Information security is a critical consideration for any organization that depends on information systems and computer networks to carry out its mission or business and is especially important for government agencies, where maintaining the public’s trust is essential. While the dramatic expansion in computer interconnectivity and the rapid increase in the use of the Internet have enabled agencies such as SEC to better accomplish their missions and provide information to the public, agencies’ reliance on this technology also exposes federal networks and systems to various threats. This can include threats originating from foreign nation states, domestic criminals, hackers, and disgruntled employees. Concerns about these threats are well founded because of the dramatic increase in reports of security incidents, the ease of obtaining and using hacking tools, and advances in the sophistication and effectiveness of attack technology, among other reasons. Without proper safeguards, systems are vulnerable to individuals and groups with malicious intent who can intrude and use their access to obtain or manipulate sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. We and federal inspectors general have reported on persistent information security weaknesses that place federal agencies at risk of disruption, fraud, or inappropriate disclosure of sensitive information. Accordingly, since 1997, we have designated information security as a government-wide high-risk area, and we continued to do so in the most recent update to our high-risk list. The Federal Information Security Management Act (FISMA) of 2002 is intended to provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. to develop, document, and implement an agency-wide security program to provide security for the information and systems that support the operations and assets of the agency, including information and information systems provided or managed by another agency, contractor, or other source. Additionally, FISMA assigns responsibility to the National Institute of Standards and Technology (NIST) to provide standards and guidelines to agencies on information security. NIST has issued related standards and guidelines, including Recommended Security Controls for Federal Information Systems and Organizations, NIST Special Publication (NIST SP) 800-53, and Contingency Planning Guide for Federal Information Systems, NIST SP 800-34. FISMA was enacted as Title III, E-Government Act of 2002, Pub L. No 107-347, 116 Stat. 2946 (2002). The Electronic Data Gathering, Analysis, and Retrieval (EDGAR) system performs the automated collection, validation, indexing, acceptance, and forwarding of submissions by companies and others that are required to file certain information with SEC. Its purpose is to accelerate the receipt, acceptance, dissemination, and analysis of time-sensitive corporate information filed with the commission. EDGAR/Fee Momentum, a subsystem of EDGAR, maintains accounting information pertaining to fees received from registrants. End User Computing Spreadsheets and/or User Developed Applications are used by SEC to prepare, analyze, summarize, and report on its financial data. The Financial Reporting and Analysis Tool facilitates the compilation of monthly, quarterly, and year-end financial reports. This tool also helps perform data reconciliation and analysis of the principal financial statements. The ImageNow application is a workflow tool that tracks, reviews, and approves documents related to disgorgements, penalties, and court registry. The general support system provides (1) business application services to internal and external customers and (2) security services necessary to support these applications. Under FISMA, the SEC Chair has responsibility for, among other things, (1) providing information security protections commensurate with the risk and magnitude of harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the agency’s information systems and information; (2) ensuring that senior agency officials provide information security for the information and information systems that support the operations and assets under their control; and (3) delegating to the agency chief information officer (CIO) the authority to ensure compliance with the requirements imposed on the agency. FISMA further requires the CIO to designate a senior agency information security officer who will carry out the CIO’s information security responsibilities. Although SEC had implemented and made progress in strengthening information security controls, weaknesses limited their effectiveness in protecting the confidentiality, integrity, and availability of a key financial system. SEC did not consistently control access to this financial system’s network, servers, applications, and databases; manage its configuration; segregate duties; and plan for contingencies and disasters. These weaknesses existed, in part, because SEC did not effectively oversee and manage the migration of the key financial system to a new location. Consequently, SEC’s financial information and systems were exposed to increased risk of unauthorized access, disclosure, modification, and disruption. A basic management objective for any organization is to protect the resources that support its critical operations and assets from unauthorized access. Organizations accomplish this by designing and implementing controls that are intended to prevent, limit, and detect unauthorized access to computer resources (e.g., data, programs, equipment, and facilities), thereby protecting them from unauthorized disclosure, modification, and loss. Specific access controls include border protection, identification and authentication of users, authorization restrictions, cryptography, audit and monitoring procedures, incident response procedures, and physical security. Without adequate access controls, unauthorized individuals, including intruders and former employees, can surreptitiously read and copy sensitive data and make undetected changes or deletions for malicious purposes or for personal gain. In addition, authorized users could intentionally or unintentionally modify or delete data or execute changes that are outside of their authority. Although SEC had issued policies and implemented controls based on those policies, it did not consistently protect its network boundary from possible intrusions; identify and authenticate users; authorize access to resources; ensure that sensitive data are encrypted; audit and monitor actions taken on the commission’s systems and network; and restrict physical access to sensitive assets. Boundary protection controls logical connectivity into and out of networks and controls connectivity to and from network-connected devices. Implementing multiple layers of security to protect an information system’s internal and external boundaries provides defense in depth. By using a defense-in-depth strategy, entities can reduce the risk of a successful cyber attack. For example, multiple firewalls could be deployed to prevent both outsiders and trusted insiders from gaining unauthorized access to systems. At the system level, any connections to the Internet, or to other external and internal networks or information systems, should occur through controlled interfaces (for example, proxies, gateways, routers and switches, firewalls, and concentrators). At the host or device level, logical boundaries can be controlled through inbound and outbound filtering provided by access control lists and personal firewalls. SEC deployed multiple firewalls that were intended to prevent unauthorized access to its systems; however, it did not securely configure access control lists on firewalls inside a key financial system’s environment. For example, its network devices and firewall settings inappropriately permitted users in the production environment to access the system’s network management server. In addition, the system’s production Internet firewalls were configured to allow systems in the “demilitarized zone” to connect to each other. As a result of these configurations, SEC introduced vulnerability to unnecessary and potentially undetectable access at multiple points in the key financial system’s network environment. Information systems need to be managed to effectively control user accounts and identify and authenticate users. Users and devices should be appropriately identified and authenticated through the implementation of adequate logical access controls. Users can be authenticated using mechanisms such as a password and user ID combination. SEC policy requires strong password controls for authentication, such as passwords that are at least 8 eight alphanumeric characters in length and that expire after a predetermined period of time. However, SEC did not consistently implement strong password controls for identifying and authenticating users to certain servers, network devices, and databases in the key financial system’s environment. For example, password length on a network management device and a server contained fewer characters than required. User account passwords on another server were configured to never expire. Additionally, two databases had a user password that had the same name as the user account. As a result, SEC is at increased risk that accounts could be compromised and used by unauthorized individuals to access sensitive information. Authorization encompasses access privileges granted to a user, program, or process. It is used to allow or prevent actions by that user based on predefined rules. Authorization includes the principles of legitimate use and least privilege. Operating systems have some built-in authorization features such as user rights and privileges, groups of users, and permissions for files and folders. Network devices, such as routers, may have access control lists that can be used to authorize users who can access and perform certain actions on the device. Access rights and privileges are used to implement security policies that determine what a user can do after being allowed into the system. Maintaining access rights, permissions, and privileges is one of the most important aspects of administering system security. However, SEC did not always employ the principle of least privilege when authorizing access permissions to a key financial system. Specifically, it did not appropriately restrict access to security-related parameters and users’ rights and privileges for several network devices, databases, and servers supporting key financial applications. As a result, users had excessive levels of access that were not required to perform their jobs. This could lead to data being inappropriately modified, either inadvertently or deliberately. Cryptographic controls can be used to help protect the integrity and confidentiality of data and computer programs by rendering data unintelligible to unauthorized users and/or protecting the integrity of transmitted or stored data.