Information security is a critical consideration for any organization that depends on information systems and computer networks to carry out its mission or business. It is especially important for government agencies where maintaining the public’s trust is essential. The dramatic expansion in computer interconnectivity and the rapid increase in the use of the Internet are changing the way our government, the nation, and much of the world communicate and conduct business. Without proper safeguards, systems are unprotected from individuals and groups with malicious intent to intrude and use the access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. These concerns are well-founded for a number of reasons, including the dramatic increase in reports of security incidents, the ease of obtaining and using hacking tools, the steady advance in the sophistication and effectiveness of attack technology, and the dire warnings of new and more destructive attacks to come. Computer-supported federal operations are likewise at risk. Our previous reports, and those of agency inspectors general, describe persistent information security weaknesses that place a variety of federal operations at risk of disruption, fraud, and inappropriate disclosure. We have designated information security as a governmentwide high-risk area since 1997—a designation that remains today. Recognizing the importance of securing the information systems of federal agencies, Congress enacted the Federal Information Security Management Act of 2002 (FISMA) to strengthen the security of information and systems within federal agencies. FISMA requires each agency to develop, document, and implement an agencywide information security program to provide information security for the information and systems that support the operations and assets of the agency, using a risk-based approach to information security management. Congress created FDIC in 1933 to restore and maintain public confidence in the nation’s banking system. The Financial Institutions Reform, Recovery, and Enforcement Act of 1989 sought to reform, recapitalize, and consolidate the federal deposit insurance system. The act created the Bank Insurance Fund and the Savings Association Insurance Fund, both of which are responsible for protecting insured bank and thrift depositors. It also abolished the FSLIC and created the FSLIC Resolution Fund to complete the affairs of the former FSLIC and liquidate the assets and liabilities transferred from the former Resolution Trust Corporation. Further, the act designated the corporation as the administrator of these funds. As part of this function, it has an examination and supervision program to monitor the safety of deposits held in member institutions. FDIC insures deposits in excess of $7 trillion for about 8,800 institutions. Together, the funds administered by FDIC have about $53 billion in assets. FDIC had a budget of about $1.1 billion for calendar year 2005 to support its activities in managing the funds. For that year, it processed almost 21 million financial transactions. The corporation relies extensively on computerized systems to support its financial operations and store the sensitive information it collects. Its local and wide area networks interconnect these systems. To support its financial management functions, the corporation relies on several financial systems to process and track financial transactions that include premiums paid by its member institutions and disbursements made to support operations. In addition, FDIC uses other systems that maintain personnel information for its employees, examination data for financial institutions, and legal information on closed institutions. At the time of our review, there were about 6,100 users on its systems. In our report on the results of our audit of the FDIC funds’ financial statements for 2003 and 2004, we noted that FDIC’s implementation of a new financial system would significantly change its information systems environment and the related information systems controls necessary for their effective operation and that, consequently, continued commitment to an effective information security program would be essential to ensure that the corporation’s financial and sensitive information would be adequately protected in the new environment. To support the corporation’s financial management functions in 2005, FDIC implemented its new financial system in May 2005. The new financial system is composed of 26 separate applications that either replaced or modified previous applications to support the New Financial Environment (NFE). In addition to changing financial systems, FDIC has undergone organizational changes in the last year that include the reorganization of the Division of Information Technology. This division oversees the development and operation of the corporation’s computer systems and software. It maintains the corporation’s communications network and provides the expertise necessary for developing new information management systems needed by the FDIC’s bank examiners, researchers, legal case managers, and finance officers. According to FISMA, the Chairman of FDIC is responsible for, among other things, (1) providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the agency’s information systems and information; (2) ensuring that senior agency officials provide information security for the information and information systems that support the operations and assets under their control; and (3) delegating to the agency’s Chief Information Officer the authority to ensure compliance with the requirements imposed on the agency under FISMA. The corporation’s Chief Information Officer is responsible for developing and maintaining a departmentwide information security program and for developing and maintaining information security