Information security is a critical consideration for any organization that depends on information systems and computer networks to carry out its mission or business and is especially important for government agencies, where maintaining the public’s trust is essential. While the dramatic expansion in computer interconnectivity and the rapid increase in the use of the Internet have enabled agencies such as SEC to better accomplish their missions and provide information to the public, agencies’ reliance on this technology also exposes federal networks and systems to various threats. This can include threats originating from foreign nation states, domestic criminals, hackers, and disgruntled employees. Concerns about these threats are well founded because of the dramatic increase in reports of security incidents, the ease of obtaining and using hacking tools, and advances in the sophistication and effectiveness of attack technology, among other reasons. Without proper safeguards, systems are vulnerable to individuals and groups with malicious intent who can intrude and use their access to obtain or manipulate sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. We and federal inspectors general have reported on persistent information security weaknesses that place federal agencies at risk of destruction, fraud, or inappropriate disclosure of sensitive information. Accordingly, since 1997, we have designated federal information security as a government-wide high-risk area, and in 2003 expanded this area to include computerized systems supporting the nation’s critical infrastructure. Most recently, in the February 2015 update to our high-risk list, we further expanded this area to include protecting the privacy of personally identifiable information (PII)—that is, personal information that is collected, maintained, and shared by both federal and nonfederal entities. The Federal Information Security Modernization Act (FISMA) of 2014 is intended to provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. FISMA requires each agency to develop, document, and implement an agency-wide security program to provide security for the information and systems that support the operations and assets of the agency, including information and information systems provided or managed by another agency, contractor, or other source. Additionally, FISMA assigns responsibility to the National Institute of Standards and Technology (NIST) to provide standards and guidelines to agencies on information security. NIST has issued related standards and guidelines, including Recommended Security Controls for Federal Information Systems and Organizations, NIST Special Publication (NIST SP) 800-53, and Contingency Planning Guide for Federal Information Systems, NIST SP 800-34. To support its financial operations and store the sensitive information it collects, SEC relies extensively on computerized systems interconnected by local and wide-area networks. For example, to process and track financial transactions, such as filing fees paid by corporations or disgorgements and penalties from enforcement activities, and for financial reporting, SEC relies on numerous enterprise applications, including the following: Various modules in Delphi-Prism, a federal financial management system provided by the Department of Transportation’s Federal Aviation Administration’s Enterprise Service Center, are used by SEC for financial accounting, analyses, and reporting. Delphi-Prism produces SEC’s financial statements. The Electronic Data Gathering, Analysis, and Retrieval (EDGAR) system performs the automated collection, validation, indexing, acceptance, and forwarding of submissions by companies and others that are required to file certain information with SEC. Its purpose is to accelerate the receipt, acceptance, dissemination, and analysis of time-sensitive corporate information filed with the commission. EDGAR/Fee Momentum, a subsystem of EDGAR, maintains accounting information pertaining to fees received from registrants. End User Computing Spreadsheets and/or User Developed Applications are used by SEC to prepare, analyze, summarize, and report on its financial data. FedInvest invests funds related to disgorgements and penalties. Federal Personnel and Payroll System/Quicktime processes personnel and payroll transactions. The SEC’s general support system provides (1) business application services to internal and external customers and (2) security services necessary to support these applications. Under FISMA, the SEC Chairman has responsibility for, among other things, (1) providing information security protections commensurate with the risk and magnitude of harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the agency’s information systems and information; (2) ensuring that senior agency officials provide information security for the information and information systems that support the operations and assets under their control; and (3) delegating to the agency chief information officer (CIO) the authority to ensure compliance with the requirements imposed on the agency. FISMA further requires the CIO to designate a senior agency information security officer who will carry out the CIO’s information security responsibilities. SEC had implemented and made progress in strengthening information security controls, including implementing access controls, deploying multiple firewalls, establishing monitoring and logging capabilities, and resolving five weaknesses that we had previously identified. However, weaknesses limited the effectiveness of other controls in protecting the confidentiality, integrity, and availability of SEC’s information systems. Specifically, SEC did not consistently control logical and physical access to its network, servers, applications, and