Information Security: Securities and Exchange Commission Needs to Consistently Implement Effective Controls
Released: 2009-03-16T00:00:00

Letter

Background

Information security is a critical consideration for any organization that depends on information systems and computer networks to carry out its mission or business and is especially important for government agencies, where maintaining the public’s trust is essential. While the dramatic expansion in computer interconnectivity and the rapid increase in the use of the Internet have enabled agencies such as SEC to better accomplish their missions and provide information to the public, the changes also expose federal networks and systems to various threats. For example, the Federal Bureau of Investigation has identified multiple sources of cyber threats, including foreign nation states engaged in information warfare, domestic criminals, hackers and virus writers, and disgruntled employees working within an organization. Concerns about these threats are well founded for a number of reasons, including the dramatic increase in reports of security incidents, the ease of obtaining and using hacking tools, and steady advances in the sophistication and effectiveness of attack technology. For example, the number of incidents reported by federal agencies to the United States Computer Emergency Readiness Team (US- CERT), has increased dramatically over the past 3 years, increasing from 3,634 incidents reported in fiscal year 2005 to 13,029 incidents in fiscal year 2007 (a 259 percent increase). Without proper safeguards, systems are vulnerable to individuals and groups with malicious intent who can intrude and use their access to obtain or manipulate sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks.

Our previous reports and reports by federal inspectors general describe persistent information security weaknesses that place federal agencies at risk of disruption, fraud, or inappropriate disclosure of sensitive information. Accordingly, we have designated information security as a governmentwide high-risk area since 1997, a designation that remains in force today. Recognizing the importance of securing federal agencies’ information systems, Congress enacted the Federal Information Security Management Act (FISMA) in December 2002 to strengthen the security of information and systems within federal agencies. FISMA requires each agency to develop, document, and implement an agencywide information security program to provide information security for the information and systems that support the operations and assets of the agency, using a risk- based approach to information security management.

SEC’s Role as Protector of Securities Investors

Following the stock market crash of 1929, Congress passed the Securities Exchange Act of 1934, establishing SEC to enforce securities laws, regulate the securities markets, and protect investors. To carry out its responsibilities and help ensure that securities markets are fair and honest, SEC issues rules and regulations that promote adequate and effective disclosure of information to the investing public. The commission also oversees the registration of other key participants in the securities industry, including stock exchanges, broker-dealers, clearing agencies, depositories, transfer agents, investment companies, and public utility holding companies. SEC is an independent, quasi-judicial agency that operates at the direction of five commissioners appointed by the President and confirmed by the Senate.

In fiscal year 2008, SEC received a budget authority of $906 million and had a staff of 3,511 employees. In addition, the commission collected $569,000 in filing fees and about $434 million in penalties and disgorgements.

To support its financial operations and store the sensitive information it collects, SEC relies extensively on computerized systems interconnected by local and wide-area networks. For example, to process and track financial transactions, such as filing fees paid by corporations, disgorgements and penalties from enforcement activities, and procurement activities, SEC relies on several enterprise database applications—Momentum; Phoenix; Electronic Data Gathering, Analysis, and Retrieval (EDGAR); and Fee Momentum—and a general support system network that allows users to communicate with the database applications. The database applications provide SEC with the following capabilities: Momentum is used to record the commission’s accounting transactions, to maintain its general ledger, and to maintain some of the information SEC uses to produce financial reports.

Phoenix contains and processes sensitive data relating to penalties, disgorgements, and restitution on proven and alleged violations of securities and futures laws.

EDGAR performs automated collection, validation, indexing, acceptance, and forwarding of submissions by companies and others that are required to file certain information with SEC. Its primary purpose is to increase the efficiency and fairness of the securities market for the benefit of investors, corporations, and the economy by accelerating the receipt, acceptance, dissemination, and analysis of time-sensitive corporate information filed with the agency.

The general support system is an integrated client-server system composed of local- and wide-area networks and is organized into distinct subsystems based along SEC’s organizational and functional lines. The general support system provides services to internal and external customers who use them for their business applications. It also provides the necessary security services to support these applications.

