Information security is a critical consideration for any organization that depends on information systems and computer networks to carry out its mission or business and is especially important for government agencies, where maintaining the public’s trust is essential. While the dramatic expansion in computer interconnectivity and the rapid increase in the use of the Internet have enabled agencies such as SEC to better achieve their mission and provide information to the public, the changes also expose federal networks and systems to various threats. For example, the Federal Bureau of Investigation has identified multiple sources of cyber threats, including foreign nation states engaged in information warfare, domestic criminals, hackers, and virus writers, and disgruntled employees working within an organization. Similarly, the U.S. Secret Service and the Computer Emergency Readiness Team (CERT) Coordination Center conducted a study on insider threats and stated in a May 2005 report that “insiders pose a substantial threat by virtue of their knowledge of, and access to, employer systems and/or databases.” These concerns are well-founded for a number of reasons, including the dramatic increase in reports of security incidents, the ease of obtaining and using hacking tools, and steady advances in the sophistication and effectiveness of attack technology. For example, for fiscal year 2006, the Office of Management and Budget (OMB) cited a total of 5,146 incidents reported by federal agencies to the United States Computer Emergency Readiness Team (US- CERT), an increase of 44 percent from the previous fiscal year. Without proper safeguards, systems are vulnerable to individuals and groups with malicious intent who can intrude and use their access to obtain or manipulate sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. Our previous reports and reports by inspectors general describe persistent information security weaknesses that place federal agencies at risk of disruption, fraud, or inappropriate disclosure of sensitive information. Accordingly, we have designated information security as a governmentwide high-risk area since 1997, a designation that remains in force today. Recognizing the importance of securing federal agencies’ information systems, Congress enacted the Federal Information Security Management Act (FISMA) in December 2002 to strengthen the security of information and systems within federal agencies. FISMA requires each agency to develop, document, and implement an agencywide information security program to provide information security for the information and systems that support the operations and assets of the agency, using a risk- based approach to information security management. Following the stock market crash of 1929, Congress passed the Securities Exchange Act of 1934, establishing the SEC to enforce securities laws, regulate the securities markets, and protect investors. To carry out its responsibilities and help ensure that securities markets are fair and honest, SEC issues rules and regulations that promote adequate and effective disclosure of information to the investing public. The commission also oversees and requires the registration of other key participants in the securities industry, including stock exchanges, broker-dealers, clearing agencies, depositories, transfer agents, investment companies, and public utility holding companies. SEC is an independent, quasi-judicial agency that operates at the direction of five commissioners appointed by the President and confirmed by the Senate. In fiscal year 2007, SEC had a budget of about $882 million and a staff of 3,470. In fiscal year 2007, the commission collected $258 million in filing fees and $496 million in penalties and disgorgements. To support its financial operations and store the sensitive information it collects, SEC relies extensively on computerized systems interconnected by local-and wide-area networks. For example, to process and track financial transactions, such as filing fees paid by corporations, disgorgements and penalties from enforcement activities, and procurement activities, SEC relies on several enterprise database applications—Momentum; CATS/Phoenix; Electronic Data Gathering, Analysis, and Retrieval (EDGAR); Strategic Acquisition Manager (SAM)— and a general support system (GSS) network that allows users to communicate with the database applications. The database applications provide SEC with the following capabilities: Momentum is used to record some of the commission’s accounting transactions, to maintain its general ledger, and to maintain some of the information SEC uses to produce financial reports. CATS/Phoenix contains and processes sensitive data relating to penalties, disgorgements, and restitution on proven and alleged violations of the securities and futures laws. EDGAR performs automated collection, validation, indexing, acceptance, and forwarding of submissions by companies and others who are required to file certain information with SEC. Its primary purpose is to increase the efficiency and fairness of the securities market for the benefit of investors, corporations, and the economy by accelerating the receipt, acceptance, dissemination, and analysis of time-sensitive corporate information filed with the agency. SAM is intended to automate procurement processes for the SEC Procurement and Contracting office. The GSS is an integrated client-server system comprised of local- and wide-area networks and is organized into distinct subsystems based along SEC’s organizational and functional lines. The GSS provides services to internal and external customers who use them for their business applications. It also provides the necessary security services to support these applications. According