Information Security: Federal Deposit Insurance Corporation Needs to Sustain Progress Improving Its Program
Released: 2007-05-18T00:00:00

Letter

Background

Information security is a critical consideration for any organization that depends on information systems and computer networks to carry out its mission or business. It is especially important for government agencies, where maintaining the public’s trust is essential. The dramatic expansion in computer interconnectivity and the rapid increase in the use of the Internet have changed the way our government, the nation, and much of the world communicate and conduct business. However, without proper safeguards, systems are unprotected from individuals and groups with malicious intent to intrude and use the access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. This concern is well-founded for a number of reasons, including the dramatic increase in reports of security incidents, the ease of obtaining and using hacking tools, the steady advance in the sophistication and effectiveness of attack technology, and the dire warnings of new and more destructive attacks to come.

Computer-supported federal operations are likewise at risk. Our previous reports and those of agency inspectors general describe persistent information security weaknesses that place a variety of federal operations at risk of disruption, fraud, and inappropriate disclosure. Thus, we have designated information security as a governmentwide high-risk area since 1997, a designation that remains today.

Recognizing the importance of securing federal agencies’ information and systems, Congress enacted the Federal Information Security Management Act of 2002 (FISMA) to strengthen the security of information and systems within federal agencies. FISMA requires each agency to use a risk-based approach to develop, document, and implement a departmentwide information security program for the information and systems that support the operations and assets of the agency.

FDIC Is a Key Protector of Bank and Thrift Depositors

Congress created FDIC in 1933 to restore and maintain public confidence in the nation’s banking system. The Financial Institutions Reform, Recovery, and Enforcement Act of 1989 sought to reform, recapitalize, and consolidate the federal deposit insurance system. The act designated FDIC as the administrator of two funds responsible for protecting insured bank and thrift depositors—BIF and the SAIF. The act also designated FDIC as the administrator of the FSLIC Resolution Fund, which was created to complete the affairs of the former FSLIC and liquidate the assets and liabilities transferred from the former Resolution Trust Corporation. On February 8, 2006, the President signed into law the Federal Deposit Insurance Reform Act of 2005. Among its provisions, the act calls for the merger of the BIF and SAIF into the DIF. FDIC completed this merger on March 31, 2006. In managing these funds, the corporation has an examination and supervision program to monitor the safety of deposits held in member institutions.

FDIC insures deposits in excess of $4 trillion for its 8,693 member institutions. FDIC had a budget of about $1.06 billion for calendar year 2006 to support its activities in managing the funds. For that year, it processed almost 21 million financial transactions.

FDIC Reliance on Computer Systems

FDIC relies extensively on computerized systems to support its financial operations and store the sensitive information that it collects. Its local and wide area networks interconnect these systems. To support its financial management functions, the corporation relies on the NFE and several financial systems that process and track financial transactions, including premiums paid by its member institutions and disbursements made to support operations. Other systems maintain personnel information for employees, examination data for financial institutions, and legal information on closed institutions. At the time of our review, there were about 5,629 users on FDIC systems.

Federal law delineates responsibilities for the management of computer systems at FDIC. Under FISMA, the Chairman of FDIC is responsible for, among other things, (1) providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the agency’s information systems and information; (2) ensuring that senior agency officials provide information security for the information and information systems that support the operations and assets under their control; and (3) delegating to the agency’s Chief Information Officer the authority to ensure compliance with the requirements imposed on the agency under FISMA.

Two deputies to the Chairman—the Chief Financial Officer and Chief Operating Officer—also have information security responsibilities. The Chief Financial Officer is responsible for the preparation of financial statements and ensures that they are fairly presented and demonstrate discipline and accountability. The Chief Financial Officer is part of a senior management group that oversees the NFE. The group receives monthly system progress updates from the NFE project team.

The Chief Operating Officer is responsible for planning, coordinating, evaluating, and improving programs and resource management. He is also in charge of the Chief Information Officer, who is responsible for developing and maintaining a departmentwide information security program and for developing and maintaining information security policies, procedures, and control techniques that address all applicable requirements.