Under FISMA, the Chairman of SEC has responsibility for, among other things, (1) providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the agency’s information systems and information; (2) ensuring that senior agency officials provide information security for the information and information systems that support the operations and assets under their control; and (3) delegating to the agency chief information officer (CIO) the authority to ensure compliance with the requirements imposed on the agency. FISMA requires the CIO to designate a senior agency information security officer who shall carry out the CIO’s information security responsibilities.

SEC Has Made Important Progress Correcting Previously Reported Weaknesses and Improving Security

SEC has corrected or mitigated 18 of the 34 security control weaknesses that we had reported as unresolved at the time of our prior audit report in 2008. For example, it has adequately validated electronic certificates from connections to its physically secured the perimeter of the operations center, monitored unusual and suspicious activities at its operations center, and removed network system accounts and data center access rights from separating employees.

In addition, SEC has made progress in improving its information security program. For example, the commission has developed, documented, and implemented a policy on remedial action plans to help ensure that deficiencies are mitigated in an effective and timely manner, and provided individuals with training for incident handling. These efforts constitute an important step toward strengthening the agencywide information security program mandated by FISMA.

While SEC has made important progress in strengthening its information security controls, it has not completed actions to correct or mitigate 16 of the previously reported weaknesses. For example, SEC has not adequately documented access privileges for the EDGAR application, always implemented patches on vulnerable workstations and enterprise database servers, or always sufficiently protected passwords. Failure to resolve these issues could leave sensitive data vulnerable to unauthorized disclosure, modification, or destruction.

Control Weaknesses Continue to Place Financial Information at Risk

In addition to the 16 previously reported weakness that remain uncorrected, we identified 23 new weaknesses in controls intended to restrict access to data and systems, as well as weaknesses in other information security controls, that continue to jeopardize the confidentiality, integrity, and availability of SEC’s financial and sensitive information and information systems. Previously reported and newly identified weaknesses hinder the commission’s ability to perform vital functions and increase the risk of unauthorized disclosure, modification, or destruction of financial information. A key reason for these weaknesses was that SEC did not fully implement key activities of its information security program.

SEC Did Not Sufficiently Control Access to Information Resources

A basic management objective for any organization is to protect the resources that support its critical operations and assets from unauthorized access. Organizations accomplish this by designing and implementing controls that are intended to prevent, limit, and detect unauthorized access to computer resources (e.g., data, programs, equipment, and facilities), thereby protecting them from unauthorized disclosure, modification, and loss. Specific access controls include identification and authentication, authorization, cryptography, audit and monitoring, and physical security. Without adequate access controls, unauthorized individuals, including outside intruders and former employees, can surreptitiously read and copy sensitive data and make undetected changes or deletions for malicious purposes or personal gain. In addition, authorized users can intentionally or unintentionally modify or delete data or execute changes that are outside of their span of authority.

Controls for Identifying and Authenticating Users Were Not Consistently Enforced

A computer system must be able to identify and authenticate the identities of users so that activities on the system can be linked to specific individuals. When an organization assigns unique user accounts to specific users, the system is able to distinguish one user from another—a process called identification. The system must also establish the validity of a user’s claimed identity by requesting some kind of information, such as a password, that is known only by the user—a process known as authentication. Furthermore, SEC policy requires the implementation of automated identification and authentication mechanisms that enable the unique identification of individual users and systems.

SEC did not consistently enforce identification and authentication controls for its users and systems. For example, it did not always securely configure the snmp community string (similar to a password) used to monitor and manage network devices; remove the default vendor account for a remote network service, which could allow access to the network service without the need to provide a password; restrict multiple database administrators from sharing the same log-on application ID to a powerful database account; and uniquely identify individual accounts on network switches for https login.

As a result, increased risk exists that users will not be uniquely identified before they access the SEC network, and SEC will not be able to hold them accountable in the event of a security incident.

