Information Security: Federal Deposit Insurance Corporation Has Made Progress, but Further Actions Are Needed to Protect Financial Data
Released: 2011-08-12T00:00:00

Letter

Background

Information security is a critical consideration for any organization that depends on information systems and computer networks to carry out its mission and is especially important for a government corporation such as FDIC, which has responsibilities to oversee the financial institutions that are entrusted with safeguarding the public’s money. While the use of interconnected electronic information systems allows the corporation to accomplish its mission more quickly and effectively, their use also exposes FDIC’s information to various internal and external threats.

Cyber-based threats to information systems and cyber-related critical infrastructure can come from sources internal and external to the organization. Internal threats include errors as well as fraudulent or malevolent acts by employees or contractors working within an organization. External threats include the ever-growing number of cyber- based attacks that can come from a variety of sources such as hackers, criminals, and foreign nations.

Potential attackers have a variety of techniques at their disposal, which can vastly enhance the reach and impact of their actions. For example, cyber attackers do not need to be physically close to their targets, their attacks can easily cross state and national borders, and cyber attackers can preserve their anonymity. Further, the interconnectivity among information systems presents increasing opportunities for such attacks. Indeed, reports of security incidents from federal agencies are on the rise, increasing by more than 650 percent from fiscal year 2006 to fiscal year 2010. Specifically, the number of incidents reported by federal agencies to the United States Computer Emergency Readiness Team (US-CERT) has increased dramatically over the past 4 years: from 5,503 incidents reported in fiscal year 2006 to about 41,776 incidents in fiscal year 2010.

Compounding the growing number and kinds of threats are the deficiencies in security controls on the information systems at federal agencies, which have resulted in vulnerabilities in both financial and nonfinancial systems and information. These deficiencies continue to place assets at risk of inadvertent or deliberate misuse, financial information at risk of unauthorized modification or destruction, and critical operations at risk of disruption.

Accordingly, we have designated information security as a governmentwide high risk area since 1997, a designation that remains in force today. The Federal Information Security Management Act (FISMA) requires each agency to develop, document, and implement an agencywide information security program to provide information security for the information and systems that support the operations and assets of the entities, using a risk-based approach to information security management.

FDIC Is a Key Protector of Bank and Thrift Deposits

FDIC was created by Congress to maintain the stability of and public confidence in the nation’s financial system by insuring deposits, examining and supervising financial institutions, and resolving troubled institutions. Congress created FDIC in 1933 in response to the thousands of bank failures that had occurred throughout the late 1920s and early 1930s. FDIC identifies, monitors, and addresses risks to the Deposit Insurance Fund when a bank or thrift institution fails.

The Bank Insurance Fund and the Savings Association Insurance Fund were established as FDIC responsibilities under the Financial Institutions Reform, Recovery, and Enforcement Act of 1989, which sought to reform, recapitalize, and consolidate the federal deposit insurance system. The act also designated FDIC as the administrator of the Federal Savings & Loan Insurance Corporation Resolution Fund, which was created to complete the affairs of the former Federal Savings & Loan Insurance Corporation and liquidate the assets and liabilities transferred from the former Resolution Trust Corporation. The Bank Insurance Fund and the Savings Association Insurance Fund merged into the Deposit Insurance Fund on February 8, 2006, as a result of the passage of the Federal Deposit Insurance Reform Act of 2005.

FDIC Relies on Computer Systems to Support Its Mission and Financial Reporting

FDIC relies extensively on computerized systems to support its mission, including financial operations, and to store the sensitive information that it collects. The corporation uses local and wide area networks to interconnect its systems and a layered approach to security defense.

To support its financial management functions, FDIC relies on many systems, including a corporatewide system that functions as a unified set of financial and payroll systems that are managed and operated in an integrated fashion, a system to calculate and collect FDIC deposit insurance premiums and Financing Corporation bond principal and interest amounts from insured financial institutions; a Web-based application that provides full functionality to support franchise marketing, asset marketing, and asset management; a system to request access to and receive permission for the computer applications and resources available to its employees, contractors, and other authorized personnel; and a primary receivership and subsidiary financial processing and reporting system.