Objectives, Scope, and Methodology

The objectives of our review were to assess (1) the progress FDIC has made in correcting or mitigating remaining information system control weaknesses reported as unresolved at the time of our prior review in 2005 and (2) the effectiveness of the corporation’s information system controls for protecting the confidentiality, integrity, and availability of financial and sensitive data. An integral part of our objectives was to support the opinion on internal control in GAO’s 2006 financial statement audit by assessing the degree of security over systems that support the generation of the FDIC funds’ financial statements.

Our scope and methodology was based on our Federal Information System Controls Audit Manual, which contains guidance for reviewing information system controls that affect the confidentiality, integrity, and availability of computerized data. Focusing on FDIC’s financial systems and associated infrastructure, we evaluated the effectiveness of information security controls that are intended to prevent, limit, and detect access to computer resources (data, programs, and systems), thereby protecting these resources against unauthorized disclosure, modification, and use; provide physical protection of computer facilities and resources from unauthorized use, espionage, sabotage, damage, and theft; prevent the exploitation of vulnerabilities; prevent the introduction of unauthorized changes to application or system ensure that work responsibilities for computer functions are segregated so that one individual does not perform or control all key aspects of computer-related operations and thereby have the ability to conduct unauthorized actions or gain unauthorized access to assets or records without detection; and ensure the implementation of secure and effective configuration management.

In addition, we evaluated aspects of FDIC’s information security program as they relate to NFE. This program includes assessing risk; developing and implementing policies, procedures, and security plans; promoting security awareness and providing specialized training for those with significant security responsibilities; testing and evaluating the effectiveness of controls; planning, implementing, evaluating, and documenting remedial actions to address information security deficiencies; detecting, reporting, and responding to security incidents; and ensuring the continuity of operations.

To evaluate FDIC’s information security controls and program, we identified and examined pertinent FDIC security policies, procedures, guidance, security plans, and relevant reports provided during fieldwork. In addition, we conducted tests and observations of controls in operation and reviewed corrective actions taken by the corporation to address vulnerabilities identified during our previous review. We also discussed with key security representatives, system administrators, and management officials whether information system controls were in place, adequately designed, and operating effectively.

We performed our review at the FDIC computer facility in Arlington, Virginia, from September 2006 through February 2007. Our review was performed in accordance with generally accepted government auditing standards.

FDIC Has Made Substantial Progress Correcting Previously Reported Weaknesses

FDIC has taken steps to address security control weaknesses. The corporation has corrected or mitigated 21 of the 26 weaknesses that we previously reported as unresolved at the completion of our calendar year 2005 audit (see app. I). For example, the corporation has developed and implemented procedures to prohibit the transmission of mainframe user and administrator passwords in plaintext across the network, established and implemented a process to monitor and report on vendor- supplied account/password combinations, and improved mainframe security monitoring controls.

While the corporation has made important progress in strengthening its information security controls, it is still in the process of completing actions to correct or mitigate the remaining five previously reported weaknesses. These uncorrected actions include ensuring that only authorized application software changes are implemented, limiting network access to sensitive personally identifiable and business proprietary information, effectively generating and reviewing the NFE audit reports, adequately controlling physical access to the Virginia Square building, and properly segregating incompatible system-related functions, duties, and capacities for an individual associated with the NFE. Not addressing these actions could leave the corporation’s sensitive data vulnerable to unauthorized access and manipulation.

Appendix I describes the previously reported weaknesses in information security controls that were unresolved at the time of our prior review and the status of the corporation’s corrective actions.

FDIC Has Made Progress in Information System Controls, However Some Weaknesses Remain

Although FDIC made substantial improvements to its information system controls, unresolved and newly identified weaknesses could limit its ability to effectively protect the confidentiality, integrity, and availability of its financial and sensitive information and information systems. Specifically, we identified new weaknesses in controls related to (1) e-mail security, (2) physical security, and (3) configuration management. Although these control weaknesses do not pose significant risks of misstatement to the financial reports, they do increase the risk to FDIC’s financial and sensitive systems and information and increase the risk of unauthorized modification of data and programs, inappropriate disclosure of sensitive information, or disruption of critical operations.