User Access to Systems Was Not Sufficiently Restricted

Authorization is the process of granting or denying access rights and privileges to a protected resource, such as a network, system, application, function, or file. A key component of granting or denying access rights is the concept of “least privilege.” Least privilege is a basic principle for securing computer resources and data that means that users are granted only those access rights and permissions that they need to perform their official duties. To restrict legitimate users’ access to only those programs and files that they need in order to do their work, organizations establish access rights and permissions. “User rights” are allowable actions that can be assigned to users or to groups of users. File and directory permissions are rules that are associated with a particular file or directory, regulating which users can access it—and the extent of that access. To avoid unintentionally giving users unnecessary access to sensitive files and directories, an organization must give careful consideration to its assignment of rights and permissions. In addition, SEC policy requires that each user or process be assigned only those privileges or functions needed to perform authorized tasks and that approval of such privileges be documented. Furthermore, SEC policy states that only services that are absolutely necessary are allowed to have a remote connection.

SEC did not always sufficiently restrict system access and privileges to only those users that needed access to perform their assigned duties. For example, SEC did not always remove excessive user privileges on its financial systems, properly document or maintain approval of user access privileges to the restrict unnecessary remote access to database servers, and limit users’ privileges so that users do not monopolize database system resources during critical times of the day.

As a result, increased risk exists that users could gain inappropriate access to computer resources, circumvent security controls, and deliberately or inadvertently read, modify, or delete critical financial information. In addition, SEC’s financial information may not be available when it is needed.

Network Services Were Not Always Encrypted

Cryptography underlies many of the mechanisms used to enforce the confidentiality and integrity of critical and sensitive information. A basic element of cryptography is encryption. Encryption can be used to provide basic data confidentiality and integrity by transforming plaintext into ciphertext using a special value known as a key and a mathematical process known as an algorithm. The National Security Agency recommends encrypting network services. If encryption is not used, user ID and password combinations are susceptible to electronic eavesdropping by devices on the network when they are transmitted.

Although SEC has implemented a network topology that employs extensive switching and limits eavesdropping to only the network segment accessible by the potential eavesdropper, it did not always ensure that information transmitted over the network was adequately encrypted. While the eavesdropping risk on the SEC network is reduced by its topology, nonetheless, increased risk exists that individuals could capture user IDs and passwords and use them to gain unauthorized access to network devices.

Audit and Monitoring of Security-Relevant Events on Databases Was Inadequate

To establish individual accountability, monitor compliance with security policies, and investigate security violations, it is crucial to determine what, when, and by whom specific actions have been taken on a system. Organizations accomplish this by implementing system or security software that provides an audit trail for determining the source of a transaction or attempted transaction and monitoring users’ activities. To be effective, organizations should (1) configure the software to collect and maintain a sufficient audit trail for security-relevant events; (2) generate reports that selectively identify unauthorized, unusual, and sensitive access activity; and (3) regularly monitor and take action on these reports. SEC also requires the enforcement of auditing and accountability by configuring information systems to produce, store, and retain audit records of system, application, network, and user activity.

SEC did not adequately configure several database systems to enable auditing and monitoring of security-relevant events. For example, it did not configure one database to record successful log-ons or security violations for unauthorized modification of data, and three databases to safeguard log data against loss. As a result, there is increased likelihood that unauthorized activities or policy violations would not be detected.

Weaknesses in Physical Security Controls Reduced Their Effectiveness

Physical security controls are important for protecting computer facilities and resources from espionage, sabotage, damage, and theft. These controls involve restricting physical access to computer resources, usually by limiting access to the buildings and rooms in which the resources are housed, and periodically reviewing access rights granted to ensure that access continues to be appropriate based on criteria established for granting it. At SEC, physical access control measures (such as guards, badges, and locks, used either alone or in combination) are vital to protecting its computing resources and the sensitive data it processes from external and internal threats.

