Information Security: Federal Deposit Insurance Corporation Needs to Sustain Progress
Released: 2005-05-19T00:00:00

Letter

Background

Congress created FDIC in 1933 to restore and maintain public confidence in the nation’s banking system. The Financial Institutions Reform, Recovery, and Enforcement Act of 1989 sought to reform, recapitalize, and consolidate the federal deposit insurance system. The act created the Bank Insurance Fund and the Savings Association Insurance Fund, both of which are responsible for protecting insured bank and thrift depositors. The act also abolished the FSLIC and created the FSLIC Resolution Fund to complete the affairs of the former FSLIC and liquidate the assets and liabilities transferred from the former Resolution Trust Corporation. It also designated FDIC as the administrator of these funds. As part of this function, FDIC has an examination and supervision program to monitor the safety of deposits held in member institutions.

FDIC insures deposits in excess of $10 trillion for about 8,900 institutions. Together, the three funds—the Bank Insurance Fund, the Savings Association Insurance Fund, and the FSLIC Resolution Fund—have about $52 billion in assets. FDIC had a budget of about $1.1 billion for calendar year 2004 to support its activities in managing the three funds. For that year, it processed more than 3.8 million financial transactions.

FDIC relies extensively on computerized systems to support its financial operations and store the sensitive information it collects. Its local and wide area networks interconnect these systems. To support its financial management functions, it relies on several financial systems to process and track financial transactions that include premiums paid by its member institutions and disbursements made to support operations. In addition, FDIC uses other systems that maintain personnel information for its employees, examination data for financial institutions, and legal information on closed institutions. At the time of our review, about 6,200 individuals were authorized to use FDIC’s systems. The corporation’s key official for computer security is the Chief Information Officer, who is responsible for establishing, implementing, and overseeing a corporatewide information security program.

Information system controls are a critical consideration for any organization that depends on computerized systems and networks to carry out its mission or business. Without proper safeguards, there is risk that individuals and groups with malicious intent may intrude into inadequately protected systems and use this access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks.

We have reported information security as a governmentwide high-risk area since February 1997. Our previous reports, and those of agency inspectors general, describe persistent information security weaknesses that place a variety of federal operations, including those at FDIC, at risk of disruption, fraud, and inappropriate disclosure.

Congress and the executive branch have taken action to address the risks associated with persistent information security weaknesses. In December 2002, the Federal Information Security Management Act (FISMA) of 2002, which is intended to strengthen information security, was enacted as Title III of the E-Government Act of 2002. In addition, the administration undertook important actions to improve security, such as integrating information security into the President’s Management Agenda Scorecard. Moreover, the Office of Management and Budget and the National Institute of Standards and Technology (NIST) have issued information security guidance to agencies.

Objectives, Scope, and Methodology

The objectives of our review were to assess (1) the progress FDIC had made in correcting or mitigating weaknesses reported in connection with our financial statement audits for calendar years 2002 and 2003 and (2) the effectiveness of the corporation’s information system controls. Our evaluation was based on (1) our Federal Information System Controls Audit Manual (FISCAM), which contains guidance for reviewing information system controls that affect the integrity, confidentiality, and availability of computerized data and (2) our May 1998 report on security management best practices at leading organizations, which identifies key elements of an effective information security program.

Specifically, we evaluated information system controls intended to prevent, limit, and detect electronic access to computer resources (data, programs, and systems), thereby protecting these resources against unauthorized disclosure, modification, and use; provide physical protection of computer facilities and resources from espionage, sabotage, damage, and theft; ensure that work responsibilities for computer functions are segregated so that no one individual controls all key aspects of a computer-related operation and thereby has the ability to conduct unauthorized actions or gain unauthorized access to assets or records without detection by another individual performing assigned responsibilities; prevent the implementation of unauthorized changes to application or ensure recovery of computer process operations and data in case of disaster or other unexpected interruption; and ensure an adequate information security program.

To evaluate these controls, we identified and reviewed pertinent FDIC security policies and procedures, guidance, plans, and reports. We also discussed whether information system controls were in place, adequately designed, and operating effectively with key security representatives, system administrators, and management officials. In addition, we conducted tests and observations of controls in operation and reviewed corrective actions taken by the corporation to address vulnerabilities identified in our audits for calendar years 2002 and 2003.

