Information security is a critical consideration for any organization that depends on information systems and computer networks to carry out its mission or business. It is especially important for government agencies, where maintaining the public’s trust is essential. The dramatic expansion in computer interconnectivity and the rapid increase in the use of the Internet have changed the way our government, the nation, and much of the world communicate and conduct business. However, without proper safeguards, systems are unprotected from individuals and groups with malicious intent to intrude and use the access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. This concern is well-founded for a number of reasons, including the dramatic increase in reports of security incidents, the ease of obtaining and using hacking tools, the steady advance in the sophistication and effectiveness of attack technology, and the dire warnings of new and more destructive attacks to come. Computer-supported federal operations are likewise at risk. Our previous reports and those of agency inspectors general describe persistent information security weaknesses that place a variety of federal operations at risk of disruption, fraud, and inappropriate disclosure. Thus, we have designated information security as a governmentwide high-risk area since 1997, a designation that remains today. Recognizing the importance of securing federal agencies’ information and systems, Congress enacted the Federal Information Security Management Act of 2002 (FISMA) to strengthen the security of information and systems within federal agencies. FISMA requires each agency to use a risk-based approach to develop, document, and implement a departmentwide information security program for the information and systems that support the operations and assets of the agency. Congress created FDIC in 1933 to restore and maintain public confidence in the nation’s banking system. The Financial Institutions Reform, Recovery, and Enforcement Act of 1989 sought to reform, recapitalize, and consolidate the federal deposit insurance system. The act designated FDIC as the administrator of two funds responsible for protecting insured bank and thrift depositors—BIF and the SAIF. The act also designated FDIC as the administrator of the FSLIC Resolution Fund, which was created to complete the affairs of the former FSLIC and liquidate the assets and liabilities transferred from the former Resolution Trust Corporation. On February 8, 2006, the President signed into law the Federal Deposit Insurance Reform Act of 2005. Among its provisions, the act calls for the merger of the BIF and SAIF into the DIF. FDIC completed this merger on March 31, 2006. In managing these funds, the corporation has an examination and supervision program to monitor the safety of deposits held in member institutions. FDIC insures deposits in excess of $4 trillion for its 8,693 member institutions. FDIC had a budget of about $1.06 billion for calendar year 2006 to support its activities in managing the funds. For that year, it processed almost 21 million financial transactions. FDIC relies extensively on computerized systems to support its financial operations and store the sensitive information that it collects. Its local and wide area networks interconnect these systems. To support its financial management functions, the corporation relies on the NFE and several financial systems that process and track financial transactions, including premiums paid by its member institutions and disbursements made to support operations. Other systems maintain personnel information for employees, examination data for financial institutions, and legal information on closed institutions. At the time of our review, there were about 5,629 users on FDIC systems. Federal law delineates responsibilities for the management of computer systems at FDIC. Under FISMA, the Chairman of FDIC is responsible for, among other things, (1) providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the agency’s information systems and information; (2) ensuring that senior agency officials provide information security for the information and information systems that support the operations and assets under their control; and (3) delegating to the agency’s Chief Information Officer the authority to ensure compliance with the requirements imposed on the agency under FISMA. Two deputies to the Chairman—the Chief Financial Officer and Chief Operating Officer—also have information security responsibilities. The Chief Financial Officer is responsible for the preparation of financial statements and ensures that they are fairly presented and demonstrate discipline and accountability. The Chief Financial Officer is part of a senior management group that oversees the NFE. The group receives monthly system progress updates from the NFE project team. The Chief Operating Officer is responsible for planning, coordinating, evaluating, and improving programs and resource management. He is also in charge of the Chief Information Officer, who is responsible for developing and maintaining a departmentwide information security program and for developing and maintaining information security policies, procedures, and control techniques that address all applicable requirements. The objectives of our review were to assess (1) the progress FDIC has made in correcting or mitigating remaining information system control weaknesses reported as unresolved at the time of our prior review in 2005 and (2) the effectiveness of the corporation’s information system controls for protecting the confidentiality, integrity, and availability of financial and sensitive data. An integral part of our objectives was to support the opinion on internal control in GAO’s 2006 financial statement audit by