FDIC also relies on other computerized systems in deriving its estimates of losses from loss-sharing agreements. This complex estimation process was developed and implemented in order to manage the significant number of loss-sharing agreements that have been created as a result of the current financial crisis. The process uses databases containing information on loss-sharing agreements and asset valuations, software programs that use information from the databases and other sources to calculate the estimated losses, data and programs stored in FDIC’s document sharing system, a Web service used to exchange valuation information with outside contractors, and several manual processing steps. In addition, in order to reduce the risk that a material misstatement will not be detected, FDIC relies heavily on supervisory review and oversight controls in the process. We have previously reported that this process is complex, is not fully documented, and involves multiple manual data entries. In a separate report, we have made an additional recommendation to FDIC to improve the documentation around this process.

Under FISMA, the Chairman of FDIC is responsible for, among other things, (1) providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the entity’s information systems and information; (2) ensuring that senior agency officials provide information security for the information and information systems that support the operations and assets under their control; and (3) delegating to the corporation’s Chief Information Officer the authority to ensure compliance with the requirements imposed on the agency under FISMA.

The Chief Information Officer is responsible for developing and maintaining a corporatewide information security program and for developing and maintaining information security policies, procedures, and control techniques that address all applicable requirements. The Chief Information Officer also serves as the authorizing official with the authority to approve the operation of the information systems at an acceptable level of risk to the corporation.

The Chief Information Security Officer reports to the Chief Information Officer and serves as the Chief Information Officer’s designated representative. The Chief Information Security Officer is responsible for the overall support of assessment and authorization activities; for the development, coordination, and implementation of FDIC’s security policy; and for the coordination of information security and privacy efforts across the corporation.

Opportunities Exist for FDIC to Improve Information Security Controls

Although FDIC had implemented numerous controls over its systems, it had not always implemented access and other controls to protect the confidentiality, integrity, and availability of its financial systems and information. A key reason for these weaknesses is that the corporation did not always fully implement key information security program activities, such as effectively developing and implementing security policies. Although these weaknesses did not individually or collectively constitute a material weakness or significant deficiency in 2010, they still increase the risk that financial and other sensitive information could be disclosed or modified without authorization.

FDIC Had Not Always Restricted Access to Information Resources

A basic management objective for any organization is to protect the resources that support its critical operations and assets from unauthorized access. Organizations accomplish this by designing and implementing controls that are intended to prevent, limit, and detect unauthorized access to computer resources (e.g., data, programs, equipment, and facilities), thereby protecting them from unauthorized disclosure, modification, and loss. Specific access controls include system boundary protections, identification and authentication of users, authorization restrictions, cryptography, protection of sensitive system resources, and audit and monitoring procedures. Without adequate access controls, unauthorized individuals, including intruders and former employees, can surreptitiously read and copy sensitive data and make undetected changes or deletions for malicious purposes or for personal gain. In addition, authorized users could intentionally or unintentionally modify or delete data or execute changes that are outside of their authority.

Boundary protection controls logical connectivity into and out of networks and controls connectivity to and from network-connected devices. Any connections to the Internet or to other external and internal networks or information systems should occur through controlled interfaces (for example, proxies, gateways, routers and switches, firewalls, and concentrators). Many networked systems allow remote access to the information systems from virtually any remote location; thus, it is imperative that remote access paths be appropriately controlled and protected using a method such as a virtual private network (VPN). In addition, networks should also be appropriately configured to adequately protect access paths between systems; this can be accomplished through the use of access control lists and firewalls. National Institute of Standards and Technology (NIST) guidance states that agencies should establish trusted communication paths between users and the agency’s information systems, that firewalls should be configured to provide adequate protection for the organization’s networks, and that the information transmitted between interconnected systems should be controlled and regulated.

FDIC had not always controlled the logical and physical boundaries protecting its information and systems. Examples are as follows:  Certain network devices, servers, and workstations on FDIC’s internal network were not always configured to sufficiently restrict access or to fully secure connections.  Firewalls controlling traffic between segments of FDIC’s internal network did not sufficiently control certain types of network traffic.  Boundary protection controls were configured in a manner that limited the effectiveness of monitoring controls.

As a result of these deficiencies, FDIC faces an increased risk that individuals could gain unauthorized access to its financial systems and information.

A computer system must be able to identify and authenticate the identity of a user so that activities on the system can be linked to that specific individual and to protect the system from inadvertent or malicious access. When an organization assigns a unique user account to a specific user, the system is able to distinguish that user from others—a process called identification. The system must also establish the validity of the user’s claimed identity by requesting some kind of information, such as a password, which is known only by the user—a process called authentication. NIST guidance states that an organization should manage information system authenticators by changing the default content of authenticators (e.g., passwords) when installing an information system. Also, FDIC policy states that passwords should be changed periodically.