FDIC Has Made Significant Progress in Correcting Weaknesses and Implementing Controls

FDIC has made significant progress in correcting previously reported information system control weaknesses. Of the 22 weaknesses reported in our 2003 audit, FDIC corrected 19 and is taking action to resolve the 3 that remain. In addition, the corporation corrected the one weakness still open from our 2002 audit. FDIC’s actions included resolving weaknesses related to its key access controls, network security, and monitoring capabilities. For example, the corporation restricted user access to critical financial and sensitive data and strengthened security configurations of network devices, including firewalls, routers, switches, and servers; and enhanced its monitoring of security-relevant events by fully implementing its intrusion detection system to monitor its computer network traffic for unusual or suspicious access activities.

In addition to addressing previously reported weaknesses, FDIC took other steps to improve information security. For example, the corporation strengthened its oversight of contractor connections to its network by requiring contractors to develop security plans to protect these connections and to perform periodic inspections of contractor facilities to ensure security effectiveness. Further, FDIC established certification and accreditation guidelines that outline requirements for performing this process as part of each system’s life cycle and certified and accredited each of its key systems. In addition, the corporation updated its disaster recovery procedures and has been routinely performing different types of tests of its disaster recovery plan.

Weaknesses in Information System Controls

Although FDIC made substantial improvements in its information system controls, we identified 20 additional weaknesses that diminish its ability to effectively protect the integrity, confidentiality, and availability of its financial and sensitive information and information systems. Specifically, we identified weaknesses in electronic access controls, network security, physical security, segregation of computer functions, and application change controls. Although these information system control weaknesses do not pose significant risks to FDIC’s financial and sensitive systems, they warrant management’s action to decrease the risk of unauthorized modification of data and programs, inappropriate disclosure of sensitive information, or disruption of critical operations.

Electronic Access Controls

A basic management control objective for any organization is the protection of its information systems and critical data from unauthorized access. Organizations accomplish this objective by granting employees the authority to read, create, or modify only those programs and data that they need to perform their duties. Effective electronic access controls should be designed to restrict access to computer programs and data and detect unauthorized access. These controls include assigning user access rights and permissions and reviewing audit logs to ensure that access privileges are used appropriately.

Although FDIC restricted access to programs and information, we found instances in which access was not sufficiently controlled. For example, about 250 users were inadvertently granted access to read, create, or modify critical production programs and data for financial, payroll/personnel, and bank regulatory systems. The risk of weakening security access was further heightened because the access activities of these users were not being logged for review. In addition, emergency access accounts with broad system access to all critical system and security resources intended to be used solely to manage problems or emergencies that interrupt the system’s 24-hour-a-day operation were routinely used by four system and operations staff. Further, FDIC did not configure security software to appropriately restrict, log, and monitor access to certain sensitive system software libraries. As a result, increased risk exists that individuals could circumvent security controls to read, create, or modify critical or sensitive programs and data, possibly without detection.

In response to these weaknesses, FDIC’s Chief Information Officer said that they have taken steps to restrict access to critical financial data and program and related sensitive information. Further, the corporation stated that it has restricted access to sensitive system software libraries and plans to generate monthly audit reports for review and follow-up action as needed.

Network Security

Networks are a series of interconnected devices and software that allow individuals to share data and computer programs. Because sensitive programs and data are stored on network servers or transmitted along networks, effectively securing networks is essential to protecting computing resources and data from unauthorized access, manipulation, and use. Organizations secure their networks, in part, by installing and configuring network devices that permit authorized network service requests and deny unauthorized requests and by limiting the services that are available on the network. Network devices include (1) firewalls designed to prevent unauthorized access to and from the network, (2) routers that filter and forward data along the network, (3) switches that forward information among parts of a network, and (4) servers that host applications and data. Network services consist of protocols for transmitting data between network devices. In addition, effective network controls, such as passwords, should be established to authenticate authorized users who access the network from local and remote locations. Since networks often provide the entry point for access to electronic information assets, failure to secure them increases the risk of unauthorized use of sensitive data and systems.

Although FDIC’s network controls were generally effective, we identified instances where FDIC did not adequately secure specific network services and devices or protect passwords. For example, database server configurations for some of the corporation’s financial applications were not adequately secured. These servers had insecure settings that could have allowed an unauthorized user to gain access without providing authentication. In addition, FDIC did not have controls in place to consistently ensure that data transmitted between network devices were secure. Further, the passwords of local network administrators who had broad system access privileges were not adequately secured. As a result, increased risk exists that a malicious user could gain unauthorized access to some of FDIC’s sensitive network systems, read and modify sensitive system data, and disrupt or deny computer processing services to corporation employees.

In response to these weaknesses, FDIC’s Chief Information Officer said that the corporation had taken steps to improve network security including strengthening server settings, data transmission, and administrator passwords.