E-mail Security

E-mail is perhaps the most popular system for exchanging business information over the Internet or any other computer network. Because the computing and networking technologies that underlie e-mail are widespread and well-known, attackers are able to develop attack methods to exploit security weaknesses. E-mail messages can be secured in various ways including the use of digital signatures. Digital signatures can be used to ensure the integrity of an e-mail message and confirm the identity of its sender. National Institute of Standards and Technology (NIST) guidance recommends that organizations consider the implementation of secure e- mail technologies such as digital signatures to ensure the integrity of e- mail data. FDIC policy requires individual division managers to establish specific procedures regarding the use of secure e-mail technologies for e- mail.

FDIC did not use secure e-mail methods to protect the integrity of certain accounting data transferred over an internal communication network. The corporation relied upon unsecured e-mail transmission of accounting data instead of using more secure methods, such as securing e-mail with digital signatures or using the internal data transmission functions in NFE. Specifically, it did not use secure e-mail correspondence during monthly NFE closing processes because the Division of Finance—the division responsible for the financial environment—had not developed requirements for securing e-mail. In addition, the e-mail system could be compromised by sending e-mails using forged sender names and addresses. As a result, increased risk exists that an attacker could manipulate accounting data.

Physical Security

Physical security controls are important for protecting computer facilities and resources from espionage, sabotage, damage, and theft. These controls involve restricting physical access to computer resources, usually by limiting access to the buildings and rooms in which the resources are housed, and periodically reviewing access granted to ensure that it continues to be appropriate. FDIC policy also requires that visitors be allowed to enter an office only after providing proof of identity, identifying the person they are visiting, signing a visitor log, obtaining a visitor badge, and being escorted at all times by the employee whom they are visiting.

FDIC did not apply physical security controls for some instances. For example, an unauthorized visitor was able to enter a key FDIC facility without providing proof of identity, signing a visitor log, obtaining a visitor’s badge, or being escorted. In addition, a workstation that had access to a payroll system was located in an unsecured office. As a result, increased risk exists that unauthorized individuals could gain physical access to a key facility and to systems that have sensitive information.

Configuration Management

Configuration management involves the identification and management of security features for all hardware, software, and firmware components of an information system at a given point and systematically controls changes to that configuration during the system’s life cycle. The agency should have configuration management controls to ensure that only authorized changes are made to such critical components. In addition, all applications and changes to those applications should go through a formal, documented systems development process that identifies all changes to the baseline configuration. Also, procedures should ensure that no unauthorized software is installed. Patch management, a component of configuration management, is an important element in mitigating the risk associated with software vulnerabilities. Up-to-date patch installations help mitigate vulnerabilities associated with flaws in software code that could be exploited to cause significant damage. FDIC policy requires that patches be implemented within the specified time frames. In addition, FDIC policy states that configuration status accounting and configuration auditing, which includes both functional and physical audits, should be performed. Configuration audits help to maintain the integrity of the configuration baseline as well as to ensure that when a significant product change is introduced, only authorized changes are being made. FDIC policy also states that project documentation should be managed and updated as it evolves over time.

FDIC did not consistently implement configuration management controls for NFE. Specifically, the corporation did not develop and maintain a complete listing of all configuration items and a baseline configuration for NFE, including application software, data files, software development tools, hardware, and documentation; ensure that all significant system changes, such as parameter changes, go through a change control process; apply comprehensive patches to system software in a timely manner. For example, a FDIC report stated that in the third quarter of fiscal year 2006, software patches for 15 out of 21 high-risk vulnerabilities and 5 out of 34 medium-risk vulnerabilities were not implemented within required time frames. In another report, between July 9, 2006, and October 9, 2006, out of nine high-risk patches that were not implemented within the required time period, eight were not implemented for 42 days. review status accounting reports, or perform complete functional and physical configuration audits; and update or control documents to reflect the current state of the environment and to ensure consistency with related documents. Specifically, documents such as the NFE security plan, risk assessment, and contingency plan did not reflect the current environment.

The NFE project team did not institute the above because it did not always consistently follow the processes as outlined in the NFE configuration management plan. According to FDIC officials, they were not following the plan because it has not been updated to reflect the new system development life cycle. In addition, according to an FDIC official, patches were not implemented in the specified time frames because contractors do not always follow FDIC policy.

