Congress created FDIC in 1933 to restore and maintain public confidence in the nation’s banking system. The Financial Institutions Reform, Recovery, and Enforcement Act of 1989 sought to reform, recapitalize, and consolidate the federal deposit insurance system. The act created the Bank Insurance Fund and the Savings Association Insurance Fund, both of which are responsible for protecting insured bank and thrift depositors. The act also abolished the FSLIC and created the FSLIC Resolution Fund to complete the affairs of the former FSLIC and liquidate the assets and liabilities transferred from the former Resolution Trust Corporation. It also designated FDIC as the administrator of these funds. As part of this function, FDIC has an examination and supervision program to monitor the safety of deposits held in member institutions. FDIC insures deposits in excess of $10 trillion for about 8,900 institutions. Together, the three funds—the Bank Insurance Fund, the Savings Association Insurance Fund, and the FSLIC Resolution Fund—have about $52 billion in assets. FDIC had a budget of about $1.1 billion for calendar year 2004 to support its activities in managing the three funds. For that year, it processed more than 3.8 million financial transactions. FDIC relies extensively on computerized systems to support its financial operations and store the sensitive information it collects. Its local and wide area networks interconnect these systems. To support its financial management functions, it relies on several financial systems to process and track financial transactions that include premiums paid by its member institutions and disbursements made to support operations. In addition, FDIC uses other systems that maintain personnel information for its employees, examination data for financial institutions, and legal information on closed institutions. At the time of our review, about 6,200 individuals were authorized to use FDIC’s systems. The corporation’s key official for computer security is the Chief Information Officer, who is responsible for establishing, implementing, and overseeing a corporatewide information security program. Information system controls are a critical consideration for any organization that depends on computerized systems and networks to carry out its mission or business. Without proper safeguards, there is risk that individuals and groups with malicious intent may intrude into inadequately protected systems and use this access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. We have reported information security as a governmentwide high-risk area since February 1997. Our previous reports, and those of agency inspectors general, describe persistent information security weaknesses that place a variety of federal operations, including those at FDIC, at risk of disruption, fraud, and inappropriate disclosure. Congress and the executive branch have taken action to address the risks associated with persistent information security weaknesses. In December 2002, the Federal Information Security Management Act (FISMA) of 2002, which is intended to strengthen information security, was enacted as Title III of the E-Government Act of 2002. In addition, the administration undertook important actions to improve security, such as integrating information security into the President’s Management Agenda Scorecard. Moreover, the Office of Management and Budget and the National Institute of Standards and Technology (NIST) have issued information security guidance to agencies. The objectives of our review were to assess (1) the progress FDIC had made in correcting or mitigating weaknesses reported in connection with our financial statement audits for calendar years 2002 and 2003 and (2) the effectiveness of the corporation’s information system controls. Our evaluation was based on (1) our Federal Information System Controls Audit Manual (FISCAM), which contains guidance for reviewing information system controls that affect the integrity, confidentiality, and availability of computerized data and (2) our May 1998 report on security management best practices at leading organizations, which identifies key elements of an effective information security program. Specifically, we evaluated information system controls intended to prevent, limit, and detect electronic access to computer resources (data, programs, and systems), thereby protecting these resources against unauthorized disclosure, modification, and use; provide physical protection of computer facilities and resources from espionage, sabotage, damage, and theft; ensure that work responsibilities for computer functions are segregated so that no one individual controls all key aspects of a computer-related operation and thereby has the ability to conduct unauthorized actions or gain unauthorized access to assets or records without detection by another individual performing assigned responsibilities; prevent the implementation of unauthorized changes to application or ensure recovery of computer process operations and data in case of disaster or other unexpected interruption; and ensure an adequate information security program. To evaluate these controls, we identified and reviewed pertinent FDIC security policies and procedures, guidance, plans, and reports. We also discussed whether information system controls were in place, adequately designed, and operating effectively with key security representatives, system administrators, and management officials. In addition, we conducted tests and observations of controls in operation and reviewed corrective actions taken by the corporation to address vulnerabilities identified in our audits for calendar years 2002 and 2003. FDIC has made significant progress in correcting previously reported information system control weaknesses. Of the 22 weaknesses reported in our 2003 audit, FDIC corrected 19 and is taking action to resolve the 3 that remain. In addition, the corporation corrected the one weakness still open