDIC developed and documented information security policies and procedures on incident response. For example, its policy on reporting computer security incidents states that the FDIC Computer Security Incident Response Team is responsible for evaluating the seriousness of computer security incidents and taking appropriate corrective actions, including notifying FDIC senior management, the OIG, and other outside entities, when appropriate.

Nevertheless, shortcomings existed in FDIC’s implementation of its policies. Specifically, FDIC did not provide reasonable assurance that “major incidents,” as defined by OMB guidance, were identified and reported in a timely manner. Specifically, the OIG reported in July 2016 that FDIC’s incident response policies, procedures, and guidelines did not address major incidents. In addition, the large volume of potential security violations identified by its Data Loss Prevention tool, together with limited resources devoted to reviewing potential violations, hindered meaningful analysis of the information and FDIC’s ability to identify all security incidents, including major ones. Among other things, the OIG recommended that FDIC (1) revise its incident response policies, procedures, and guidelines to address major incidents; (2) ensure that these revisions include criteria for determining whether an incident is major, consistent with FISMA and Office of Management and Budget guidance; and (3) review the current implementation of the Data Loss Prevention tool to determine how it can be better leveraged to safeguard sensitive FDIC information.

In November 2016, the FDIC OIG reported that, in response to these findings, the corporation was working to improve its incident response capabilities by developing an overarching incident response program guide, hiring an incident response coordinator, implementing a new incident tracking system, updating incident response policies and procedures, and performing a comprehensive assessment of the FDIC’s information security and privacy programs. If fully implemented, these actions could improve FDIC’s ability to identify and address security incidents, including major incidents.

FDIC Did Not Complete Key Information Security Strategic Management Activities

According to NIST SP 800-39, effective risk management requires organizations such as FDIC to operate in highly complex, interconnected environments using state-of-the-art and legacy information systems— systems that organizations depend on to accomplish their missions and to conduct important business-related functions. The complex relationships among missions, mission/business processes, and the information systems supporting those missions and processes require an integrated, organization-wide view for managing risk.

Effective management of information security risk is critical to the success of organizations in achieving their strategic goals and objectives. NIST SP 800-100 states that agencies should have a strategic plan for information security that identifies goals and objectives related to the agency’s mission, specifies a plan for achieving those goals, and establishes short- and mid-term performance targets and measures that allow the agency to track, manage, and monitor its progress toward those goals and objectives. In addition, according to NIST SP 800-39, agencies should establish roles and responsibilities for managing information security risk.

However, FDIC had not fully implemented key activities for managing and overseeing information security risk across the organization. Specifically: In November 2016, the FDIC OIG reported that FDIC’s information security strategic plan was not up-to-date. Specifically, although the corporation had an information security strategic plan, this plan had expired in 2015 and did not fully reflect OMB’s cybersecurity priorities or the corporation’s strategies. Without an up-to-date strategic plan, ongoing and planned IT initiatives may not be linked to the corporation’s long-term security and business goals and priorities.

FDIC had not completed actions to address gaps in how the roles and responsibilities of its Information Security Managers (ISM) are defined and carried out. In October 2015, the FDIC OIG reported that the duties and roles of the ISMs in addressing information security requirements and risks had evolved since the ISM program was established. It also reported that FDIC had not completed a recent comprehensive assessment to determine whether the skills, training, oversight, and resource allocations pertaining to the ISMs enabled them to effectively carry out their increased responsibilities and address security risks within their divisions and offices. In November 2016, the OIG reported that FDIC had conducted an assessment of its ISM program, which identified gaps in areas such as available resources, training, and performance measurement. The OIG also reported that FDIC plans to complete all actions to address these gaps by 2018. Until then, however, increased risk exists that these capability gaps could impact the effectiveness of the FDIC’s information security program.

Conclusions

FDIC had implemented and strengthened many information security controls over its financial systems and information. For example, the corporation had taken steps to improve controls for restricting user access to only what has been authorized, auditing and monitoring systems for potentially malicious activity, and applying patches to address known software vulnerabilities by addressing many of the weaknesses that we previously reported. However, management attention is needed to address new and previously identified deficiencies in access controls— including boundary protection, identification and authentication, authorization, cryptography, and audit and monitoring controls—and in configuration management controls. These deficiencies, considered collectively, are the basis for our determination that FDIC had a significant deficiency in internal control over financial reporting in its information systems controls as of December 31, 2016.

In addition, FDIC had developed, documented, and implemented many elements of its corporate information security program. However, further actions are needed to address shortcomings in the corporation’s program, such as ensuring that its procedure for granting access to a key financial application includes key responsibilities and steps.

Given the important role that information systems play in FDIC’s internal controls over financial reporting, it is vitally important that the corporation address weaknesses in information security controls—both old and new—as part of its ongoing efforts to mitigate the risks from cyber attacks and to ensure the confidentiality, integrity, and availability of its financial and sensitive information. Continued and consistent management commitment and attention to access, configuration management, and security management controls will be essential to addressing existing deficiencies and further improving FDIC’s information system controls.

Recommendations for Executive Action

To help improve the corporation’s implementation of its information security program, we recommend that the Chairman of FDIC direct the Chief Information Officer to update the procedure for granting access to the key financial application, to include responsibilities and steps for ensuring that the access privileges granted have been approved by the users’ supervisor.

In a separate report with limited distribution, we are also making six recommendations to resolve shortcomings in FDIC’s internal control over financial reporting and help strengthen access and configuration management controls over key financial information, systems, and networks.

Agency Comments and Our Evaluation

In written comments on a draft of this report (reprinted in appendix II), FDIC concurred with our recommendation to improve its implementation of its information security program and stated that corrective actions will be completed by July 2017. FDIC also provided an attachment detailing its actions to implement our recommendation.