assessing the degree of security over systems that support the generation of the FDIC funds’ financial statements. Our scope and methodology was based on our Federal Information System Controls Audit Manual, which contains guidance for reviewing information system controls that affect the confidentiality, integrity, and availability of computerized data. Focusing on FDIC’s financial systems and associated infrastructure, we evaluated the effectiveness of information security controls that are intended to prevent, limit, and detect access to computer resources (data, programs, and systems), thereby protecting these resources against unauthorized disclosure, modification, and use; provide physical protection of computer facilities and resources from unauthorized use, espionage, sabotage, damage, and theft; prevent the exploitation of vulnerabilities; prevent the introduction of unauthorized changes to application or system ensure that work responsibilities for computer functions are segregated so that one individual does not perform or control all key aspects of computer-related operations and thereby have the ability to conduct unauthorized actions or gain unauthorized access to assets or records without detection; and ensure the implementation of secure and effective configuration management. In addition, we evaluated aspects of FDIC’s information security program as they relate to NFE. This program includes assessing risk; developing and implementing policies, procedures, and security plans; promoting security awareness and providing specialized training for those with significant security responsibilities; testing and evaluating the effectiveness of controls; planning, implementing, evaluating, and documenting remedial actions to address information security deficiencies; detecting, reporting, and responding to security incidents; and ensuring the continuity of operations. To evaluate FDIC’s information security controls and program, we identified and examined pertinent FDIC security policies, procedures, guidance, security plans, and relevant reports provided during fieldwork. In addition, we conducted tests and observations of controls in operation and reviewed corrective actions taken by the corporation to address vulnerabilities identified during our previous review. We also discussed with key security representatives, system administrators, and management officials whether information system controls were in place, adequately designed, and operating effectively. We performed our review at the FDIC computer facility in Arlington, Virginia, from September 2006 through February 2007. Our review was performed in accordance with generally accepted government auditing standards. FDIC has taken steps to address security control weaknesses. The corporation has corrected or mitigated 21 of the 26 weaknesses that we previously reported as unresolved at the completion of our calendar year 2005 audit (see app. I). For example, the corporation has developed and implemented procedures to prohibit the transmission of mainframe user and administrator passwords in plaintext across the network, established and implemented a process to monitor and report on vendor- supplied account/password combinations, and improved mainframe security monitoring controls. While the corporation has made important progress in strengthening its information security controls, it is still in the process of completing actions to correct or mitigate the remaining five previously reported weaknesses. These uncorrected actions include ensuring that only authorized application software changes are implemented, limiting network access to sensitive personally identifiable and business proprietary information, effectively generating and reviewing the NFE audit reports, adequately controlling physical access to the Virginia Square building, and properly segregating incompatible system-related functions, duties, and capacities for an individual associated with the NFE. Not addressing these actions could leave the corporation’s sensitive data vulnerable to unauthorized access and manipulation. Appendix I describes the previously reported weaknesses in information security controls that were unresolved at the time of our prior review and the status of the corporation’s corrective actions. Although FDIC made substantial improvements to its information system controls, unresolved and newly identified weaknesses could limit its ability to effectively protect the confidentiality, integrity, and availability of its financial and sensitive information and information systems. Specifically, we identified new weaknesses in controls related to (1) e-mail security, (2) physical security, and (3) configuration management. Although these control weaknesses do not pose significant risks of misstatement to the financial reports, they do increase the risk to FDIC’s financial and sensitive systems and information and increase the risk of unauthorized modification of data and programs, inappropriate disclosure of sensitive information, or disruption of critical operations. E-mail is perhaps the most popular system for exchanging business information over the Internet or any other computer network. Because the computing and networking technologies that underlie e-mail are widespread and well-known, attackers are able to develop attack methods to exploit security weaknesses. E-mail messages can be secured in various ways including the use of digital signatures. Digital signatures can be used to ensure the integrity of an e-mail message and confirm the identity of its sender. National Institute of Standards and Technology (NIST) guidance recommends that organizations consider the implementation of secure e- mail technologies such as digital signatures to ensure the integrity of e- mail data.