Information security is a critical consideration for any organization that depends on information systems and computer networks to carry out its mission or business and is especially important for government agencies, where maintaining the public’s trust is essential. While the dramatic expansion in computer interconnectivity and the rapid increase in the use of the Internet have enabled corporations such as FDIC to better achieve its mission and provide information to the public, the changes also expose federal networks and systems to various threats. For example, the Federal Bureau of Investigation has identified multiple sources of cyber threats, including foreign nation states engaged in information warfare, domestic criminals, hackers, virus writers, and disgruntled employees working within an organization. According to a May 2005 report by the U.S. Secret Service and the Computer Emergency Response Team (CERT) Coordination Center, “insiders pose a substantial threat by virtue of their knowledge of, and access to, employer systems and/or databases.” These concerns are well-founded for a number of reasons, including the dramatic increase in reports of security incidents, the ease of obtaining and using hacking tools, and steady advances in the sophistication and effectiveness of attack technology. For example, the number of incidents reported by federal agencies to the United States Computer Emergency Readiness Team (US-CERT) has increased dramatically over the past 3 years, increasing from 3,634 incidents reported in fiscal year 2005 to 13,029 incidents in fiscal year 2007 (about a 259 percent increase). Without proper safeguards, systems are vulnerable to individuals and groups with malicious intent who can intrude and use their access to obtain or manipulate sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. Our previous reports, and those by inspectors general, describe persistent information security weaknesses that place federal agencies at risk of disruption, fraud, or inappropriate disclosure of sensitive information. Accordingly, we have designated information security as a governmentwide high-risk area since 1997, a designation that remains in force today. Recognizing the importance of securing federal agencies’ information systems, Congress enacted the Federal Information Security Management Act (FISMA) in December 2002 to strengthen the security of information and systems within federal agencies. FISMA requires each agency to develop, document, and implement an agencywide information security program to provide information security for the information and systems that support the operations and assets of the agency, using a risk- based approach to information security management. FDIC is an independent agency created by Congress that maintains the stability and public confidence in the nation’s financial system by insuring deposits, examining and supervising financial institutions, and managing receiverships. Congress created FDIC in 1933 in response to the thousands of bank failures that occurred in the 1920s and early 1930s. The corporation identifies, monitors, and addresses risks to the deposit insurance funds when a bank or thrift institution fails. The Bank Insurance Fund and the Savings Association Insurance Fund were established as FDIC responsibilities under the Financial Institutions Reform, Recovery, and Enforcement Act of 1989, which sought to reform, recapitalize, and consolidate the federal deposit insurance system. The act also designated FDIC as the administrator of the Federal Savings & Loan Insurance Corporation Resolution Fund, which was created to complete the affairs of the former Federal Savings & Loan Insurance Corporation and liquidate the assets and liabilities transferred from the former Resolution Trust Corporation. The Bank Insurance Fund and the Savings Association Insurance Fund merged into the Deposit Insurance Fund on February 8, 2006, as a result of the President signing the Federal Deposit Insurance Reform Act of 2005 into law. With the congressional approval of the Federal Deposit Insurance Reform Act of 2005, FDIC was required to ensure that approximately 7,400 eligible member institutions received a one-time assessment credit totaling $4.7 billion. FDIC insures deposits in excess of $4 trillion for its 8,571 member institutions. It had a budget of about $1.1 billion for calendar year 2007 to support its activities in managing the funds. For that year, it processed almost 16.4 million financial transactions. FDIC relies extensively on computerized systems to support its financial operations and store the sensitive information that it collects. Its local and wide area networks interconnect these systems. To support its financial management functions, the corporation relies on many systems including the NFE, a corporate-wide effort focused on implementing an enterprisewide, integrated software system. In addition, the corporation relies on the AIMS II to calculate and collect FDIC deposit insurance premiums and Financing Corporation bond principal and interest amounts from insured financial institutions. FDIC financial systems also process and track financial transactions such as disbursements made to support operations. Under FISMA, the Chairman is responsible for, among other things, (1) providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the agency’s information systems and information; (2) ensuring that senior agency officials provide information security for the information and information systems that support the operations and assets under their control; and (3) delegating to the corporation’s CIO the authority to ensure compliance with the requirements imposed on the agency under FISMA. Two deputies to the Chairman—the Chief Financial Officer and