For any organization that depends on information systems to carry out its mission, protecting those systems that support critical operations and infrastructures is of paramount importance. Without proper safeguards, the speed and accessibility that create the enormous benefits of the computer age may allow individuals and groups with malicious intent to gain unauthorized access to systems and use this access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other sites. Concerns about attacks from individuals and groups, including terrorists, are well founded for a number of reasons, including the dramatic increase in reports of security incidents, the ease of obtaining and using hacking tools, the steady advance in the sophistication and effectiveness of attack technology, and the dire warnings of new and more destructive attacks to come. Given these threats, the security of computer-supported federal operations are at risk and place a variety of critical operations at risk of disruption, fraud, and inappropriate disclosure. We have designated information security as a governmentwide high-risk area since 1997—a designation that remains today. To address these concerns, Congress enacted the Federal Information Security Management Act of 2002 to strengthen the security of information collected or maintained and information systems used or operated by federal agencies, or by a contractor or other organization on behalf of a federal agency. The act provides a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. The act requires each agency to develop, document, and implement an agencywide information security program for the information and systems that support the operations of the agency as well as information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency. Established by the Federal Reserve Act of 1913, the Federal Reserve System consists of a 7-member Board of Governors with headquarters in Washington, D.C.; 12 Reserve Districts, each with its own FRB located in a major city in the United States; and 25 bank branches. The Federal Reserve System differs from other entities established to carry out public purposes in that it is part public and part private. Although the Board is a government agency, the banks are not. Also, the Federal Reserve System structure does not follow the familiar “top-down” hierarchy, with all policymaking authorities centralized in Washington, D.C. The Board and the FRBs have shared responsibilities and policymaking authority in many areas of operation. The FRBs play a significant role in the processing of marketable Treasury securities. As fiscal agents of Treasury, the FRBs receive bids, issue securities to awarded bidders, collect payments on behalf of Treasury, and make interest and redemption payments from Treasury’s account to the accounts of security holders. During fiscal year 2005, the FRBs processed debt held by the public of about $4.5 trillion in issuances, about $4.2 trillion in redemptions, and about $128 billion in interest payments. Certain FRBs also provide IT services in support of Treasury auctions, operating and maintaining the Treasury mainframe auction application in which bid submissions are recorded and the auction results calculated. In addition to the Treasury mainframe auction application, the FRBs also operate and maintain two Treasury distributed-based auction applications. These applications provide the user interface to the mainframe auction application through the Federal Reserve networks. One of the distributed-based auction applications serves approximately 670 users, allowing them to participate in public (primarily noncompetitive) auctions via the Internet. The other distributed-based auction application serves 22 primary broker/dealers for competitive auctions who connect to it via workstations installed in the dealers’ offices by the FRBs. One nonprimary broker/dealer is allowed to access this distributed-based auction application via the Internet on a trial basis. These distributed-based auction applications transmit information on the tenders/bids, including the name of the submitter, the par amount of securities being tendered or awarded, the discount rate being tendered or awarded, and the clearing bank. Multiple Federal Reserve organizations are involved in the operation and maintenance of these applications, including the Federal Reserve Information Technology (FRIT)—the organization that provides entitywide IT support services for the Federal Reserve System. Other systems supporting Treasury financial reporting are mainframe-based applications and are used to record securities purchased by financial institutions, provide an automated system for investors to buy securities directly from Treasury and manage their Treasury securities portfolios, and monitor and track all cash received and disbursed for debt transactions that the FRBs process. The objective of our review was to assess the effectiveness of information system controls in ensuring the confidentiality, integrity, and availability of Treasury’s financial and sensitive auction information on key mainframe and distributed-based systems that the FRBs maintain and operate on behalf of BPD and that are relevant to the Schedule of Federal Debt. Our assessment included a review of the supporting network infrastructure that interconnects the mainframe and distributed-based systems. To accomplish this objective, we used elements of our Federal Information System Controls Audit Manual to evaluate information system controls within the FRB control environment. We concentrated our efforts primarily on the evaluation of logical access controls over the FRBs’ distributed-based auction applications because of their recent implementation and the Federal Reserve network infrastructure