Physical Security

Physical security controls are important for protecting computer facilities and resources from espionage, sabotage, damage, and theft. These controls involve restricting physical access to computer resources, usually by limiting access to the buildings and rooms in which the resources are housed and by periodically reviewing access rights granted to ensure that access continues to be appropriate based on criteria established for granting it. At FDIC, physical access control measures (such as guards, badges, and locks, used either alone or in combination) are vital to protecting computing resources and the sensitive data it processes from external and internal threats.

Although FDIC had taken numerous actions to strengthen its physical security over its computing environment, certain weaknesses reduced its effectiveness in protecting and controlling physical access to sensitive work areas. For example, 4 employees and contractors had access to the computer data center even though they had changed their job responsibilities and no longer required this access. As a result, there is an increased risk that unauthorized individuals could gain access to sensitive computing resources and data and inadvertently or deliberately misuse or destroy them.

In response, FDIC’s management plans to update procedures to ensure that physical access to the data center is limited to authorized individuals.

Segregation of Computer Functions

Segregation of computer functions refers to the policies, procedures, and organizational structure that helps ensure that one individual cannot independently control all key aspects of a process or computer-related operation and, thereby, gain unauthorized access to assets or records. Often segregation of computer functions is achieved by dividing responsibilities among two or more organizational groups. Dividing duties among two or more individuals or groups diminishes the likelihood that errors and wrongful acts will go undetected because the activities of one individual or group will serve as a check on the activities of the others. Inadequate segregation of computer functions increases the risk that erroneous or fraudulent transactions could be processed, improper program changes implemented, and computer resources damaged or destroyed.

Although computer responsibilities were generally properly segregated at FDIC, we identified one instance in which responsibilities were not adequately segregated: system administrators were also serving as database administrators for systems that maintained FDIC’s key financial information. The risk associated with this weakness was further heightened because these administrators could take full control over the financial applications and databases that include audit and reconciliation data. Consequently, there is an increased risk that these individuals could perform unauthorized system activities without being detected.

In response to this weakness, FDIC’s Chief Information Officer said that the corporation plans to segregate the duties of system and database administrator functions.

Application Change Controls

It is important to ensure that only authorized and fully tested application programs are placed in operation. To ensure that changes to application programs are needed, work as intended, and do not result in the loss of data or program integrity, such changes should be authorized, tested, and independently reviewed.

Although FDIC had application change control procedures for its general ledger and accounts payable mainframe applications, it did not have procedures for documenting tests performed or independent reviews made for changes made to other key mainframe and client/server financial applications. In addition, the corporation did not have a process for authorizing changes to Web-based financial applications. Without adequate application change control procedures, changes may be implemented that are not authorized, tested, or independently reviewed.

In response, FDIC’s Chief Information Officer plans to establish procedures for documenting tests performed and independent reviews made for application software changes made to all mainframe and client/server application software. In addition, the corporation plans to establish a process for authorizing changes to Web-based financial applications.

FDIC Has Made Substantial Progress Implementing Information Security Program but Has Not Completed Key Element

A key reason for FDIC’s weaknesses in information system controls is that it had not fully implemented a complete test and evaluation process, which is a key element of a comprehensive agency information security program. Our May 1998 study of security management best practices determined that a comprehensive information security program is essential to ensuring that information system controls work effectively on a continuing basis. Also, FISMA, consistent with our study, requires an agency’s information security program to include certain key elements. These elements include a central information security management structure to provide overall security policy and guidance along with oversight to ensure compliance with established policies and reviews of the effectiveness of the information security environment; periodic assessments of the risk and magnitude of the harm that could result from unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems; policies and procedures that (1) are based on risk assessments, (2) cost effectively reduce risks, (3) ensure that information security is addressed throughout the life cycle of each system, and (4) ensure compliance with applicable requirements; security awareness training to inform personnel, including contractors and other users of information systems, of information security risks and their responsibilities in complying with agency policies and procedures; and a process of tests and evaluations of the effectiveness of information security policies, procedures, and practices relating to management, operational, and technical controls of every major information system identified in the agency’s inventories.

FDIC has made substantial progress in establishing a comprehensive information security program. The corporation strengthened its central information security management structure by providing additional staff resources to oversee the program. Further, the corporation initiated a program to routinely perform risk assessments on all major systems. In addition, FDIC updated its overall security policies covering network security, computer center access, and security management and it developed security plans for all key systems. Also, the corporation continued to enhance its security awareness program by adding specialized training for selected technical staff.