to FISMA, the Chairman of SEC has responsibility for, among other things, (1) providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the agency’s information systems and information; (2) ensuring that senior agency officials provide information security for the information and information systems that support the operations and assets under their control; and (3) delegating to the agency chief information officer (CIO) the authority to ensure compliance with the requirements imposed on the agency under FISMA. SEC’s CIO is responsible for developing and maintaining a departmentwide information security program and for developing and maintaining information security policies, procedures, and control techniques that address all applicable requirements. SEC has corrected or mitigated 8 of the 20 security control weaknesses that we had reported as unresolved at the time of our previous audit. For example, SEC has documented authorizations for software modifications, developed a comprehensive program for monitoring access activities to its computer network environment, and tested and evaluated the effectiveness of controls for the general ledger system. In addition, SEC has made progress in improving its information security program. For example, the commission has developed and documented information security related policies, including those responding to information security incidents, such as unauthorized access. SEC has also developed remedial action plans to mitigate identified weaknesses in its systems and developed a mechanism to track the progress of the actions taken to correct deficiencies. The commission also has tested disaster recovery plans two times a year through a series of disaster recovery exercises covering major applications and various scenarios. These efforts constitute an important step towards strengthening the agencywide information security program mandated by FISMA. A key reason for its progress in these areas is that SEC senior management has been actively engaged in mitigating the previously reported weaknesses. For example, the Chairman has received regular briefings on SEC’s progress in resolving the previously reported weaknesses, and the CIO has coordinated efforts with other offices involved in implementing information security controls and practices at the commission. While SEC has made important progress in strengthening its information security controls, it has not completed actions to correct or mitigate 12 previously reported weaknesses. For example, SEC has not mitigated weaknesses that could lead to malicious code attacks on SEC’s workstations, has not adequately documented access privileges for the EDGAR application, and has not implemented an effective intrusion detection system. In addition, SEC has not adequately controlled access to its facility. Failure to resolve these issues could leave SEC’s sensitive data vulnerable to unauthorized disclosure, modification, or destruction. Controls intended to restrict access to data and systems, as well as in other information security controls, insufficiently protect the confidentiality, integrity, and availability of SEC financial systems and information. The unresolved, previously reported weaknesses and newly identified weaknesses could hinder SEC’s ability to perform vital functions and increase the risk of unauthorized disclosure, modification, or destruction of financial information. A key reason for these weaknesses was that SEC did not always effectively implement key program activities of its information security program. A basic management objective for any organization is to protect the resources that support its critical operations and assets from unauthorized access. Organizations accomplish this objective by designing and implementing controls that are intended to prevent, limit, and detect unauthorized access to computer resources (e.g., data, programs, equipment, and facilities), thereby protecting them from unauthorized disclosure, modification, and loss. Specific access controls include identification and authentication, authorization, cryptography, audit and monitoring, and physical security. Without adequate access controls, unauthorized individuals, including outside intruders and former employees, can surreptitiously read and copy sensitive data and make undetected changes or deletions for malicious purposes or personal gain. In addition, authorized users can intentionally or unintentionally modify or delete data or execute changes that are outside of their span of authority. A computer system must be able to identify and authenticate the identity of users so that activities on the system can be linked to specific individuals. When an organization assigns unique user accounts to specific users, the system is able to distinguish one user from another—a process called identification. The system must also establish the validity of a user’s claimed identity by requesting some kind of information, such as a password, that is known only by the user—a process known as authentication. SEC policy requires the implementation of automated identification and authentication mechanisms that enable the unique identification of individual users. However, SEC did not consistently identify and authenticate the identity of users before granting them access to its enterprise database applications, as the following examples illustrate: SEC did not always enforce strong password settings on its enterprise database servers, which increased the likelihood that passwords could be compromised. Multiple individuals shared a single-user account to enter system information on a key SEC enterprise database application, which diminished SEC’s capability to attribute system activity to specific individuals.