that supports these applications. To evaluate these applications, we reviewed information system controls over network resources used by the applications and focused on the following control domain areas: identification and authentication; authorization; boundary protection; cryptography; logging, auditing, and monitoring; and configuration management and assurance. Our review included observations of Treasury auction operations and an examination of automated programs related to the auction process; system data collected by FRB employees in our presence and at our direction; system and infrastructure documentation; source code for the distributed-based auction applications; and configuration files of firewalls, routers, and switches. We also examined policy and procedural documentation for the FRBs’ distributed computing security and network security, interviewed information technology managers and staff, and familiarized ourselves with the operations of the general auditors and with the results of their recent work applicable to our audit. In addition, we performed limited application controls testing over the Treasury mainframe auction application and other key mainframe applications that support Treasury’s financial reporting. Specifically, we evaluated application controls associated with access (segregation of duties, least privilege, and identification and authentication); controls over master data; transaction data input (data validation and edit checks); transaction data processing (data integrity and logs); and transaction data output (output reconciliation and review). To evaluate the effectiveness of these controls, we obtained system configuration information using GAO-prepared analytical tools run by FRB IT staff, and verified critical operating system logging and access control information for relevant system configurations. Also, using GAO-prepared scripts, we obtained information on operating system utilities with assistance from FRB IT staff. We discussed with officials from the staff of the Board of Governors and key Federal Reserve information security representatives and officials whether information security controls were in place, adequately designed, and operating effectively. We also discussed with these individuals the results of our review. We performed our work at the FRBs that operate and maintain the mainframe and distributed-based financial reporting and auction applications we selected for review. We performed our work from March 2005 through May 2006 in accordance with generally accepted government auditing standards. Although the FRBs established and implemented many controls to protect the mainframe applications that they maintain and operate on behalf of BPD, they did not consistently implement controls to prevent, limit, or detect unauthorized access to sensitive data and computing resources for the distributed-based systems and network environment that support Treasury auctions. As a result, increased risk exists that unauthorized and possibly undetected use, modification, destruction, and disclosure of certain sensitive auction information could occur. Furthermore, other FRB applications that share common network resources may also face increased risk. These information system control weaknesses existed, in part, because the FRBs did not have (1) an effective management structure for coordinating, communicating, and overseeing information security activities across bank organizational boundaries and (2) an environment to sufficiently test the auction applications. The FRBs had generally implemented effective information system controls for the mainframe applications that they operate and maintain on behalf of BPD in support of Treasury’s auctions and financial reporting. Examples of these controls include multiple layers of procedural and technical controls over mainframe systems, effective isolation of mainframe systems having different control requirements, and continuous independent auditing of mainframe technical controls. In addition, FRIT upgrades the software for the mainframe systems on an annual schedule. Each year, a new logical partition of the mainframe is created with the upgraded operating system and vendor-supplied software. This logical partition is then tested in a defined process, which is subject to an annual audit, and there is continuous monitoring of the production logical partitions. Although the mainframe control environment was generally effective, the FRBs had not effectively implemented information system controls for the distributed-based systems and supporting network environment relevant to Treasury auctions. More specifically, the FRBs did not consistently (1) identify and authenticate users to prevent unauthorized access; (2) enforce the principle of least privilege to ensure that authorized access was necessary and appropriate; (3) implement adequate boundary protections to limit connectivity to systems that process BPD business; (4) apply strong encryption technologies to protect sensitive data in storage and on the Federal Reserve networks; (5) log, audit, or monitor security-related events; and (6) maintain secure configurations on servers and workstations. Identification and Authentication A computer system must be able to identify and differentiate among users so that activities on the system can be linked to specific individuals. When an organization assigns unique user accounts to specific users, the system distinguishes one user from another—a process called identification. The system also must establish the validity of a user’s claimed identity through some means of authentication, such as a password, that is known only to its owner. The combination of identification and authentication—such as user account/password