policies, procedures, and control techniques that address all applicable requirements. The objectives of our review were to assess (1) the progress FDIC has made in correcting or mitigating remaining information system control weaknesses reported as unresolved at the time of our prior review in 2004 and (2) the effectiveness of the corporation’s information system controls for protecting the confidentiality, integrity, and availability of computerized data. An integral part of our objectives was to support the 2005 financial audit by assessing, as of December 31, 2005, the degree of security and controls over systems that support the generation of the FDIC funds’ financial statements. Our scope and methodology was based on our Federal Information System Controls Audit Manual, which contains guidance for reviewing information system controls that affect the confidentiality, integrity, and availability of computerized data. Focusing on FDIC’s financial systems and associated infrastructure, we evaluated the effectiveness of information security controls that are intended to prevent, limit, and detect access to computer resources (data, programs, and systems), thereby protecting these resources against unauthorized disclosure, modification, and use; provide physical protection of computer facilities and resources from unauthorized use, espionage, sabotage, damage, and theft; prevent the exploitation of vulnerabilities; prevent the introduction of unauthorized changes to application or ensure that work responsibilities for computer functions are segregated so that one individual does not perform or control all key aspects of computer-related operations and, thereby, have the ability to conduct unauthorized actions or gain unauthorized access to assets or records without detection. In addition, we evaluated aspects of FDIC’s information security program. This program includes assessing risk; developing and implementing policies, procedures, and security plans; promoting security awareness and providing specialized training for those with significant security responsibilities; testing and evaluating the effectiveness of controls; planning, implementing, evaluating, and documenting remedial actions to address information security deficiencies; detecting, reporting, and responding to security incidents; and ensuring the continuity of operations. To evaluate FDIC’s information security controls and program, we identified and examined pertinent FDIC security policies, procedures, guidance, security plans, and relevant reports provided during field work. In addition, we conducted tests and observations of controls in operation and reviewed corrective actions taken by the corporation to address vulnerabilities identified during our previous review. We also discussed with key security representatives, system administrators, and management officials whether information system controls were in place, adequately designed, and operating effectively. We performed our review at FDIC headquarters in Washington, D.C., and its computer facility in Arlington, Virginia, from September 2005 through February 2006. Our review was performed in accordance with generally accepted government auditing standards. FDIC has taken steps to address security control weaknesses. The corporation has corrected or mitigated 18 of the 24 weaknesses that we previously reported as unresolved. For example, the corporation has established and implemented procedures to ensure that dataset naming conventions comply with FDIC standards; developed and implemented automated procedures to ensure that access to sensitive production data is limited; and documented the appropriate controls of system interconnections, sharing information between applications, and rules concerning the behavior of users within each application between the Department of Agriculture’s National Finance Center and FDIC. While the corporation has made progress in strengthening its information security controls, it is still in the process of completing actions to correct or mitigate the remaining six previously reported weaknesses. These weaknesses include not adequately securing personal firewall settings on laptop computers, using live data for testing, and not ensuring that only authorized application software changes are implemented. Failure to resolve these issues could leave the corporation’s sensitive data vulnerable to unauthorized access and manipulation. FDIC has not effectively implemented information security controls to properly protect the confidentiality, integrity, and availability of its financial and sensitive information and information systems. In addition to the 6 previously reported weaknesses that remain uncorrected, we identified 20 new information security weaknesses during this review. Most of the identified weaknesses pertain to access controls. A primary reason for these weaknesses is that FDIC has not yet fully implemented its information security program. As a result, weaknesses in controls over its financial and sensitive data increase the risk of unauthorized disclosure, modification, or loss of data. Because of these heightened risks, we concluded that the weaknesses we identified constituted a reportable condition with respect to FDIC’s information systems security for 2005. Protecting the resources that support critical operations from unauthorized access is a basic management objective for any organization. Organizations accomplish this objective by designing and implementing controls that are intended to prevent, limit, and detect unauthorized access to computing resources, programs, and information. Access controls include (1) user accounts and passwords, (2) access rights and permissions, (3) network services, (4) configuration assurance, (5) audit and monitoring of security- related events, and (6) physical security.