Although SEC has strengthened its physical security controls, certain weaknesses reduced its effectiveness in protecting and controlling physical access to sensitive work areas. For example, on multiple occasions SEC employees entered electronically secured interior spaces by following another employee through an open door instead of using their badges to obtain access. In addition, physical security standards have been drafted but have not been approved by management. As a result, increased risk exists that unauthorized individuals could gain access to sensitive computing resources and data and inadvertently or deliberately misuse or destroy them.

Weaknesses in Other Information System Controls Increase Risk

Incompatible Duties and Functions Were Not Adequately Segregated

In addition to having access controls, an organization should have policies, procedures, and control techniques in place to appropriately segregate computer-related duties. Segregation of duties refers to the policies, procedures, and organizational structure that help ensure that one individual cannot independently control all key aspects of a process or computer-related operation and thereby gain unauthorized access to assets or records. Often segregation of incompatible duties is achieved by dividing responsibilities among two or more organizational groups. Dividing duties among two or more individuals or groups diminishes the likelihood that errors and wrongful acts will go undetected because the activities of one individual or group will serve as a check on the activities of another. Inadequate segregation of duties increases the risk that erroneous or fraudulent transactions could be processed, improper program changes implemented, and computer resources damaged or destroyed. In addition, SEC policy requires that each user or process be assigned only those privileges or functions needed to perform authorized tasks.

SEC did not adequately segregate incompatible computer-related duties and functions. For example, a financial services branch chief could perform multiple incompatible duties such as creating, modifying, and deleting security organizations, roles, and security categories. At the same time, he could perform financial operations such as creating, approving, and changing invoices. These conditions existed, in part, because SEC lacked implementation guidelines for assigning incompatible duties among personnel administering its computer applications environment. In addition, although SEC has logically separated many of its networked devices, it did not always adequately separate network management traffic from general network traffic. As a result, general users could gain inappropriate access and intentionally or inadvertently disrupt network operations. As a consequence, increased risk exists that users could perform unauthorized system activities without detection.

Configuration Management Controls Were Not Adequately Implemented

Configuration management is another important control that involves the identification and management of security features for all hardware and software components of an information system at a given point and systematically controls changes to that configuration during the system’s life cycle. An effective configuration management process includes procedures for (1) identifying, documenting, and assigning unique identifiers (for example, serial number and name) to a system’s hardware and software parts and subparts, generally referred to as configuration items; (2) evaluating and deciding whether to approve changes to a system’s baseline configuration; (3) documenting and reporting on the status of configuration items as a system evolves; (4) determining alignment between the actual system and the documentation describing it; and (5) developing and implementing a configuration management plan for each system. In addition, establishing controls over the modification of information system components and related documentation helps to prevent unauthorized changes and ensure that only authorized systems and related program modifications are implemented. This is accomplished by instituting policies, procedures, and techniques that help make sure all hardware, software, and firmware programs and program modifications are properly authorized, tested, and approved.

SEC has implemented several elements of a configuration management process. Specifically, it has documented policies and procedures for assigning unique identifiers and naming configuration items so that they can be distinguished from one another and for requesting changes to configuration items. SEC has also developed a change request process and an enterprise-level change control board to review changes.

However, SEC has not adequately implemented key configuration management controls over the information system components associated with the upgrade to Momentum. Specifically, it did not always document, evaluate, or approve changes to a system’s baseline. For example, it did not consistently document test plans; adequately document or approve changes to the requirements, design, and scripts; establish or maintain configuration baselines; or apply up-to-date patches on its database servers that support processing of financial data. In addition, SEC did not document and report on the status of configuration items as Momentum evolved, nor did it conduct configuration audits to determine the alignment between the actual system and the documentation describing it.

Furthermore, SEC did not (1) develop a configuration management plan for Momentum, (2) assign a manager or team to conduct these activities, and (3) use adequate tools to implement the process. As a result, increased risk exists that authorized changes will not be made and unauthorized changes will be made to the Momentum system.

