Following the stock market crash of 1929, Congress passed the Securities Exchange Act of 1934, which established the SEC to enforce securities laws, to regulate the securities markets, and to protect investors. In enforcing these laws, the SEC issues rules and regulations to provide protection for investors and to help ensure that the securities markets are fair and honest. This is accomplished primarily by promoting adequate and effective disclosure of information to the investing public. The SEC also oversees and requires the registration of other key participants in the securities industry, including stock exchanges, broker-dealers, clearing agencies, depositories, transfer agents, investment companies, and public utility holding companies. The SEC is an independent, quasi-judicial agency that operates under a bipartisan commission appointed by the President and confirmed by the Senate. SEC had a budget of about $800 million and staff of 4,100 to monitor and regulate the securities industry in fiscal year 2004. In 2003, the volume traded on U.S. exchanges and NASDAQ exceeded $22 trillion and 850 billion shares. Each year the commission accepts, processes, and disseminates to the public more than 600,000 documents from companies and individuals that are filed with the SEC, including annual reports from more than 12,000 reporting companies. SEC relies extensively on computerized systems to support its financial operations and store the sensitive information it collects. Its local and wide area networks interconnect these systems. To support the commission’s financial management functions, it relies on several financial systems to process and track financial transactions that include filing fees paid by corporations and penalties from enforcement activities. In fiscal year 2004, the SEC collected $389 million for filing fees and $948 million in penalties and disgorgements. In addition, the commission uses other systems that maintain sensitive personnel information for its employees, filing data for corporations, and legal information on enforcement activities. The commission’s Chief Information Officer (CIO) is SEC’s key official for information security. The CIO is responsible for establishing, implementing, and overseeing the commission’s information security program. Information system controls are a critical consideration for any organization that depends on computerized systems and networks to carry out its mission or business. Without proper safeguards, there is risk that individuals and groups with malicious intent may intrude into inadequately protected systems and use this access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. We have reported information security as a governmentwide high-risk area since February 1997. Our previous reports, and those of agency inspectors general, describe persistent information security weaknesses that place a variety of federal operations at risk of disruption, fraud, and inappropriate disclosure. Congress and the executive branch have taken actions to address the risks associated with persistent information security weaknesses. In December 2002, the Federal Information Security Management Act (FISMA), which is intended to strengthen information security, was enacted as Title III of the E-Government Act of 2002. In addition, the administration undertook important actions to improve security, such as integrating information security into the President’s Management Agenda Scorecard. Moreover, the Office of Management and Budget (OMB) and the National Institute of Standards and Technology (NIST) have issued security guidance to agencies. The objective of our review was to assess the effectiveness of SEC’s information system controls in protecting its financial and sensitive information. Our evaluation was based on (1) our Federal Information System Controls Audit Manual, which contains guidance for reviewing information system controls that affect the integrity, confidentiality, and availability of computerized data and (2) our May 1998 report on security management best practices at leading organizations, which identifies key elements of an effective information security management program. Specifically, we evaluated SEC’s information system controls intended to prevent, limit, and detect electronic access to computer resources (data, programs, and systems), thereby protecting these resources against unauthorized disclosure, modification, and use; provide physical protection of computer facilities and resources from espionage, sabotage, damage, and theft; ensure that work responsibilities for computer functions are segregated so that one individual does not perform or control all key aspects of a computer-related operation and, thereby, have the ability to conduct unauthorized actions or gain unauthorized access to assets or records without detection by another individual performing assigned responsibilities; prevent the implementation of unauthorized changes to application or ensure the recovery of computer processing operations and data in case of disaster or other unexpected interruption; and ensure an adequate information security program. To evaluate these controls, we identified and reviewed pertinent SEC computer security policies, procedures, guidance, plans, and reports. We also discussed with key security representatives, system administrators, and management officials whether information system controls were in place, adequately designed, and operating effectively. In addition, we conducted tests and observations of controls in operation. SEC did not effectively implement information system controls to protect the integrity, confidentiality, and availability of its financial and sensitive information. Specifically, the commission did not consistently implement effective electronic access controls, including user account and passwords, access rights and permissions, network