databases; manage its configuration settings; segregate duties; or update its contingency plan. These weaknesses existed, in part, because SEC did not effectively implement key elements of its information security program, including keeping up-to-date policies and procedures, completely documenting plans of actions and milestones (POA&M) for control weakness remediation, establishing and maintaining configuration settings, and monitoring configuration settings for compliance with standards. Consequently, SEC’s financial information and systems were exposed to increased risk of unauthorized disclosure, modification, and destruction. A basic management objective for any organization is to protect the resources that support its critical operations and assets from unauthorized access. Organizations accomplish this by designing and implementing controls that are intended to prevent, limit, and detect unauthorized access to computer resources (e.g., data, programs, equipment, and facilities), thereby protecting them from unauthorized disclosure, modification, and destruction. Specific access controls include boundary protection, identification and authentication of users, authorization restrictions, audit and monitoring capability, configuration management, separation of duties, and physical security. Without adequate access controls, unauthorized individuals, including intruders and former employees, can surreptitiously read and copy sensitive data and make undetected changes or deletions for malicious purposes or for personal gain. In addition, authorized users could intentionally or unintentionally modify or delete data or execute changes that are outside of their span of authority. Although SEC had issued policies and implemented controls based on those policies, it did not consistently protect its network from possible intrusions, identify and authenticate users, authorize access to resources, audit and monitor actions taken on its systems and network, and restrict physical access to sensitive assets. Boundary protection controls (1) logical connectivity into and out of networks and (2) connectivity to and from network-connected devices. Implementing multiple layers of security to protect an information system’s internal and external boundaries provides defense-in-depth. By using a defense-in-depth strategy, entities can reduce the risk of a successful cyber attack. For example, multiple firewalls could be deployed to prevent both outsiders and trusted insiders from gaining unauthorized access to systems. At the host or device level, logical boundaries can be controlled through inbound and outbound filtering provided by access control lists and personal firewalls. At the system level, any connections to the Internet, or to other external and internal networks or information systems, should occur through controlled interfaces. To be effective, remote access controls should be properly implemented in accordance with authorizations that have been granted. SEC deployed multiple firewalls that were intended to prevent unauthorized access to its systems; however, it did not always restrict traffic passing through its firewalls. For example, SEC did not always configure access control lists to restrict potentially insecure traffic or ports on each of the six internal firewalls reviewed, subjecting the hosts to potentially vulnerable services. Also, SEC did not apply host firewall configuration rules on three of four hosts. As a result of these inadequate configurations, SEC introduced vulnerability to potentially unnecessary and undetectable access at multiple points in its network environment. Information systems need to be managed to effectively control user accounts and identify and authenticate users. Users and devices should be appropriately identified and authenticated through the implementation of adequate logical access controls. Users can be authenticated using mechanisms such as a password and smart card combination. SEC policy requires enforcement of minimum password complexity and password expiration. In addition, SEC policy requires that multifactor authentication be implemented for network and local access to privileged and non-privileged accounts. However, SEC did not fully implement controls for identifying and authenticating users. For example, it did not always enforce individual accountability, as 20 different users used the same password on multiple servers in the production, development and testing environments. Also, SEC configured the password for a key financial server to never expire. Additionally, while SEC implemented multifactor authentication for remote access, it did not require multifactor authentication for network or console access managed by the agency’s security group. As a result, SEC is at an increased risk that accounts could be compromised and used by unauthorized individuals to access sensitive financial data. Authorization encompasses access privileges granted to a user, program, or process. It involves allowing or preventing actions by that user based on predefined rules. Authorization includes the principles of legitimate use and least privilege. Access rights and privileges are used to implement security policies that determine what a user can do after being allowed into the system. Maintaining access rights, permissions, and privileges is one of the most important aspects of administering system security. SEC policy states that information system owners shall explicitly authorize access to configuration settings, file permissions, and privileges. SEC policy also states that information systems must prevent non‐privileged users from executing privileged functions, including disabling, circumventing, or altering implemented security safeguards or countermeasures.