FDIC had effectively implemented controls for identifying and authenticating users on certain systems. For example, it had implemented controls to effectively detect and change default vendor-supplied user accounts and passwords in installed software and had ensured that passwords for privileged accounts on certain servers were changed in accordance with its policy.

However, FDIC had not consistently enforced other identification and authentication user controls. Examples are as follows:  Passwords for certain privileged accounts on a system supporting financial processing were not configured in accordance with FDIC policy. Additionally, two of the accounts were using the same password.  Password settings for certain accounts on a system supporting the loss-share loss estimation process were not configured in accordance with FDIC policy.  Systems supporting financial processing were not always configured with sufficiently strong identification and authentication controls.

As a result of these deficiencies, FDIC is at an increased risk that an individual with malicious intentions could gain inappropriate access to its financial systems and information.

Authorization is the process of granting or denying access rights and privileges to a protected resource, such as a network, system, application, function, or file. A key component of granting or denying access rights is the concept of “least privilege,” which refers to granting a user only the access rights and permissions needed to perform official duties. To restrict a legitimate user’s access to only those programs and files needed, organizations establish user access rights: allowable actions that can be assigned to a user or to groups of users. File and directory permissions are rules that are associated with a particular file or directory, regulating which users can access it—and the extent of their access rights. To avoid unintentionally giving a user unnecessary access to sensitive files and directories, an organization should give careful consideration to its assignment of rights and permissions. NIST guidance states that access to information systems should be allowed only for authorized users and only for the tasks necessary to accomplish the work, in accordance with the organization’s missions and business functions. In addition, NIST guidance states that agency information systems should separate user functionality from functions necessary to administer databases, network components, workstations, or servers. FDIC policy requires that the access to information technology (IT) resources be periodically reviewed to ensure that access controls remain consistent with existing authorizations and current business needs. Also, the Division of Resolutions and Receiverships requires user access to the document sharing system supporting the loss-share estimation process to be reviewed every 3 months.

FDIC had implemented controls to restrict user access to certain resources. For example, it had configured access control lists on servers dedicated to network management to restrict access to only those users who required it, controlled access to sensitive files of critical network devices, and limited user access rights to a business application supporting resolution and receivership activities to only those roles necessary for personnel to perform their duties.

However, other deficiencies in authorization controls placed FDIC’s financial information and systems at risk. Examples are as follows:  The Division of Resolutions and Receiverships had not documented a procedure describing how access to the Web service used in the loss- share loss estimation process was to be reviewed, including requirements for conducting reviews at regular intervals or retaining documentation of reviews.  The Division of Resolutions and Receiverships had not reviewed access to the document sharing system every 3 months in accordance with its policy; instead, it had conducted a review only once during 2010.  FDIC had given users access to sensitive resources on certain systems supporting financial processing that they did not need to accomplish their work.

As a result, FDIC faces an increased risk that a user could gain inappropriate access to computer resources, circumvent security controls, and deliberately or inadvertently read, modify, or delete financial information and other sensitive information.

Cryptography underlies many of the mechanisms used to enforce the confidentiality and integrity of sensitive information. A basic element of cryptography is encryption. Encryption can be used to provide basic data confidentiality and integrity by transforming plain text into cipher text using a special value known as a key and a mathematical process known as an algorithm. If encryption is not used, user identification (ID) and password combinations will be susceptible to electronic eavesdropping by devices on the network when they are transmitted. The National Security Agency and NIST recommend encrypting network services, and NIST guidance states that passwords should be encrypted while being stored and transmitted. NIST guidance also states that the use of encryption by organizations can reduce the probability of unauthorized disclosure of information and that government systems should use sufficiently strong encryption in order to establish and maintain secure communication links between information systems and applications.

FDIC had implemented controls to encrypt certain sensitive information on its systems. For example, it had restricted the use of unencrypted protocols on the mainframe and had required that sensitive information stored on user workstations or mobile devices be encrypted.

However, FDIC had not always ensured that sensitive financial information transmitted over and stored on its network was adequately encrypted. Specifically, FDIC had not always used sufficiently strong encryption on two systems supporting the loss-share loss estimation process and had not always strongly encrypted stored passwords on certain financial systems. As a result of these deficiencies, FDIC is at an increased risk that an individual could capture information such as user IDs and passwords and use them to gain unauthorized access to data and system resources.