security, and audit and monitoring of security-relevant events to prevent, limit, and detect access to its critical financial and sensitive systems. In addition, weaknesses in other information system controls, including physical security, segregation of computer functions, application change controls, and service continuity, further increase the risk to SEC’s information systems. As a result, sensitive data—including payroll and financial transactions, personnel data, regulatory, and other mission critical information—are at increased risk of unauthorized disclosure, modification, or loss, possibly without being detected. A basic management control objective for any organization is the protection of its information systems and critical data from unauthorized access. Organizations accomplish this objective by designing and implementing controls to prevent, limit, and detect electronic access to computing resources. These controls include user accounts and passwords, access rights and permissions, network security, and audit and monitoring of security-related events. Inadequate electronic access controls diminish the reliability of computerized data and increase the risk of unauthorized disclosure, modification, and use of data. SEC did not consistently implement effective electronic access controls to prevent, limit, and detect access to financial and sensitive data. Numerous vulnerabilities existed in SEC’s computing environment because of the cumulative effects of information system control weaknesses in the area of user accounts and passwords, access rights and permissions, network security, and audit and monitoring of security-relevant events. For example, our testers found a workstation located in an area of an SEC building readily accessible by the general public that was logged into the SEC computer network. With access from this workstation, a potential attacker would have direct access to the SEC’s internal network and could have exploited other vulnerabilities, such as easy-to-guess passwords, vulnerable servers, and insecurely configured system servers to gain access to critical systems that maintain the commission’s financial and regulatory information. Also, because of weaknesses in system audit logs and the lack of a fully implemented intrusion detection system, the likelihood of detection would have been remote. Prior to the completion of our review, SEC completed actions to remediate this access vulnerability. Weaknesses in the specific control areas are summarized here. A computer system must be able to identify and differentiate among users so that activities on the system can be linked to specific individuals. Unique user accounts assigned to specific users allow systems to distinguish one user from another, a process called identification. The system must also establish the validity of a user’s claimed identity through some means of authentication, such as a password, known only to its owner. The combination of identification and authentication, such as user account/password combinations, provides the basis for establishing individual accountability and controlling access to the system. Accordingly, agencies should (1) implement procedures to control the creation, use, and removal of user accounts and (2) establish password parameters, such as length, life, and composition, to strengthen the effectiveness of account/password combinations for authenticating the identity of users. SEC did not sufficiently control user accounts and passwords to ensure that only authorized individuals were granted access to its systems and data. For example, SEC operating personnel did not consistently configure password parameters securely, and users sometimes created easy-to-guess passwords. User accounts and passwords for privileged network and database administrator accounts were inappropriately stored in clear text, increasing the likelihood of their disclosure and unauthorized use to gain access to server resources. Moreover, SEC did not remove system access from certain separated employees, including one terminated employee who still had access to SEC’s information systems 8 months after termination. These practices increase the risk that individuals might gain unauthorized access to SEC resources without attribution. A basic underlying principle for securing computer systems and data is the concept of least privilege. This means that users are granted only those access rights and permissions needed to perform their official duties. Organizations establish access rights and permissions to restrict the access of legitimate users to the specific programs and files that they need to do their work. User rights are allowable actions that can be assigned to users or groups. File and directory permissions are rules associated with a file or directory that regulate which users can access them and in what manner. Assignment of rights and permissions must be carefully considered to avoid giving users unintentional and unnecessary access to sensitive files and directories. SEC routinely permitted excessive access to the computer systems that support its critical financial and regulatory information and to certain key files and directories. For example, on certain network systems, users and administrators had access that would allow them to bypass security settings or change security parameters and audit logs. All 4,100 network users were inadvertently granted access that would allow them to circumvent the audit controls in the commission’s main financial systems. Further, on certain systems, users had access to system files and directories that would allow them to gain unauthorized access to the system, thereby enabling them to compromise key servers or disrupt operations. In addition, contractor staff did not follow SEC policy for obtaining remote access and instead granted themselves access to key financial systems without SEC approval.