As a result, the corporation has a higher risk that NFE may not perform as intended.

NFE Was Not Fully Integrated into the Corporation’s Information Security Program

Although FDIC had taken steps to develop, document, and implement a corporate information security program, it did not fully implement key control activities for NFE. For example, FDIC had not sufficiently assessed risks, updated the security plan, reported computer security incidents, or updated the contingency plan to reflect the current environment for NFE.

Risk Assessments

Identifying and assessing information security risks are essential steps in determining what controls are required. Moreover, by increasing awareness of risks, these assessments can generate support for the policies and controls that are adopted in order to help ensure that they operate as intended. Security testing and evaluation can be used to efficiently identify system vulnerabilities for use in a risk assessment. NIST guidance states that the risk assessment should be updated to reflect the results of the security test and evaluation.

The risk assessment for NFE was not properly updated. FDIC performed a security test and evaluation after the risk assessment was performed. However, the risk assessment was not updated to include the risks associated with any of the newly identified vulnerabilities. As a result, NFE may have inadequate or inappropriate security controls that might not address the system’s true risk.

Security Plans

A security plan provides an overview of the system’s security requirements and describes the controls that are in place—or planned—to meet those requirements. Common security controls are controls that can be applied to one or more organizational information systems. System-specific controls are the responsibility of the information system owner. NIST guidance states that system security plans should clearly identify which security controls have been designated as common security controls and the individual responsible for implementing the common security control. In addition, NIST guidance states that organizations should update information system security plans to address system/organizational changes.

The corporation did not update the system security plan for NFE. FDIC has identified 77 management, operational, and technical common security controls established in its information system. However, the NFE security plan was not updated to clearly identify common security controls. In addition, the security plan was not updated to reflect the correct servers or recently installed mainframe hardware. As a result, increased risk exists that proper controls may not be implemented for the NFE.

Incident Handling

Even strong controls may not block all intrusions and misuse, but organizations can reduce the risks associated with such incidents if they take steps to promptly detect and respond to them before significant damage is done. In addition, analyzing security incidents allows organizations to gain a better understanding of the threats to their information and the costs of their security-related problems. Such analyses can pinpoint vulnerabilities that need to be eliminated so that they will not be exploited again. FISMA requires that agency information security programs include procedures for detecting and reporting security incidents. NIST guidance states that organizations should implement an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery. In addition, NIST guidance states that organizations should regularly review and analyze information system audit records for indications of inappropriate or unusual activity, investigate suspicious activity or suspected violations, report findings to appropriate officials, and take necessary actions. FDIC policy requires all users of the corporate information systems to report suspected computer security incidents to the Computer Security Incident Response Team (CSIRT).

FDIC has implemented an incident handling program, including establishing a team and associated procedures for detecting, responding to, and reporting computer security incidents. However, the corporation did not always review events occurring in the NFE to determine whether the events were computer security incidents or not. For example, during our observation of the purchase order matching process, an FDIC official overrode a matching exception. Although an override exception matching report was generated, it was not reviewed to determine if it was an incident, and was not forwarded to CSIRT. According to an official, there were not always procedures to review events in NFE. As a result, increased risk exists that computer security incidents that relate to the NFE will not be identified.

Continuity of Operations

Continuity of operations, which includes disaster recovery planning, should be designed to ensure that when unexpected events occur, essential operations continue without interruption or can be promptly resumed, and critical and sensitive data are protected. These controls include procedures to minimize the risk of unplanned interruptions, along with a well-tested plan to recover critical operations should interruptions occur. FISMA requires that agencies have plans and procedures to ensure the continuity of operations for information systems that support the operations and assets of the agency. NIST guidance states that disaster recovery plans, including contingency plans, should be maintained in a ready state that accurately reflects system requirements, procedures, and organizational structure.

