Information security is a critical consideration for any organization that depends on information systems and computer networks to carry out its mission or business and is especially important for government agencies, where maintaining the public’s trust is essential. While the dramatic expansion in computer interconnectivity and the rapid increase in the use of the Internet have enabled agencies such as SEC to better accomplish their missions and provide information to the public, the changes also expose federal networks and systems to various threats. For example, the Federal Bureau of Investigation has identified multiple sources of cyber threats, including foreign nation states engaged in information warfare, domestic criminals, hackers and virus writers, and disgruntled employees working within an organization. Concerns about these threats are well founded for a number of reasons, including the dramatic increase in reports of security incidents, the ease of obtaining and using hacking tools, and steady advances in the sophistication and effectiveness of attack technology. For example, the number of incidents reported by federal agencies to the United States Computer Emergency Readiness Team (US- CERT), has increased dramatically over the past 3 years, increasing from 3,634 incidents reported in fiscal year 2005 to 13,029 incidents in fiscal year 2007 (a 259 percent increase). Without proper safeguards, systems are vulnerable to individuals and groups with malicious intent who can intrude and use their access to obtain or manipulate sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. Our previous reports and reports by federal inspectors general describe persistent information security weaknesses that place federal agencies at risk of disruption, fraud, or inappropriate disclosure of sensitive information. Accordingly, we have designated information security as a governmentwide high-risk area since 1997, a designation that remains in force today. Recognizing the importance of securing federal agencies’ information systems, Congress enacted the Federal Information Security Management Act (FISMA) in December 2002 to strengthen the security of information and systems within federal agencies. FISMA requires each agency to develop, document, and implement an agencywide information security program to provide information security for the information and systems that support the operations and assets of the agency, using a risk- based approach to information security management. Following the stock market crash of 1929, Congress passed the Securities Exchange Act of 1934, establishing SEC to enforce securities laws, regulate the securities markets, and protect investors. To carry out its responsibilities and help ensure that securities markets are fair and honest, SEC issues rules and regulations that promote adequate and effective disclosure of information to the investing public. The commission also oversees the registration of other key participants in the securities industry, including stock exchanges, broker-dealers, clearing agencies, depositories, transfer agents, investment companies, and public utility holding companies. SEC is an independent, quasi-judicial agency that operates at the direction of five commissioners appointed by the President and confirmed by the Senate. In fiscal year 2008, SEC received a budget authority of $906 million and had a staff of 3,511 employees. In addition, the commission collected $569,000 in filing fees and about $434 million in penalties and disgorgements. To support its financial operations and store the sensitive information it collects, SEC relies extensively on computerized systems interconnected by local and wide-area networks. For example, to process and track financial transactions, such as filing fees paid by corporations, disgorgements and penalties from enforcement activities, and procurement activities, SEC relies on several enterprise database applications—Momentum; Phoenix; Electronic Data Gathering, Analysis, and Retrieval (EDGAR); and Fee Momentum—and a general support system network that allows users to communicate with the database applications. The database applications provide SEC with the following capabilities: Momentum is used to record the commission’s accounting transactions, to maintain its general ledger, and to maintain some of the information SEC uses to produce financial reports. Phoenix contains and processes sensitive data relating to penalties, disgorgements, and restitution on proven and alleged violations of securities and futures laws. EDGAR performs automated collection, validation, indexing, acceptance, and forwarding of submissions by companies and others that are required to file certain information with SEC. Its primary purpose is to increase the efficiency and fairness of the securities market for the benefit of investors, corporations, and the economy by accelerating the receipt, acceptance, dissemination, and analysis of time-sensitive corporate information filed with the agency. The general support system is an integrated client-server system composed of local- and wide-area networks and is organized into distinct subsystems based along SEC’s organizational and functional lines. The general support system provides services to internal and external customers who use them for their business applications. It also provides the necessary security services to support these applications. Under FISMA, the Chairman of SEC has responsibility for, among other things, (1) providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the agency’s information systems and information; (2) ensuring that senior agency officials provide information security for the information and information systems that support the operations and assets under their