combinations—provides the basis for establishing individual accountability and for controlling access to the system. The National Institute of Standards and Technology states that information systems should employ multifactor authentication, such as a combination of passwords, tokens, and biometrics. The FRBs did not adequately identify and authenticate users. For example, due to the weak design of password reset functionality for one of the distributed-based auction applications, anyone on the Internet could potentially change the password for a user in the application by having only his or her userID. Recognizing the severity of this vulnerability, the FRBs took steps to immediately correct this weakness. The FRBs also designed and implemented the distributed-based auction applications to only rely on one means of authentication, rather than a combination of authentication factors for controlling access. Furthermore, the FRBs did not replace a well-known vendor-supplied password on one of their systems, thereby increasing the risk that an unauthorized individual could guess the password and gain access to the system. Authorization is the process of granting or denying access rights and privileges to a protected resource, such as a network, system, application, function, or file. A key component of granting or denying access rights is the concept of “least privilege.” Least privilege is a basic underlying principle for securing computer resources and data. The term means that users are granted only those access rights and permissions that they need to perform their official duties. To restrict legitimate users’ access to only those programs and files that they need to do their work, organizations establish access rights and permissions. User rights are allowable actions that can be assigned to users or to groups of users. File and directory permissions are rules that are associated with a particular file or directory and regulate which users can access them and the extent of that access. To avoid unintentionally giving users unnecessary access to sensitive files and directories, an organization must give careful consideration to its assignment of rights and permissions. The FRBs did not implement sufficient authorization controls to limit user access to distributed-based computer resources. The distributed-based auction applications had excessive database privileges that were granted explicitly as well as inherited through permissions given to all users. As a result, malicious users could use these excessive privileges to exploit other vulnerabilities in the applications. In addition, the FRBs had granted users administrative privileges on their workstations, even though most users did not require this level of access. Granting unnecessary access privileges increases the risk that a workstation could be successfully compromised and then used to attack other FRB resources. As a result, the unnecessary level of access granted to computer resources provides opportunities for individuals to circumvent security controls to deliberately or inadvertently read, modify, or delete critical or sensitive information. Boundary protections demarcate a logical or physical boundary between protected information and systems and unknown users. Organizations physically allocate publicly accessible information system components to subnetworks with separate, physical network interfaces, and prevent public access into their internal networks, except as authorized. Unnecessary connectivity to an organization’s network not only increases the number of access paths that must be managed and the complexity of the task, but increases the risk in a shared environment. The FRBs did not consistently implement adequate boundary protections to limit connectivity to applications in the shared network environment. These applications include those that the FRBs operate and maintain on behalf of BPD and other FRB internal applications and systems that serve a variety of business areas with differing security requirements. In addition, the internal network was not segregated to restrict access to internal systems, and management of network devices and applications was conducted “in-band.” These practices increase the risk that individuals could disrupt or gain unauthorized access to sensitive auction data and other Federal Reserve computing resources. In some cases, the FRBs implemented effective boundary protection controls. For example, the remote access system used Federal Information Processing Standard compliant tokens for authentication and enforced a restriction that prevented simultaneous communication with the internal Federal Reserve network and the Internet. Cryptography underlies many of the mechanisms used to enforce the confidentiality and integrity of critical and sensitive information. Encryption—one type of cryptography—is the process of converting readable or plaintext information into unreadable or ciphertext information using a special value known as a key and a mathematical process known as an algorithm. The strength of a key and an algorithm is determined by their length and complexity—the longer and more complex they are, the stronger they are. The FRBs did not appropriately apply strong encryption technologies to sensitive data and network traffic. Weak encryption algorithms, such as the user’s session information and application configuration files, were used to protect sensitive data in one of the distributed-based auction applications. Also, a weak encryption format was used to store and transmit certain passwords. These weaknesses could allow an attacker to view data and use that knowledge to gain access to sensitive information, including auction data. Determining what, when, and by whom specific actions were taken on a system