FDIC has developed plans for the continuity of NFE operations. To assess the effectiveness of the plans, FDIC successfully tested the NFE at its new disaster recovery site. However, the NFE contingency plan was not updated to reflect the new disaster recovery site. In addition, the plan identified servers that were not in use. As a result, FDIC has limited assurance it will be able to efficiently implement continuity of operations for the NFE in the event of an emergency when knowledgeable employees are not available.

Conclusions

FDIC has made substantial progress in correcting previously reported weaknesses and has taken other steps to improve information security. Although five weaknesses from prior reports remain unresolved and new control weaknesses related to (1) e-mail security, (2) physical security, and (3) configuration management were identified, the remaining unresolved weaknesses previously reported and the newly identified weaknesses did not pose significant risk of misstatement in the corporation’s financial statements for calendar year 2006. However, the old and new weaknesses do increase preventable risk to the corporation’s financial and sensitive systems and information.

Since FDIC did not fully integrate its NFE into its information security program, it did not fully implement key control activities for NFE, such as sufficiently assessing risks, updating the security plan, reporting computer security incidents, or updating the contingency plan to reflect the current environment. Continued management commitment to integrating the NFE into the corporate information security program will be essential to ensure that the corporation’s financial and sensitive information will be adequately protected. As the corporation continues to enhance the NFE, its reliance on controls implemented in this single, integrated financial system will increase. Until FDIC fully integrates NFE into the security program, its ability to maintain adequate information system controls over its financial and sensitive information will be limited.

Recommendations for Executive Action

In order to sustain progress to its program, we recommend that the FDIC Chief Financial Officer and Chief Operating Officer direct that the following 12 actions be performed in a timely manner: Require that e-mail containing or transmitting accounting data be secured to protect the integrity of the accounting data.

Train security personnel to implement the corporation’s policy on physical security of the facility.

Instruct FDIC personnel to lock rooms that contain sensitive software.

Develop a configuration item index of all configuration items for NFE using a consistent and documented naming convention.

Require that significant changes to the system, such as parameter changes, go through a formal change management process.

Implement patches in a timely manner.

Require that the NFE project team review status accounting reports and perform complete functional and physical configuration audits.

Adequately control the NFE documents so that they are up-to-date and accurately reflect the current environment.

Update the NFE risk assessment to include the risk associated with vulnerabilities identified during security testing and evaluation.

Update the NFE security plan to clearly identify all common security controls.

Develop procedures to review events occurring in the NFE to determine whether the events are computer security incidents.

Update the contingency plan to reflect the new disaster recovery site and servers that are in use.

Agency Comments and Our Evaluation

We received written comments on a draft of this report from FDIC’s Deputy to the Chairman and Chief Financial Officer (these are reprinted in app. II). The Deputy acknowledged the benefit of the recommendations made as part of this year’s audit and stated that FDIC concurred with seven of our recommendations and has implemented or will implement them in the coming year. He also stated that FDIC partially concurred with our remaining five recommendations and has developed or implemented plans to adequately address the underlying risks that prompted these five recommendations, in some instances through alternative corrective actions.

With regard to the five recommendations to which FDIC partially concurred, if the corporation adequately implements the corrective actions below, it will have satisfied the intent of our recommendations. Regarding our recommendation that FDIC require that e-mail containing or transmitting accounting data be secured to protect the integrity of the accounting data, the Deputy stated that by July 31, 2007, FDIC will ensure that the integrity of accounting data transmitted by e-mail is appropriately protected, and that it will evaluate the various exchanges of accounting information and identify and document where more secure communications are needed. Concerning our recommendation that FDIC instruct personnel to lock rooms that contain sensitive software, the Deputy stated that FDIC has conducted additional analysis on the software that had access to payroll information and has removed that software from the desktop. With regard to our recommendation that FDIC require that significant changes to the system, such as parameter changes, go through a formal change management process, the Deputy stated that by December 31, 2007, FDIC will have developed procedures that will include appropriate management of, and documentation standards for, parameter changes. Based on the Deputy’s comments, we have clarified our recommendation that FDIC update the NFE risk assessment to include the risk associated with vulnerabilities identified during security testing and evaluation. The Deputy stated that FDIC has since changed its process to require updates to the risk assessments when applications undergo major changes that affect the security of the system. Finally, with regard to the recommendation that FDIC develop procedures to review events occurring in the NFE to determine whether the events are computer security incidents, the Deputy stated that FDIC addressed this issue during the first quarter of 2007 when it established a formal process for monitoring and reviewing such events. In addition, FDIC plans to have documented procedures for elevating potential security violations to the incident handling team and for monitoring unusual events by August 31, 2007.