control; and (3) delegating to the agency chief information officer (CIO) the authority to ensure compliance with the requirements imposed on the agency. FISMA requires the CIO to designate a senior agency information security officer who shall carry out the CIO’s information security responsibilities. SEC has corrected or mitigated 18 of the 34 security control weaknesses that we had reported as unresolved at the time of our prior audit report in 2008. For example, it has adequately validated electronic certificates from connections to its physically secured the perimeter of the operations center, monitored unusual and suspicious activities at its operations center, and removed network system accounts and data center access rights from separating employees. In addition, SEC has made progress in improving its information security program. For example, the commission has developed, documented, and implemented a policy on remedial action plans to help ensure that deficiencies are mitigated in an effective and timely manner, and provided individuals with training for incident handling. These efforts constitute an important step toward strengthening the agencywide information security program mandated by FISMA. While SEC has made important progress in strengthening its information security controls, it has not completed actions to correct or mitigate 16 of the previously reported weaknesses. For example, SEC has not adequately documented access privileges for the EDGAR application, always implemented patches on vulnerable workstations and enterprise database servers, or always sufficiently protected passwords. Failure to resolve these issues could leave sensitive data vulnerable to unauthorized disclosure, modification, or destruction. In addition to the 16 previously reported weakness that remain uncorrected, we identified 23 new weaknesses in controls intended to restrict access to data and systems, as well as weaknesses in other information security controls, that continue to jeopardize the confidentiality, integrity, and availability of SEC’s financial and sensitive information and information systems. Previously reported and newly identified weaknesses hinder the commission’s ability to perform vital functions and increase the risk of unauthorized disclosure, modification, or destruction of financial information. A key reason for these weaknesses was that SEC did not fully implement key activities of its information security program. A basic management objective for any organization is to protect the resources that support its critical operations and assets from unauthorized access. Organizations accomplish this by designing and implementing controls that are intended to prevent, limit, and detect unauthorized access to computer resources (e.g., data, programs, equipment, and facilities), thereby protecting them from unauthorized disclosure, modification, and loss. Specific access controls include identification and authentication, authorization, cryptography, audit and monitoring, and physical security. Without adequate access controls, unauthorized individuals, including outside intruders and former employees, can surreptitiously read and copy sensitive data and make undetected changes or deletions for malicious purposes or personal gain. In addition, authorized users can intentionally or unintentionally modify or delete data or execute changes that are outside of their span of authority. A computer system must be able to identify and authenticate the identities of users so that activities on the system can be linked to specific individuals. When an organization assigns unique user accounts to specific users, the system is able to distinguish one user from another—a process called identification. The system must also establish the validity of a user’s claimed identity by requesting some kind of information, such as a password, that is known only by the user—a process known as authentication. Furthermore, SEC policy requires the implementation of automated identification and authentication mechanisms that enable the unique identification of individual users and systems. SEC did not consistently enforce identification and authentication controls for its users and systems. For example, it did not always securely configure the snmp community string (similar to a password) used to monitor and manage network devices; remove the default vendor account for a remote network service, which could allow access to the network service without the need to provide a password; restrict multiple database administrators from sharing the same log-on application ID to a powerful database account; and uniquely identify individual accounts on network switches for https login. As a result, increased risk exists that users will not be uniquely identified before they access the SEC network, and SEC will not be able to hold them accountable in the event of a security incident. Authorization is the process of granting or denying access rights and privileges to a protected resource, such as a network, system, application, function, or file. A key component of granting or denying access rights is the concept of “least privilege.” Least privilege is a basic principle for securing computer resources and data that means that users are granted only those access rights and permissions that they need to perform their official duties. To restrict legitimate users’ access to only those programs and files that they need in order to do their work, organizations establish access rights and permissions. “User rights” are allowable actions that can be assigned to users or to groups of users. File and directory permissions are rules that are associated with a particular file or directory, regulating which users can access it—and the extent of that access.