To establish individual accountability, monitor compliance with security policies, and investigate security violations, the capability to determine what, when, and by whom specific actions have been taken on a system is needed. Organizations accomplish this by implementing system or security software that provides an audit trail for determining the source of a transaction or attempted transaction and by monitoring user activity. To be effective, organizations should (1) configure the software to collect and maintain a sufficient audit trail for security-relevant events; (2) generate reports that selectively identify unauthorized, unusual, and sensitive access activity; and (3) regularly monitor and take action on these reports. NIST guidance states that organizations should track and monitor access by individuals who use elevated access privileges, review and analyze information system audit records for indications of inappropriate or unusual activity, and report the findings to designated organization officials.

FDIC had ensured that default installation user accounts were no longer used on certain servers and had configured its mainframe logging controls efficiently. However, FDIC’s audit and monitoring of security- relevant events on key financial systems was not always sufficient. For example, FDIC had not always sufficiently configured logging controls on a system that supported the loss-share loss estimation process or on several network devices. As a result of these deficiencies, FDIC faces an increased risk that unauthorized activity or a policy violation on its systems and networks would not be detected.

Other Information System Controls Can Be Improved

In addition to access controls, organizations should use policies, procedures, and techniques for securely segregating incompatible duties, configuring information systems, and ensuring continuity of computer processing operations in the event of a disaster or unexpected interruption to ensure the confidentiality, integrity, and availability of its information. However, FDIC’s systems were not always in full compliance with these policies, procedures, and techniques, leaving them vulnerable to intrusions.

Segregation of duties refers to the policies, procedures, and organizational structure that help ensure that one individual cannot independently control all key aspects of a process or computer-related operation and thereby gain unauthorized access to assets or records. Often, segregation of incompatible duties is achieved by dividing responsibilities among two or more organizational groups, which diminishes the likelihood that errors and wrongful acts will go undetected because the activities of one individual or group will serve as a check on the activities of the other. Inadequate segregation of duties increases the risk that erroneous or fraudulent transactions could be processed, improper program changes implemented, and computer resources damaged or destroyed. According to NIST, in order to maintain separation of duties, personnel who administer access control functions should not also be responsible for administering audit functions.

FDIC’s Division of Resolutions and Receiverships had not always separated audit responsibilities from administration of access to loss- share and asset valuation data and programs. Specifically, the FDIC access administrators for both the external Web service and the document sharing system used in the loss-share loss estimation process were also responsible for approving and reviewing user access to the systems. As a result, the access administrators had the ability to grant inappropriate levels of access to loss-share and asset valuation data and programs without being detected, placing the data and programs at risk of unauthorized access, misuse, modification, or destruction.

Configuration management is another important control that involves the identification and management of security features for all hardware and software components of an information system at a given point and systematically controls changes to that configuration during the system’s life cycle. An effective configuration management process includes procedures for (1) identifying, documenting, and assigning unique identifiers (for example, serial number and name) to a system’s hardware and software parts and subparts, generally referred to as configuration items; (2) evaluating and deciding whether to approve changes to a system’s baseline configuration; (3) documenting and reporting on the status of configuration items as a system evolves; (4) determining alignment between the actual system and the documentation describing it; and (5) developing and implementing a configuration management plan for each system. In addition, establishing controls over the modification of information system components and related documentation helps to prevent unauthorized changes and ensure that only authorized systems and related program modifications are implemented. This is accomplished by instituting policies, procedures, and techniques that help make sure all hardware, software, and firmware programs and program modifications are properly authorized, tested, and approved.

According to NIST, organizations should document approved configuration-controlled changes to information systems, retain and review records of the changes, audit activities associated with the changes, and coordinate and provide oversight for configuration change control activities through a mechanism such as a change control board. NIST also recommends that agencies configure their systems to reflect the most restrictive mode possible consistent with operational requirements and employ malicious code protection mechanisms to detect and eradicate malicious code transported by electronic mail, electronic mail attachments, or other common means.