SEC Has Not Fully Implemented Its Information Security Program

SEC has made important progress in implementing its information security program. For example, SEC has provided individuals with training for incident handling and developed, documented, and implemented a policy on remedial action plans to ensure that deficiencies are mitigated in an effective and timely manner. However, a key reason for the information security weaknesses is that it has not effectively or fully implemented key program activities. Until all key elements of its information security program are fully and consistently implemented, SEC will not have sufficient assurance that new weaknesses will not emerge and that financial information and financial assets are adequately safeguarded from inadvertent or deliberate misuse, fraudulent use, improper disclosure, or destruction.

SEC Has Not Filled the Senior Agency Information Security Officer Position

FISMA requires the CIO to designate a senior agency information security officer who shall have information security duties as that official’s primary duty and head an office with the mission and resources to assist in ensuring agency compliance with the provisions of the act. This officer will be responsible for carrying out the CIO’s information security responsibilities, including developing and maintaining a departmentwide information security program, developing and maintaining information security policies and procedures, and providing training and oversight to security personnel.

However, although SEC appointed an acting senior agency information security officer from April to July 2008, the position has been vacant for the past 8 months. According to an SEC official, a vacancy announcement has not yet been posted for this position. Without a senior security officer to provide direction for an agencywide security focus, SEC is at increased risk that its security program will not be adequate to ensure the security of its highly interconnected computer environment.

SEC Did Not Fully Report Risks to Management

FISMA and its implementing policies require agencies to develop, document, and implement periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information or information systems. The National Institute of Standards and Technology (NIST) also states that a risk assessment report should be presented as a systematic and analytical approach to assessing risk so that senior management will understand the risks and allocate resources to reduce and correct potential losses. SEC policy states that security risk assessment involves the identification and evaluation of IT security risks. This process identifies IT security-related risks to information and information systems, considers the probability of occurrence, and measures their potential impact. The SEC Office of IT Security Group is responsible for periodically reviewing the risk assessments to ensure that all aspects of risk and applicable IT security requirements have been adequately addressed.

SEC did not provide full information for management oversight of risks associated with the Momentum application. For example, the SEC security testing and evaluation for Momentum identified numerous configuration management vulnerabilities that affect other areas such as access controls, separation of duties, and inappropriate administrative roles assigned to individuals. Several of these vulnerabilities in the security testing and evaluation were not reported in the risk assessment summary for the Momentum application for management attention. As a result, SEC management may not be fully aware of all risks or the magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support their operations and assets.

System Security Tests Were Not Always Sufficient

FISMA and its implementing policies require periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices performed with a frequency depending on risk, but no less than annually; this should include testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems. This type of oversight is a fundamental element of a security program because it demonstrates management’s commitment to the program, reminds employees of their roles and responsibilities, and identifies areas of noncompliance and ineffectiveness. Analyzing the results of security reviews provides security specialists and business managers with a means of identifying new problem areas, reassessing the appropriateness of existing controls, and identifying the need for new controls. FISMA requires that the frequency of tests and evaluations be based on risks and occur no less than annually.

However, SEC did not sufficiently conduct periodic testing and evaluation of controls. For example, SEC did not test and evaluate the effectiveness of security controls for the general support system supporting Momentum and EDGAR in fiscal year 2008. In addition, the scope and depth of security testing and evaluation that were performed were not comprehensive and often did not identify control weaknesses. To illustrate, SEC did not test or assess the effectiveness of a key subsystem used to develop financial statements, and an independent contractor tested only 4 of 65 security roles in Momentum, severely limiting the scope of the testing. In addition, control tests conducted by SEC on Momentum did not identify vulnerabilities in the following controls: (1) configuration management, (2) separation of duties, (3) audit and monitoring, and (4) access controls; in contrast our tests identified vulnerabilities in these controls. As a result, there is heightened risk that SEC cannot be assured that Momentum and EDGAR meet requirements and perform as intended.