is crucial to establishing individual accountability, investigating security violations, and monitoring compliance with security policies. Organizations accomplish this by implementing system or security software that provides an audit trail for determining the source of a transaction or attempted transaction and for monitoring users’ activities. How organizations configure the system or security software determines what system activity data are recorded into system logs and the nature and extent of the audit trail information that results. Without sufficient auditing and monitoring, organizations increase the risk that they may not detect unauthorized activities or policy violations. Furthermore, the National Institute of Standards and Technology guidance states that organizations should deploy centralized servers and configure devices to send duplicates of their log entries to the centralized servers. The FRBs did not sufficiently log, audit, or monitor events related to the distributed-based auction application process. For example, the intrusion detection system had not been customized to detect any abnormal communication among application components that might indicate an attack was in progress. In addition, no centralized logging was performed for certain servers we examined. As a result, there was a higher risk that unauthorized system activity would not be detected in a timely manner. To protect an organization’s information, it is important to ensure that only authorized application programs are placed in operation. This process, known as configuration management, is accomplished by instituting policies, procedures, and techniques to help ensure that all programs and program modifications are properly authorized, tested, and approved. Patch management, a component of configuration management, is an important element in mitigating the risks associated with software vulnerabilities. When a software vulnerability is discovered, the software vendor may develop and distribute a patch or work-around to mitigate the vulnerability. Up-to-date patch installation can help mitigate vulnerabilities associated with flaws in software code that could be exploited to cause significant damage, ranging from Web-site defacement to the loss of control of entire systems, thereby enabling malicious individuals to read, modify, or delete sensitive information; disrupt operations; or launch attacks against other organizations’ systems. Configuration assurance is the process of verifying the correctness of the security settings on hosts, applications, and networks and maintaining operations in a secure fashion. The FRBs did not maintain secure configurations on the distributed-based auction application servers and workstations we reviewed. Key servers and FRB workstations were missing patches that could prevent an attacker from gaining remote access. In addition, the FRBs were running a database management system and network devices that were no longer supported by the vendor. Unsupported products greatly increase the risk of security breaches, since the vendor often does not provide patches for known vulnerabilities. As a result of these weaknesses, the risk is increased of a successful attack and compromise of the related auction process. The previously mentioned information system control weaknesses existed, in part, because the FRBs did not have (1) an effective management structure for coordinating, communicating, and overseeing information security activities across bank organizational boundaries and (2) an environment to sufficiently test the auction applications. Implementing effective information security management practices across the enterprise is essential to ensuring that controls over information and information systems work effectively on a continuing basis, as described in our May 1998 study of security management best practices. An important factor in implementing effective practices is linking them in a cycle of activity that helps to ensure that information security policies address current risks on an ongoing basis. An effective management structure is the starting point for coordinating and communicating the continuous cycle of information security activities, while providing guidance and oversight for the security of the entity as a whole. One mechanism organizations can adopt to achieve effective coordination and communication, particularly in organizations where information security management is decentralized, is to establish a central security management office or group to serve as a facilitator to individual business units and senior management. A central security group serves as a locus of knowledge and expertise on information security and coordinates agencywide security-related activities. This group is also accessible to security specialists at the various organizational elements within the agency. Such a management structure is especially important to manage the inherent risks associated with a highly distributed, interconnected network-based computing environment and to help ensure that weaknesses in one system do not place the entire entity’s information assets at undue risk. In addition, as part of this management structure, clearly defined roles and responsibilities for all security staff should be established and coordination of responsibilities among individual security staff should be developed and communicated to ensure that, collectively, information security activities are effective. The FRBs did not have an effective management structure for coordinating, communicating, and overseeing their decentralized information security management activities that support Treasury auction systems and the supporting network infrastructure. Each bank operates independently and autonomously