FDIC had not applied appropriate configuration management controls to many of the special purpose programs and data in the loss-share estimating process. Although FDIC had documented activities for development, testing, and production for three of the programs used to calculate the estimates of losses due to loss-sharing agreements and had assigned responsibility for the different activities, it had neither documented approved changes to the programs prior to implementation nor retained records of the changes made. While the corporation had documented plans for tracking changes to these three programs, the plans had not been implemented. Additionally, the corporation had not documented plans for controlling changes to a program that generated a key dataset or to two other programs used to validate the data contained in a key database used in the loss-share loss estimation process. Furthermore, FDIC had not applied version control or change control to the database for the loss-share cost estimates. Moreover, a workstation used to execute one of the key calculation programs had configuration weaknesses that could allow it to be compromised. Until FDIC fully implements configuration management and configuration change controls to these data and programs, increased risk exists that changes to the programs could be unnecessary, may not work as intended, or may result in the unintentional loss of data or program integrity, or that individuals, both internal and external to the corporation, could exploit configuration weaknesses and gain unauthorized access to financial or other sensitive data and systems.

Patch management is a critical process that can help alleviate many of the challenges in securing computing systems. Malicious acts can range from defacing a Web site to taking control of an entire system, thereby being able to read, modify, or delete sensitive information; disrupt operations; or launch attacks against other organizations’ systems. After a vulnerability has been validated, the software vendor may develop and test a patch or workaround to mitigate the vulnerability. Incident response groups and software vendors issue regular information updates on the vulnerability and the availability of patches. NIST guidance states that a comprehensive patch management process should include prioritization of the order in which vulnerabilities are addressed, with a focus on high- priority systems such as those essential for mission-critical operations.

FDIC had patched many of its systems and had ensured that much of its software was up-to-date. For example, it had retired critical network devices that were not supported by their manufacturers, updated patch levels for third-party software running on two UNIX servers, and removed an obsolete version of third-party software running on a Windows server.

However, FDIC had not consistently updated its financial systems and servers with critical patches or kept its software up-to-date, including systems supporting the loss-share loss estimation process. For example, certain servers supporting financial processing were running a version of software that was unsupported for patch updates, and several workstations used in the loss-share loss estimation process were missing patches and were running software that was no longer supported by the manufacturer. Additionally, certain workstations were missing operating system patches. As a result of these deficiencies, FDIC is at an increased risk that unpatched vulnerabilities could allow its information and information systems to be compromised.

Contingency planning, which includes developing contingency, business continuity, and disaster recovery plans, should be performed to ensure that when unexpected events occur, essential operations can continue without interruption or can be promptly resumed, and that sensitive data are protected. NIST guidance states that organizations should develop and implement contingency plans that describe activities associated with backing up and restoring the system after a disruption or failure. The plans should be updated and include information such as contact, resources, and description of files in order to restore the application in the event of a disaster. In addition, the plans should be tested to determine their effectiveness and the organization’s readiness to execute the plans. Officials should review the test results and initiate corrective actions. FDIC’s Information Technology Security Risk Management Program requires contingency plans and disaster recovery plans to be developed and tested for all sensitive applications (both major and nonmajor) and general support systems; the plans should address measures to be taken in response to a disruption in availability due to an unplanned outage.

Although FDIC had developed contingency plans for its major systems and had also conducted testing on these plans, it had not documented plans for recovering the automated and semiautomated processes supporting the loss-share loss estimation process. Although the security plan for one of FDIC’s general support systems included the document sharing system and one of the key databases supporting the process, the corporation had not documented or tested contingency plans that addressed restoring the computer programs, workstations, and datasets supporting the preparations of the estimates of losses and costs due to loss-sharing agreements or of the workspaces within the document sharing system where loss-share and asset valuation information and programs are stored. As a result, FDIC may not be able to effectively recover the data and programs in the loss-share loss estimation process and resume normal operations after a disruption.

FDIC Had Not Always Implemented Key Activities of its Information Security Program

An underlying reason for the information security weaknesses noted in the previous section is that, while FDIC has developed and documented a comprehensive corporate information security program, including documenting an information security risk management policy, developing security policies and procedures, documenting system security plans, and periodically testing information security controls, the corporation had not fully implemented its information security program. Specifically, it had not fully implemented its security policies and had not completed actions to remediate certain control weaknesses. In addition, FDIC had not applied security management controls to the programs and data in the loss-share loss estimation process.