from our 2002 audit. FDIC’s actions included resolving weaknesses related to its key access controls, network security, and monitoring capabilities. For example, the corporation restricted user access to critical financial and sensitive data and strengthened security configurations of network devices, including firewalls, routers, switches, and servers; and enhanced its monitoring of security-relevant events by fully implementing its intrusion detection system to monitor its computer network traffic for unusual or suspicious access activities. In addition to addressing previously reported weaknesses, FDIC took other steps to improve information security. For example, the corporation strengthened its oversight of contractor connections to its network by requiring contractors to develop security plans to protect these connections and to perform periodic inspections of contractor facilities to ensure security effectiveness. Further, FDIC established certification and accreditation guidelines that outline requirements for performing this process as part of each system’s life cycle and certified and accredited each of its key systems. In addition, the corporation updated its disaster recovery procedures and has been routinely performing different types of tests of its disaster recovery plan. Although FDIC made substantial improvements in its information system controls, we identified 20 additional weaknesses that diminish its ability to effectively protect the integrity, confidentiality, and availability of its financial and sensitive information and information systems. Specifically, we identified weaknesses in electronic access controls, network security, physical security, segregation of computer functions, and application change controls. Although these information system control weaknesses do not pose significant risks to FDIC’s financial and sensitive systems, they warrant management’s action to decrease the risk of unauthorized modification of data and programs, inappropriate disclosure of sensitive information, or disruption of critical operations. A basic management control objective for any organization is the protection of its information systems and critical data from unauthorized access. Organizations accomplish this objective by granting employees the authority to read, create, or modify only those programs and data that they need to perform their duties. Effective electronic access controls should be designed to restrict access to computer programs and data and detect unauthorized access. These controls include assigning user access rights and permissions and reviewing audit logs to ensure that access privileges are used appropriately. Although FDIC restricted access to programs and information, we found instances in which access was not sufficiently controlled. For example, about 250 users were inadvertently granted access to read, create, or modify critical production programs and data for financial, payroll/personnel, and bank regulatory systems. The risk of weakening security access was further heightened because the access activities of these users were not being logged for review. In addition, emergency access accounts with broad system access to all critical system and security resources intended to be used solely to manage problems or emergencies that interrupt the system’s 24-hour-a-day operation were routinely used by four system and operations staff. Further, FDIC did not configure security software to appropriately restrict, log, and monitor access to certain sensitive system software libraries. As a result, increased risk exists that individuals could circumvent security controls to read, create, or modify critical or sensitive programs and data, possibly without detection. In response to these weaknesses, FDIC’s Chief Information Officer said that they have taken steps to restrict access to critical financial data and program and related sensitive information. Further, the corporation stated that it has restricted access to sensitive system software libraries and plans to generate monthly audit reports for review and follow-up action as needed. Networks are a series of interconnected devices and software that allow individuals to share data and computer programs. Because sensitive programs and data are stored on network servers or transmitted along networks, effectively securing networks is essential to protecting computing resources and data from unauthorized access, manipulation, and use. Organizations secure their networks, in part, by installing and configuring network devices that permit authorized network service requests and deny unauthorized requests and by limiting the services that are available on the network. Network devices include (1) firewalls designed to prevent unauthorized access to and from the network, (2) routers that filter and forward data along the network, (3) switches that forward information among parts of a network, and (4) servers that host applications and data. Network services consist of protocols for transmitting data between network devices. In addition, effective network controls, such as passwords, should be established to authenticate authorized users who access the network from local and remote locations. Since networks often provide the entry point for access to electronic information assets, failure to secure them increases the risk of unauthorized use of sensitive data and systems. Although FDIC’s network controls were generally effective, we identified instances where FDIC did not adequately secure specific network services and devices or protect passwords. For example, database server configurations for some of the corporation’s financial applications were not adequately secured. These servers had insecure settings that could have allowed an unauthorized user to gain access without providing authentication. In addition, FDIC did not have controls in place to consistently ensure that data transmitted between network devices were secure.