We are sending copies of this report to the Chairman and Ranking Minority Member of the Senate Committee on Banking, Housing, and Urban Affairs; the Chairman and Ranking Minority Member of the House Committee on Financial Services; members of the FDIC Audit Committee; officials in FDIC’s divisions of information resources management, administration, and finance; and the FDIC inspector general. We will also make copies available to others upon request. In addition, this report will be available at no charge on the GAO Web site at http://www.gao.gov.

If you have any questions regarding this report, please contact me at (202) 512-6244 or by e-mail at wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III.

Appendix I: Status of Previously Reported Weaknesses

Information Security: Information System Controls at the Federal Deposit Insurance Corporation (GAO-04-629)

1. Federal Deposit Insurance Corporation (FDIC) was using live data to support application 2. Personal firewall settings for corporate examiner laptop computers that were used for remotely connecting to the network were not adequately secured.

Information Security: Federal Deposit Insurance Corporation Needs to Sustain Progress (GAO-05-487SU) 3. Procedures were not established to prevent processes running in supervisor state in one logical partition from accessing datasets stored in another partition. 4. Procedures were not in place to identify and effectively control risks caused by sharing critical system components between production and nonproduction LPARs (logical partitions). 5. Structured query language database server configurations for many of FDIC’s financial applications were not adequately secured. 6. Procedures have not been consistently followed for authorizing, documenting, and reviewing Information Security: Federal Deposit Insurance Corporation Needs to Improve Its Program (GAO-06-619SU) 7. FDIC did not always change vendor-supplied account/password combinations. 8. FDIC did not adequately control inactive user accounts. FDIC policy requires accounts that have not been used within 60 days be deleted. 9. FDIC transmitted mainframe user and administrator passwords in plaintext across the 10. FDIC did not adequately enforce password management restrictions. 11. FDIC access authorizations did not consistently support the access rights granted to New Financial Environment (NFE) users. 12. FDIC did not adequately control access to datasets containing sensitive data critical to the integrity of loss calculations used by the Division of Insurance. 13. FDIC did not effectively limit network access to sensitive personally identifiable and business proprietary information.

X 14. FDIC did not securely configure Internet-accessible remote access to its information resources. 15. FDIC permitted the use of unencrypted network protocols on its UNIX systems. 16. FDIC did not securely configure an Oracle production database. 17. FDIC did not properly secure the Apache Tomcat server that hosts a production database used by the employee time and attendance system. 18. FDIC did not securely configure its workstations. 19. FDIC laptop computers had unnecessary wireless technologies enabled. 20. FDIC’s Blackberry Enterprise Server and handheld devices were deployed and configured with several security weaknesses.

Audit and monitoring of security-related events 21. FDIC did not effectively generate NFE audit reports or review them. 22. FDIC’s ability to monitor changes to critical mainframe datasets was inadequate. 23. FDIC did not sufficiently audit system activities on its Oracle databases. 24. FDIC did not adequately control physical access to the Virginia Square computer processing facility. 25. FDIC did not properly segregate incompatible system-related functions, duties, and capacities for an individual associated with the NFE. 26. FDIC granted NFE accounts payable users inappropriate access to perform incompatible functions.

Appendix II: Comments from the Federal Deposit Insurance Corporation

Appendix III: GAO Contacts and Staff Acknowledgments

GAO Contacts

Staff Acknowledgments

In addition to the individual named above, William F. Wadsworth, Assistant Director; Verginie A. Amirkhanian; Daniel D. Castro; Patrick R. Dugan; Edward Glagola Jr.; Mickie E. Gray; David B. Hayes; Kaelin P. Kuhn; Duc M. Ngo; Tammi L. Nguyen; Eugene E. Stevens IV; Henry I. Sutanto; and Amos Tevelow made key contributions to this report.