An entitywide information security management program is the foundation of a security control structure and a reflection of senior management’s commitment to addressing security risks. The security management program should establish a framework and continuous cycle of activity for assessing risk, developing and implementing effective security procedures, and monitoring the effectiveness of these procedures. Without a well-designed program, security controls may be inadequate; responsibilities may be unclear, misunderstood, or improperly implemented; and controls may be inconsistently applied. FISMA requires each agency to develop, document, and implement an information security program that, among other things, includes  periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems;  policies and procedures that (1) are based on risk assessments, (2) cost effectively reduce information security risks to an acceptable level, (3) ensure that information security is addressed throughout the life cycle of each system, and (4) ensure compliance with applicable requirements;  plans for providing adequate information security for networks, facilities, and systems;  periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, to be performed with a frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems; and  a process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in its information security policies, procedures, or practices.

FDIC had developed and documented a comprehensive corporate information security program that was consistent with FISMA requirements and had implemented some elements of its program, but had not fully implemented other elements. Specifically:  FDIC had developed and documented an IT security risk management policy that required all sensitive applications to periodically be assessed for the risk and magnitude of harm that could result from vulnerabilities and potential threats.  FDIC had not fully implemented its policies requiring that users be provided with only the minimum level of access required to allow them to perform their duties and that its computer security information response team monitor the progress of security patching activities by reviewing reports on the status of implementation. In addition, it had not fully implemented its policies for frequency of password changes and for storage of passwords.  FDIC had developed and documented security plans for all of the major systems we reviewed that addressed policies and procedures for providing management, operational, and technical controls, and had documented requirements for physically securing FDIC facilities.  FDIC had conducted annual periodic testing and evaluation of the effectiveness of the management, operational, and technical controls for the major systems we reviewed.  Although FDIC had established a process for planning, implementing, evaluating, and documenting remedial actions to address information security weaknesses, and had completed actions to remediate 26 of the 33 control weaknesses we identified in our calendar year 2009 audit, the corporation had not yet completed actions to correct or mitigate 7 of the previously reported weaknesses. For example, FDIC had not separated or partitioned the data network from the voice network, developed and documented policies and procedures for assigning access to systems and databases where application controls could be compromised, or fully implemented its monitoring program.

In addition, FDIC had not received an independent audit report from the provider of its Web service in a timely manner. FISMA information security requirements apply not only to an agency’s own systems but also to information systems used or operated on its behalf by a contractor or other agency, such as an external service provider. According to OMB, service providers are required to provide client organizations with an audit report that describes whether internal controls were designed to achieve specified objectives, have been placed into operation, and are operating effectively. Previously known as Statement on Auditing Standards (SAS) 70 reports, since June 15, 2011, they have been known as Statement on Standards for Attestation Engagements (SSAE) 16 reports. OMB also states that such reports should be provided within a reasonable time frame so that auditors of client organizations may use them during their financial statement audits. However, the provider of the Web service used to exchange information with valuation contractors did not provide FDIC with a SAS 70 report until March 2011, more than 8 weeks after the end of the financial reporting period and more than 5 months after the end of the period that the SAS 70 audit covered.

Until all key elements of its information security program are fully implemented, FDIC may not have assurance that controls over its financial systems and information are appropriately designed and operating effectively.

FDIC had not applied key controls in its information security program to the loss-share loss estimation process. OMB Circular A-130, Appendix III, requires federal agencies to implement and maintain an automated information security program, including planning for adequate security of each system, assessing risks, and reviewing security controls. OMB Circular A-127 requires that federal financial management systems, which include core financial systems as well as any automated and manual processes, procedures, data, hardware, and software that support financial management, be subject to the requirements of Circular A-130. However, FDIC had not applied key controls in its information security program to the automated and semiautomated processes used to support the preparation of the estimates of losses and costs due to loss- sharing agreements. Specifically, FDIC had not  assessed the risks associated with the information and programs involved to identify potential threats and vulnerabilities as well as possible countermeasures and mitigating controls, and had not included the programs in the risk assessment of any of its general support systems;  documented the management, technical, or operational security controls intended to protect the programs in system security plans, and had not included the programs in the system security plans of any general support system; or tested any security controls for the programs, and had not included the programs when testing the security controls of other general support systems.

FDIC had not applied these controls because the Division of Resolutions and Receiverships developed the process independently, in order to be able to manage the large increase in bank failures and the extensive use of loss-sharing agreements resulting from the current financial crisis. In doing so, the Division of Resolutions and Receiverships had not used FDIC’s existing IT management framework—which requires these controls to be put into place—to develop and manage the process.