of one another, yet they share many of the same systems and computing resources. Because the FRBs did not have an effective information security management structure over the distributed-based systems, information security activities were not adequately coordinated among the banks and with the various IT groups involved in providing IT support services, including FRIT—the organization that provides entitywide IT support services. For example, information management activities associated with one of the distributed-based auction systems was divided among 10 IT groups, as shown in figure 1. In addition, no IT group was responsible for coordinating and communicating enterprisewide security operations support or oversight services. Consequently, the various organizations responsible for implementing information security did not have a good understanding or adequate visibility of the activities that other groups performed, nor did they always make appropriate decisions about information security for the network environment as a whole. As a result, there was no enterprisewide view of information security, and decisions regarding information security activities were not always optimal or based on a full understanding of the shared network environment supporting the Treasury auction process. For example, one IT group responsible for database operations made information security decisions regarding the distributed-based auction applications on the concept that they were operating in a “trusted network,” which resulted in the omission of controls that should have been in place; one IT group made decisions about the operations and maintenance of the distributed-based auction applications without full or accurate knowledge of the relevant computing environment; no IT group had responsibility for making a decision to upgrade the distributed-based auction database product, although all concerned agreed that an upgrade was needed; and servers that support the distributed-based auction applications were supposed to be identical to ensure real-time continuity of operations, but our testing showed that, as implemented, they were not identical. The Federal Reserve recognizes that a need exists for comprehensive approaches to managing information security, and that the management structure and processes that served its mainframe-centric environment in the past are not adequate for the distributed, interconnected environment supporting its various lines of business today. The Federal Reserve has an initiative under way to establish an information security architecture framework that is intended to integrate enterprise security activities, including enterprise access management, domain boundary, data security, configuration management, and information assurance. If effectively implemented, this initiative could provide the FRBs with an enterprisewide operational and technological view of its computing environment, including the interdependencies and interrelationships across the entity’s business operations and underlying IT infrastructure and applications that support these operations. However, until a more comprehensive and enterprisewide approach to security management is adopted, the FRB organizations that support Treasury auction systems will be limited in their ability to ensure the confidentiality, integrity, and availability of certain sensitive auction information and other resources for systems that they maintain and operate. The FRBs did not have a test environment to evaluate system changes and enhancements to the distributed-based auction applications, which limited the rigor of the testing that could be performed. A separate test environment that models the production environment is critical to ensuring that systems and system enhancements are adequately tested and do not adversely affect production. However, the FRBs did not have an isolated testing area that was functionally separate from the production network infrastructure and other FRB business applications. As a result, some application security testing was performed during very limited scheduled outages of the production systems involved, and some test procedures were never performed because the risk to production systems could not be effectively mitigated. Although the FRBs have implemented many controls to protect the mainframe information systems that they maintain on behalf of BPD relevant to the Schedule of Federal Debt, information security control weaknesses related to the distributed-based auction systems and supporting network environment exist at the Federal Reserve that place certain sensitive auction information at risk. The weaknesses in identification and authentication; authorization; boundary protection; cryptography; logging, auditing, and monitoring; and configuration management and assurance affect not only the distributed-based auction systems but also could affect other FRB systems residing in the shared network environment. With control over and responsibility for Treasury’s auction information systems spread across the FRBs, an effective management structure for coordinating, communicating, and overseeing information security activities across bank organizational boundaries becomes even more important. In addition, more robust testing of security controls over the auction applications is imperative to help provide more timely detection of vulnerabilities. Until the Federal Reserve takes steps to mitigate these weaknesses, it has increased risk that sensitive auction data would not be adequately protected against unauthorized disclosure, modification, or destruction. To help strengthen the FRBs’ information security over key distributed-based auction systems, we recommend that you take the following two steps: establish a management