Although FDIC enhanced its process to test and evaluate its information system controls, it did not ensure that all key control areas supporting the corporation’s financial environment were routinely reviewed and tested. These areas included electronic access controls, network security, and audit logging. During the past year, FDIC strengthened its test and evaluation process to cover additional key information system control areas, provide for independent tests of corrective actions, and assess and test newly-identified weaknesses and emerging security threats. Although FDIC established a process to test and evaluate network and mainframe information system controls, its program did not include routine evaluations of network desktop and database application controls. Further, the process did not include comprehensive tests to ensure that electronic access to key financial programs and data (1) were restricted to only those users who need it to perform their job functions and (2) had appropriate audit logs maintained to record security-relevant events for subsequent review. Without routine tests and evaluations of all key information system control areas, FDIC will have limited assurance that its financial and sensitive information is adequately protected.

Incorporating these key areas into its test and evaluation process should allow FDIC to better identify and correct security problems, such as those identified in our 2004 audit. Further, the corporation’s implementation of new financial systems in the coming year will significantly change the nature of its information systems environment and of the related information systems controls necessary for their effective operation. Consequently, a comprehensive test and evaluation process that includes these areas will be essential to ensure that the corporation’s financial and sensitive information will be adequately protected in this new environment.

In response, FDIC’s Chief Information Officer said that the corporation will continue to take steps to enhance its overall test and evaluation process to ensure an effective security environment.

Conclusions

FDIC has made significant progress in correcting the information system control weaknesses we previously identified and has taken other steps to improve information security. Although we identified weaknesses in information system controls involving electronic access, network security, segregation of computer functions, physical security, and application change control, these weaknesses do not pose significant risks to FDIC’s financial and sensitive systems. Accordingly, we concluded that weaknesses in information system controls at the corporation no longer constitute a reportable condition, as stated in our audit of the calendar year 2004 financial statements for FDIC’s three funds. However, they warrant action by the FDIC management to decrease the risk of unauthorized modification of data and programs, inappropriate disclosure of sensitive information, or disruption of critical operations.

A key reason for FDIC’s weaknesses in information system controls is that it had not fully implemented a complete test and evaluation process, which is a key element of a comprehensive agency information security program. Although the corporation has made substantial progress in implementing its information security program and enhanced its process to test and evaluate its information system controls, it did not ensure that all key control areas supporting its financial environment were routinely reviewed and tested. These areas included electronic access controls, network security, and audit logging. Until FDIC fully implements a comprehensive test and evaluation process, its ability to maintain adequate information system controls over its financial and sensitive information will be limited. This will be especially crucial as the corporation implements new financial systems in the coming year.

Recommendation for Executive Action

To strengthen FDIC’s information security program, we recommend that the Chairman direct the Chief Information Officer to broaden its process of tests and evaluations to ensure that all key control areas supporting FDIC’s financial environment are routinely reviewed and tested. This process should include routine tests and evaluations of key control areas such as electronic access, network security, and audit logging.

We are also making recommendations in a separate report designated for “Limited Official Use Only.” These recommendations address actions needed to correct specific information security weaknesses related to electronic access, network security, physical security, segregation of computer functions, and application change controls.

Agency Comments

In providing written comments on a draft of this report, FDIC’s Chief Financial Officer (CFO) agreed with our recommendations. His comments are reprinted in appendix I of this report. Specifically, FDIC plans to correct all weaknesses identified and broaden the testing and evaluation element of its computer management program by February 28, 2006. According to the CFO, significant progress has already been made in addressing the identified weaknesses.

We are sending copies of this report to the Chairman and Ranking Minority Member of the Senate Committee on Banking, Housing, and Urban Affairs; the Chairman and Ranking Minority Member of the House Committee on Financial Services; members of the FDIC Audit Committee; officials in FDIC’s divisions of information resources management, administration, and finance; and the FDIC inspector general. We also will make copies available to others upon request. In addition, this report will be available at no charge on the GAO Web site at http://www.gao.gov.

If you have any questions regarding this report, please contact me at (202) 512-6244 or David W. Irvin, Assistant Director, at (214) 777-5716. We can also be reached by e-mail at wilshuseng@gao.gov and irvind@gao.gov, respectively. Key contributors to this report are listed in appendix II.

Comments from the Federal Deposit Insurance Corporation

GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the individual named above, Edward Alexander Jr., Gerald Barnes, Jason Carroll, Lon Chin, Debra Conner, Anh Dang, Kristi Dorsey, Edward Glagola Jr., Nancy Glover, Rosanna Guerrero, David Hayes, Harold Lewis, Leena Mathew, Kevin Metcalfe, Duc Ngo, Eugene Stevens, Charles Vrabel, and Christopher Warweg made key contributions to this report.