During 2010, FDIC had mitigated the effect of these weaknesses on financial reporting by implementing compensating management and reconciliation controls in this process. However, because of ongoing financial institution failures and the lack of information security management controls around the process, the financial information processed by the programs involved—representing a nearly $39 billion impact on the corporation’s financial statements—continues to be at risk of unauthorized disclosure, modification, or destruction.

Conclusions

FDIC has made significant progress in correcting or mitigating previously reported information security weaknesses, but other control weaknesses continue to unnecessarily put FDIC’s systems at an increased risk from internal and external threats. A key reason for these weaknesses is that the corporation had not fully implemented key elements of its information security program, such as effectively implementing security policies, conducting risk assessments, documenting security management plans, documenting contingency plans, testing security controls, or implementing an effective continuous monitoring program. FDIC had made improvements in its information security controls and had mitigated the potential effect of its remaining weaknesses on financial reporting by implementing compensating management and reconciliation controls during 2010, enabling us to conclude that FDIC had resolved the significant deficiency over information systems that we had reported in our 2009 audit. However, the weaknesses—both old and new—continue to challenge the corporation in its efforts to ensure the confidentiality, integrity, and availability of financial and sensitive information.

Until FDIC further mitigates known information security weaknesses in access controls and other information system controls and fully implements its information security program, the corporation will continue to face an increased risk that sensitive financial information and resources will not be sufficiently protected from inadvertent or deliberate misuse, improper disclosure, or destruction.

Recommendations for Executive Action

We recommend that the Acting Chairman take the following two actions to enhance FDIC’s information security program:  Direct the Director of the Division of Resolutions and Receiverships and the Chief Information Officer to develop, document, and implement appropriate information security activities in the loss-share loss estimation process, such as assessing and mitigating risks, managing and controlling the configurations of programs and databases, evaluating the effectiveness of security controls, and ensuring that data and programs can be recovered after a disruption.  Direct the Chief Information Officer to work with the external Web service provider to obtain a more timely delivery of the provider’s SSAE 16 report (previously known as a SAS 70 report), or to obtain other means of assurance of internal controls.

We are also making 38 new recommendations to address 37 new findings in a separate report with limited distribution. These recommendations consist of actions to implement and correct specific information security weaknesses related to access controls, segregation of duties, configuration management, and contingency planning identified during this audit.

Agency Comments and Our Evaluation

In providing written comments (reprinted in app. II) on a draft of this report, the Deputy to the Chairman and Chief Financial Officer of FDIC stated that FDIC was pleased to accept our acknowledgment of the significant progress made toward correcting and mitigating our previously reported weaknesses. In addition, he indicated that the corporation plans to implement improvements to address our recommendations, and discussed the actions that FDIC has taken or plans to take to review and improve controls over the loss-share loss estimation process, to obtain timely delivery of appropriate audit reports from current and future service providers, and to conduct additional due diligence activities to obtain assurance of the service provider’s internal controls.

In responding to our draft recommendation that FDIC develop, document, and implement appropriate information security controls over the automated and semiautomated processes within the loss-share loss estimation process, the Deputy to the Chairman stated that although FDIC agrees that the loss-share business processes and the data associated with these processes deserve proper controls assessment and protection, the corporation will not necessarily treat the processes and data as a separate FDIC system. The Deputy to the Chairman further stated that FDIC is currently taking steps to improve the information security controls around the process.

The intent of our draft recommendation was not to suggest that FDIC treat the data and programs supporting the loss-share loss estimation process as a separate information system. We agree that it may not be appropriate for FDIC to treat these data and programs as a separate information system, as they are stored, processed, and executed across multiple systems. Rather, our intent was to recommend that appropriate information security control activities be incorporated into the process. Accordingly, we have clarified our recommendation to state that the Acting Chairman direct the Director of the Division of Resolutions and Receiverships and the Chief Information Officer to develop, document, and implement appropriate information security activities in the loss-share loss estimation process, such as assessing and mitigating risks, managing and controlling the configurations of programs and databases, evaluating the effectiveness of security controls, and ensuring that data and programs can be recovered after a disruption.

We are sending copies of this report to the Chairman and Ranking Member of the Senate Committee on Banking, Housing, and Urban Affairs; Chairman and Ranking Member of the House Financial Services Committee; and other interested parties. In addition, this report will be available at no charge on the GAO Web site at http://www.gao.gov.