Chief Operating Officer—have information security responsibilities. The Chief Financial Officer has information security responsibilities insofar as he is part of a senior management group that oversees the NFE and AIMS II security team. He is also responsible for the preparation of financial statements and ensures that they are fairly presented and demonstrate discipline and accountability. In addition, the Chief Operating Officer has information security responsibilities. He supervises the CIO, who is responsible for developing and maintaining a corporate-wide information security program and for developing and maintaining information security policies, procedures, and control techniques that address all applicable requirements. The CIO also serves as the authorizing official with the authority to approve the operation of the information system at an acceptable level of risk to the enterprise. The CIO supervises the Chief Information Security Officer, who is in charge of information security at the corporation. The Chief Information Security Officer serves as the CIO’s designated representative responsible for the overall support of the certification and accreditation activities. FDIC has made significant progress in mitigating previously reported information security weaknesses. Specifically, it has corrected or mitigated 16 of the 21 weaknesses that we had previously reported as unresolved at the completion of the 2006 audit (see app. II). For example, FDIC has enhanced physical security controls, instructed personnel to use more secure e-mail methods to protect the integrity of certain accounting data transferred over an internal communication network, updated the NFE security plan to clearly identify all common security controls, developed procedures to report computer security incidents, and updated the NFE contingency plan. While the corporation has made significant progress in resolving known weaknesses, it has not completed actions to mitigate the remaining five weaknesses. Specifically FDIC has not effectively generated NFE audit reports; maintained a complete listing of all NFE configuration items, including application software, data files, software development tools, hardware, and documentation; properly segregated incompatible system-related functions, duties, and capacities for an individual associated with the NFE; effectively implemented or accurately reported the status of its remedial properly updated the NFE risk assessment. FDIC stated it has initiated and completed some actions to mitigate the remaining five prior year weaknesses. However, we have not verified that these actions have been completed. Not addressing these actions could leave the corporation’s financial data vulnerable to an increased risk of unauthorized access and manipulation. Appendix II describes the previously reported weaknesses in information security controls that were unresolved at the time of our prior review and the status of the corporation’s corrective actions. Although FDIC has made significant progress improving its information system controls, old and new weaknesses could limit the corporation’s ability to effectively protect the confidentiality, integrity, and availability of its financial systems and information. In addition to the five previously reported weaknesses that remain unresolved, newly identified weaknesses in access controls and configuration management controls introduce risk to two key financial systems. A key reason for these weaknesses is that FDIC did not always fully implement key information security program activities. As a result, increased risk exists of unauthorized disclosure or modification of financial information. A basic management objective for any organization is to protect the resources that support its critical operations and assets from unauthorized access. Organizations accomplish this objective by designing and implementing controls that are intended to prevent, limit, and detect unauthorized access to computer resources (data, programs, equipment, and facilities), thereby protecting them from unauthorized disclosure, modification, and loss. FDIC developed policies and procedures on access control which, among other things, stated that login ID and password combinations should not be shared, access to application source code should be restricted unless users have a legitimate business need for access, and passwords should be adequately encrypted. However, FDIC did not always implement certain access controls, as the following examples show: Multiple FDIC users in a production control unit in one division and multiple users in another division share the same NFE logon ID and password. As a result, increased risk exists that individual accountability for authorized, as well as unauthorized system activity could be lost. All users of the AIMS II application have full access to the application production code although their job responsibilities do not require such access. As a result, increased risk exists that individuals could circumvent security controls and deliberately or inadvertently read, modify, or delete critical source code. One database connection could be compromised because the password is not adequately encrypted with a Federal Information Processing Standards 140-2 compliant algorithm. As a result, increased risk exists that the database could be compromised by unauthorized individuals who could then potentially change, add, or delete information. Our Federal Information System Controls Audit Manual states that configuration management involves the identification and management of security features for all hardware and software components of an information system at a given point and systematically controls changes to that configuration during the system’s life cycle.