In addition to the aforementioned comments, FDIC provided technical comments that we have addressed in our report as appropriate. In these comments, the corporation expressed concern about one additional recommendation to improve its information security program that we had made in our draft report. Specifically, the draft report had included a recommendation that FDIC develop, document, and implement procedures for ensuring that configuration actions identified by its Computer Security Incident Response Team are taken. In written and oral comments, FDIC officials provided additional information about the corporation’s incident handling process in order to clarify that the condition we identified did not pose a risk to the corporation’s information and systems. After our review of this information, we agree that the condition does not pose a risk to the corporation and, accordingly, removed the recommendation from our final report.

We are sending copies of this report to interested congressional parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you have any questions regarding this report, please contact Nick Marinos at (202) 512-9342 or Dr. Nabajyoti Barkakati at (202) 512-4499. We can also be reached by e-mail at marinosn@gao.gov and barkakatin@gao.gov. Key contributors to this report are listed in appendix II.

Appendix I: Objective, Scope, and Methodology

The objective of this information security review was to determine the effectiveness of the Federal Deposit Insurance Corporation’s (FDIC) controls in protecting the confidentiality, integrity, and availability of its financial systems and information. To do this, we identified and reviewed FDIC information systems control policies and procedures, tested controls over key financial applications, and held interviews with key security representatives and management officials in order to determine whether information security controls were in place, adequately designed, and operating effectively. The review was conducted as part of our audit of the financial statements of the two funds administered by FDIC: the Deposit Insurance Fund and the Federal Savings and Loan Insurance Corporation Resolution Fund.

The scope of our audit included an examination of FDIC information security policies, procedures, and controls over key financial systems in order to (1) assess the effectiveness of corrective actions taken by FDIC to address weaknesses we previously reported and (2) determine whether any additional weaknesses existed. This work was performed in support of our opinion on internal control over financial reporting as it relates to our audits of the calendar years 2016 and 2015 financial statements of the two funds administered by FDIC.

The independent public accounting firm of Cotton & Company LLP tested certain FDIC information systems controls, including the follow-up on the status of FDIC’s corrective actions during calendar year 2016 to address open recommendations from our prior years’ reports. We agreed on the scope of the audit work, monitored the firm’s progress, and reviewed the related audit documentation to determine whether the firm’s findings were adequately supported.

To determine whether controls over key financial systems and information were effective, we considered the results of FDIC’s actions to mitigate previously-reported weaknesses that remained open as of December 31, 2015, and performed audit work at FDIC facilities in Arlington, Virginia. We concentrated our evaluation primarily on the controls for systems and applications associated with financial processing, such as the (1) New Financial Environment; (2) Communication, Capability, Challenge, and Control System; (3) Portfolio Investment Accounting; (4) Assessments Information Management System; and (5) general support systems. Our selection of the systems to evaluate was based on consideration of systems that directly or indirectly support the processing of material transactions that are reflected in the funds’ financial statements.

Our audit methodology was based on the Federal Information System Controls Audit Manual, which contains guidance for reviewing information system controls that affect the confidentiality, integrity, and availability of computerized information.

Using standards and guidance from the National Institute of Standards and Technology and the Office of Management and Budget, as well as FDIC’s policies and procedures, we evaluated controls by examining network diagrams and device configuration settings to determine if intrusion detection and prevention systems were monitoring the FDIC network for suspicious activity; reviewing privileged accounts to verify that access to privileged accounts was appropriately controlled and that accounts were not shared among multiple users; analyzing user application authorizations to determine whether users had more permissions than necessary to perform their assigned functions; reviewing administrative account settings to determine if privileged accounts were used as required and if access to a privileged account was appropriately controlled; assessing configuration settings to evaluate settings used to audit inspecting vulnerability scans for in-scope systems to determine whether scans were conducted regularly and whether patches were appropriately installed on affected systems.

Using the requirements of the Federal Information Security Modernization Act of 2014, which establishes elements for an agency-wide information security program, we evaluated FDIC’s implementation of its security program by examining system authorization documentation for information on FDIC’s implementation of risk categorization and risk assessment practices; reviewing information security policies and procedures to determine whether they were adequately documented and implemented; examining FDIC training records for information on general and reviewing assessments of security controls to determine if they had been completed as scheduled; reviewing an FDIC Office of Inspector General (OIG) report for information on the corporation’s processes for assessing security controls of outsourced service providers; examining remedial action plans to determine whether FDIC had addressed identified vulnerabilities in a timely manner; examining two FDIC OIG reports for information on the corporation’s reviewing security event records to determine if security events were tracked and resolved appropriately; reviewing continuity of operations plans, contingency plans, and test results to determine whether contingency planning controls were appropriately implemented; and examining two FDIC OIG reports for information on the corporation’s information security strategic management activities.

To determine the status of FDIC’s actions to correct or mitigate previously reported information security weaknesses, we reviewed prior GAO reports to identify previously reported weaknesses, examined FDIC’s corrective action plans, and assessed the effectiveness of those actions.

We conducted this audit in accordance with U.S. generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provided a reasonable basis for our findings and conclusions based on our audit objective.

Appendix II: Comments from the Federal Deposit Insurance Corporation

Appendix III: GAO Contacts and Staff Acknowledgments

GAO Contacts

Staff Acknowledgments

In addition to the individuals named above, Gregory Wilshusen (Director); Gary Austin, Paul Foderaro, and Michael Hansen (Assistant Directors); William Cook (Analyst in Charge); Wayne Emilien; Nancy Glover; Franklin Jackson; Thomas J. Johnson; Jean Mathew; David Plocher; Dacia Stewart; and Adam Vodraska made key contributions to this report.