structure that ensures decentralized information security activities are effective and implement an application test environment for the auction systems. We are also making additional recommendations in a separate report with limited distribution. These recommendations consist of actions to be taken to correct the specific information security weaknesses we identified that are related to identification and authentication; authorization; boundary protection; cryptography; logging, auditing, and monitoring; and configuration management and assurance. In providing written comments on a draft of this report (reprinted in app. I), the Director, Division of Reserve Bank Operations and Payment Systems of the Federal Reserve System, generally agreed with the contents of the draft report and stated that the Federal Reserve has already taken corrective actions to remedy many of the reported findings and will continue to apply its risk-based assessment framework to determine appropriate information security controls or compensating measures to address the remaining findings. The director also described completed, ongoing, and planned actions to address systemic and organizational issues that contributed to the report’s findings, including actions to improve the Federal Reserve’s ability to coordinate and oversee its operational and technical environments and to replace its existing auction applications and operational infrastructure. In addition, the director commented that the Federal Reserve and Treasury plan to validate the integrity of the new application and infrastructure at several points during the development of the application; a key aspect of this validation is to ensure that the findings in this report are addressed. This report contains recommendations to you. As you know, 31 U.S.C. 720 requires that the head of a federal agency submit a written statement of the actions taken on our recommendations to the Senate Committee on Homeland Security and Governmental Affairs and to the House Committee on Government Reform not later than 60 days from the date of the report and to the House and Senate Committees on Appropriations with the agency’s first request for appropriations made more than 60 days after the date of this report. Because agency personnel serve as the primary source of information on the status of recommendations, GAO requests that the agency also provide us with a copy of your agency’s statement of action to serve as preliminary information on the status of open recommendations. We are sending copies of this report to the Chairmen and Ranking Minority Members of the Senate Committee on Homeland Security and Governmental Affairs; the Subcommittee on Federal Financial Management, Government Information, and International Security, Senate Committee on Homeland Security and Governmental Affairs; and the Chairmen and Ranking Minority Members of the House Committee on Government Reform and the Subcommittee on Government Management, Finance, and Accountability, House Committee on Government Reform. In addition, we are sending copies to the Fiscal Assistant Secretary of the Treasury and the Deputy Director for Management of OMB. We will also make copies available to others upon request. In addition, this report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov, Keith A. Rhodes at (202) 512-6412 or rhodesk@gao.gov, or Gary T. Engel at (202) 512-8815 or engelg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix II. On behalf of Chairman Bernanke, thank you for the opportunity to comment on the GAO’s report titled Information Security: Federal Reserve Needs to Address Treasury Auction Systems. The GAO’s audit of the Treasury auction systems was conducted as part of its review of the Bureau of the Public Debt’s FY 2005 Schedules of Federal Debt. The report identified a number of weaknesses in Reserve Bank computer-based information security control environments in the distributed computing and network environments that support the Treasury auction processes. We have already taken corrective actions to remediate many of the findings in the report, and we will continue to apply our risk-based assessment framework to determine appropriate information security controls or compensating measures to address remaining findings. The Reserve Banks are taking action to address systemic and organizational issues that contributed to the report’s findings. We met with the GAO review team several times to discuss our plans to further strengthen our information security architecture and to correct the root causes of the findings so that we avoid recurring weakness in controls. The report recognizes that successful implementation of the strengthened architecture could improve our ability to manage our information security operational and technical environments. We have also taken actions to improve our ability to coordinate and oversee our complex IT systems effectively. The Reserve Banks recently realigned their information security governance structure and designated the Director of the Reserve Banks’ Federal Reserve Information Technology organization (FRIT) as the focal point for enterprise-wide information security. All operational units within the Federal Reserve Banks are responsible for confirming compliance with established information security operational practices and information security policies and standards with the Director of FRIT. As part of this realignment, FRIT established a new function, National Information Security Assurance (NISA), which is responsible for monitoring end-to-end information security compliance with security standards, including software currency, across the Federal Reserve. Further, NISA will maintain an aggregate view of information security risk across all risk management