If you have any questions regarding this report, please contact Gregory C. Wilshusen at (202) 512-6244 or Dr. Nabajyoti Barkakati at (202) 512- 4499. We can also be reached by e-mail at wilshuseng@gao.gov and barkakatin@gao.gov. Key contributors to this report are listed in appendix III.

Appendix I: Objective, Scope, and Methodology

The objective of our audit was to determine the effectiveness of the Federal Deposit Insurance Corporation’s (FDIC) controls protecting the confidentiality, integrity, and availability of its financial systems and information. To do this, we examined FDIC information security policies, plans, and procedures; tested controls over key financial applications; and interviewed key agency officials in order to (1) assess the effectiveness of corrective actions taken by FDIC to address weaknesses we previously reported and (2) determine whether any additional weaknesses existed. This work was performed in support of our opinion on internal control over the preparation of the calendar year 2010 and 2009 financial statements of two funds administered by FDIC.

To determine whether controls over key financial systems were effective, we considered the results of our evaluation of FDIC’s actions to mitigate previously reported weaknesses and performed new audit work at FDIC facilities in Arlington, Virginia, and Washington, D.C. We concentrated our evaluation primarily on the controls for financial applications and enterprise database applications associated with the New Financial Environment; the Assessment Information Management System; the Communication, Capability, Challenge, and Control System (4C) application; the programs, data, and systems supporting the preparation of the estimates of losses and costs due to loss-sharing agreements, and the general support systems. Our selection of the systems to evaluate was based on consideration of systems that directly or indirectly support the processing of material transactions that are reflected in the funds’ financial statements.

Our evaluation was based on GAO’s Federal Information System Controls Audit Manual, which contains guidance for reviewing information system controls that affect the confidentiality, integrity, and availability of computerized information.

Using National Institute of Standards and Technology (NIST) standards and guidance and FDIC’s policies, procedures, practices, and standards, we evaluated controls by  observing methods for providing secure data transmissions across the network to determine whether sensitive data were being encrypted; testing and observing physical access controls to determine if computer facilities and resources were being protected from espionage, sabotage, damage, and theft;  evaluating the control configurations of selected servers and database inspecting key servers and workstations to determine whether critical patches had been installed or were up-to-date; and  examining access responsibilities to determine whether incompatible functions were segregated among different individuals.

Using the requirements of the Federal Information Security Management Act (FISMA), which establishes key elements for an effective agencywide information security program, we evaluated FDIC’s implementation of its security program by reviewing FDIC’s risk assessment process and risk assessments for key FDIC systems that support the preparation of financial statements to determine whether risks and threats were documented consistent with federal guidance;  analyzing FDIC’s policies, procedures, practices, and standards to determine their effectiveness in providing guidance to personnel responsible for securing information and information systems;  analyzing security plans to determine if management, operational, and technical controls were in place or planned and that security plans were updated;  analyzing security testing and evaluation results for six key FDIC systems to determine whether management, operational, and technical controls were tested at least annually and based on risk; and  examining remedial action plans to determine whether they addressed vulnerabilities identified in FDIC’s security testing and evaluations.

We also discussed with key security representatives and management officials whether information security controls were in place, adequately designed, and operating effectively.

To determine the status of FDIC’s actions to correct or mitigate previously reported information security weaknesses, we identified and reviewed its information security policies, procedures, and guidance. We reviewed prior GAO reports to identify previously reported weaknesses and examined FDIC’s corrective action plans to determine which weaknesses FDIC reported as being corrected. For those instances where FDIC reported it had completed corrective actions, we assessed the effectiveness of those actions.

We conducted this audit from November 2010 to August 2011, in accordance with generally accepted government auditing standards. We conducted our data collection, analysis, and assessment procedures in support of the financial audit between November 2010 and March 2011. We conducted supplemental audit procedures to prepare this report from March 2011 to August 2011. The generally accepted government auditing standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective.

Appendix II: Comments from the Federal Deposit Insurance Corporation

Appendix III: GAO Contacts and Staff Acknowledgments

GAO Contacts

Staff Acknowledgments

In addition to the individuals named above, Lon Chin, David Hayes, Charles Vrabel, and Christopher Warweg, Assistant Directors; Gary Austin; Angela Bell; William Cook; Saar Dagani; Nancy Glover; Rosanna Guerrero; Jason Porter; Michael Stevens; and Shaunyce Wallace made key contributions to this report.