A Key Intermediary Subsystem Was Not Certified and Accredited

According to NIST, security certification and accreditation of information systems and subsystems are important activities that support a risk management process and are an integral part of an agency’s information security program. Security certification consists of conducting a security control assessment and developing the security documents. Security accreditation is the official management decision given by a senior agency official to authorize the operation of an information system and to explicitly accept the risk it may present to agency operations, agency assets, or individuals based on the implementation of an agreed-upon set of security controls. Required by Office of Management and Budget (OMB) Circular A-130, appendix III, security accreditation provides a form of quality control and challenges managers and technical staffs at all levels to implement the most effective security controls possible on an information system, given mission requirements and technical, operational, and cost/schedule constraints. After certification, a security accreditation package with security documents is provided to the authorizing official with the essential information for the official to make a credible, risk- based decision on whether to authorize operation of the information system. The security accreditation package includes the security plan, risk assessment, contingency plan, security assessment report, and plan of action and milestones.

SEC did not certify and accredit a key intermediary subsystem that supports the production of its financial statements. In preparing its financial statements, SEC regularly used this intermediary subsystem to process transactions before loading the financial data into the Momentum application. The subsystem encompassed (1) an application tool to handle transactions of disgorgement data between the Phoenix and Momentum applications; (2) spreadsheets to record, calculate, maintain, and report financial transactions from various accounts; and (3) a third-party tool used for manipulating, sorting, and merging financial data. SEC did not certify or accredit the subsystem or include it as part of the security certification and accreditation process for Phoenix and Momentum. For example, the subsystem was not described in a security plan, risk assessment, contingency plan, security assessment report, or plan of action and milestone. Without certification and accreditation of the intermediate subsystem, possible security weaknesses may go undetected and management may not be alerted to potential vulnerabilities.

Conclusions

SEC has made progress in correcting or mitigating previously reported weaknesses. However, information security weaknesses—both old and new—continue to impair the agency’s ability to ensure the confidentiality, integrity, and availability of financial and sensitive information. These weaknesses represent a significant deficiency in internal controls over the information systems and data used for financial reporting.

A key reason for these weaknesses is that the agency has not yet fully implemented critical elements of its agencywide information security program. Until SEC (1) mitigates known information security weaknesses in access controls and other information system controls and (2) fully implements a comprehensive agencywide information security program that includes filling the security officer position, adequately reporting risks, conducting effective system security tests, and certifying and accrediting an intermediary subsystem, its financial information will remain at increased risk of unauthorized disclosure, modification, or destruction, and its management decisions may be based on unreliable or inaccurate information.

Recommendations for Executive Action

To assist the commission in improving the implementation of its agencywide information security program, we recommend that the SEC Chairman direct the CIO to take the following four actions: designate a senior agency information security officer who will be responsible for managing SEC’s information security program, provide full information for management oversight of information security conduct comprehensive periodic testing and evaluation of the effectiveness of security controls for the general support system and key financial applications, and certify and accredit subsystems that support the production of SEC’s financial statements.

In a separate report with limited distribution, we are also making 32 recommendations to enhance SEC’s access controls and configuration management practices.

Agency Comments

In providing written comments on a draft of this report, the SEC Chairman agreed with our recommendations and reported that the agency is on track to address our new findings and to complete remediation of prior year findings. She stated that strong internal controls are one of SEC’s highest priorities and that it is committed to proper stewardship of the information entrusted to it by the public. The Chairman’s written comments are reprinted in appendix II.

We are sending copies of this report to the Chairmen and Ranking Members of the Senate Committee on Banking, Housing, and Urban Affairs; the Senate Committee on Homeland Security and Governmental Affairs; the House Committee on Financial Services; and the House Committee on Oversight and Government Reform. We are also sending copies to the Secretary of the Treasury, the Director of the Office of Management and Budget, and other interested parties. In addition, this report will be available at no charge on our Web site at http://www.gao.gov.