programs, including internal audit and external sources, such as the GAO. The Treasury auction applications reviewed in this report were developed starting in 1998 when web technology, tools, and development practices were substantially less evolved than those available today. While security methods for web-based applications have improved, so has the sophistication of criminals attempting to compromise them. The Treasury and the Federal Reserve are currently undertaking a significant development initiative to replace the existing applications and operational infrastructure by year-end 2007. The design of the new application and infrastructure is based on current sound practices that will ensure a well- managed and well-controlled operating environment. The Federal Reserve and Treasury plan to validate the integrity of the application and infrastructure at several points in the project using internal and external technical resources. A key aspect of this validation is ensuring the GAO’s findings are addressed. The new auction applications will be operated within the Federal Reserve’s strengthened information security architecture, and information security compliance will be monitored through our improved information security governance structure. As your report notes, this review specifically focused on information security controls in the distributed computing and network environments supporting the Treasury auction process. The GAO’s review did not consider the end-to-end risk control environment that would include management and business operational controls. This additional layer of control is critical to ensuring the integrity of the Schedules of Federal Debt. The information security vulnerabilities the GAO identified did not affect its opinion in its report titled Financial Audit: Bureau of the Public Debt’s Fiscal Years 2004 and 2005 Schedules of Federal Debt. That report noted that effective internal controls over financial reporting and compliance with applicable laws and regulations were maintained. Although we consider the information security control vulnerabilities identified in the Treasury auction system report significant and warranting our serious attention, they should not be construed as allowing successful circumvention of Treasury auction management and business operational controls. We appreciate the quality of the GAO technical review and the time taken by the review team to brief Federal Reserve and Treasury staff thoroughly on the results of the review. The GAO team has also contributed to our remediation efforts by consulting with various Federal Reserve technical and management staff on the technical details underlying the findings in the report. In addition to the individuals named above, Ed Alexander, Lon Chin, Edward Glagola, David Hayes, Hal Lewis, Duc Ngo, Dawn Simpson, and Jenniffer Wilson, Assistant Directors, and Mark Canter, Dean Carpenter, Jason Carroll, West Coile, Debra Conner, Neil Doherty, Nancy Glover, Sharon Kittrell, Eugene Stevens, Henry Sutanto, Amos Tevelow, and Chris Warweg made key contributions to this report.

Summary: The Federal Reserve System's Federal Reserve Banks (FRB) serve as fiscal agents of the U.S. government when they are directed to do so by the Secretary of the Treasury. In this capacity, the FRBs operate and maintain several mainframe and distributed-based systems--including the systems that support the Department of the Treasury's auctions of marketable securities--on behalf of the department's Bureau of the Public Debt (BPD). Effective security controls over these systems are essential to ensure that sensitive and financial information is adequately protected from inadvertent or deliberate misuse, disclosure, or destruction. In support of its audit of BPD's fiscal year 2005 Schedule of Federal Debt, GAO assessed the effectiveness of information system controls in protecting financial and sensitive auction information on key mainframe and distributed-based systems that the FRBs maintain and operate for BPD. To do this, GAO observed and tested FRBs' security controls. In general, the FRBs had implemented effective information system controls over the mainframe applications they maintain and operate for BPD in support of Treasury's auctions and financial reporting. On the distributed-based systems and supporting network environment used for Treasury auctions, however, they had not fully implemented information system controls to protect the confidentiality, integrity, and availability of sensitive and financial information. The FRBs did not consistently (1) identify and authenticate users to prevent unauthorized access; (2) enforce the principle of least privilege to ensure that access was authorized only when necessary and appropriate; (3) implement adequate boundary protections to limit connectivity to systems that process BPD business; (4) apply strong encryption technologies to protect sensitive data both in storage and on its networks; (5) log, audit, or monitor security-related events; and (6) maintain secure configurations on servers and workstations. Without consistent application of these controls, the auction information and computing resources for key distributed-based auction systems remain at increased risk of unauthorized and possibly undetected use, modification, destruction, and disclosure. Other FRB applications that share common network resources may also be at increased risk. Contributing to these weaknesses in information system controls were the Federal Reserve's lack of (1) an effective management structure for coordinating, communicating, and overseeing information security activities across bank organizational boundaries and (2) an adequate environment in which to sufficiently test the security of its auction applications.