If you have any questions about this report, please contact Gregory C. Wilshusen at (202) 512-6244 or Dr. Nabajyoti Barkakati at (202) 512-4499. We can also be reached by e-mail at wilshuseng@gao.gov or barkakatin@gao.gov. Contacts for our offices of Congressional Relations and Public Affairs may be found on the last page of this report. Individuals who made key contributions to this report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

The objectives of our review were (1) to determine the status of the Securities and Exchange Commission’s (SEC) actions to correct or mitigate previously reported information security weaknesses and (2) to determine whether controls over key financial systems were effective in ensuring the confidentiality, integrity, and availability of financial and sensitive information. This review was performed for the purpose of supporting the opinion developed during our audit of SEC’s internal controls over the preparation of its 2008 financial statements.

To determine the status of SEC’s actions to correct or mitigate previously reported information security weaknesses, we identified and reviewed its information security policies, procedures, practices, and guidance. We reviewed prior GAO reports to identify previously reported weaknesses and examined the commission’s corrective action plans to determine which weaknesses it had reported were corrected. For those instances where SEC reported that it had completed corrective actions, we assessed the effectiveness of those actions by reviewing the appropriate documents and interviewing the appropriate officials.

To determine whether controls over key financial systems were effective, we tested the effectiveness of selected information security controls. We concentrated our evaluation primarily on the controls for financial applications, enterprise database applications, and network infrastructure—Momentum; Phoenix; Electronic Data Gathering, Analysis, and Retrieval (EDGAR); Fee Momentum; and the general support system—that directly or indirectly support the processing of material transactions reflected in the agency’s financial statements. Our evaluation was based on our Federal Information System Controls Audit Manual, which contains guidance for reviewing information system controls that affect the confidentiality, integrity, and availability of computerized information.

Using National Institute of Standards and Technology (NIST) standards and guidance and SEC’s policies, procedures, practices, and standards, we evaluated controls by testing the complexity and expiration of password settings on selected servers to determine if strong password management was enforced; analyzing users’ system authorizations to determine whether users had more permissions than necessary to perform their assigned functions; observing methods for providing secure data transmissions across the network to determine whether sensitive data were being encrypted; observing whether system security software was logging successful testing and observing physical access controls to determine if computer facilities and resources were being protected from espionage, sabotage, damage, and theft; inspecting key servers and workstations to determine whether critical patches had been installed or were up to date; examining access privileges to determine whether incompatible functions were segregated among different individuals; and observing end user activity pertaining to the process of preparing SEC financial statements.

Using the requirements identified by the Federal Information Security Management Act (FISMA), the Office of Management and Budget (OMB), and NIST, we evaluated SEC’s implementation of its security program by reviewing SEC’s risk assessment process and risk assessments for three key systems that support the preparation of financial statements to determine whether risks and threats were documented consistent with federal guidance; analyzing SEC’s policies, procedures, practices, and standards to determine their effectiveness in providing guidance to personnel responsible for securing information and information systems; analyzing security plans to determine if management, operational, and technical controls were in place or planned and that security plans were updated; examining training records for personnel with significant security responsibilities to determine if they received training commensurate with those responsibilities; analyzing security testing and evaluation results for three key systems to determine whether management, operational, and technical controls were tested at least annually and based on risk; examining remedial action plans to determine whether they addressed vulnerabilities identified in security testing and evaluations; and examining contingency plans for three key systems to determine whether those plans had been tested or updated.

We also discussed, with key security representatives and management officials, whether information security controls were in place, adequately designed, and operating effectively. We conducted this audit from July 2008 to March 2009 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Securities and Exchange Commission

Appendix III: GAO Contacts and Staff Acknowledgments

GAO Contacts

Staff Acknowledgments

In addition to the contacts named above, David B. Hayes and William F. Wadsworth (Assistant Directors), Angela M. Bell, Mark J. Canter, Kirk J. Daubenspeck, Patrick R. Dugan, Mickie E. Gray, Sharon S. Kitrell, Lee A. McCracken, Stephanie Santoso, Duc M. Ngo, Tammi L. Nguyen, Henry I. Sutanto, Edward R. Tekeley and Jayne L. Wilson made key contributions to this report.