Information security is a critical consideration for any organization that depends on information systems and computer networks to carry out its mission and is especially important for a government corporation such as FDIC, which oversees the financial institutions that are entrusted with safeguarding the public’s money. While the use of interconnected electronic information systems allows FDIC to accomplish its mission more quickly and effectively, their use also exposes FDIC’s information to the various internal and external threats that come with the use of such systems. Cyber-based threats to information systems and cyber-related critical infrastructure are evolving and growing and can affect FDIC information systems and computer networks. Threats that could adversely affect the systems and information relevant to FDIC’s operations associated with financial management and reporting can come from sources internal and external to the organization. Internal threats include mistakes by individuals, and fraudulent or malevolent acts by insiders. External threats include the ever-growing number of cyber-based attacks that can come from a variety of sources such as hackers, criminals, and foreign nations. These potential attackers have a variety of techniques at their disposal, which can vastly enhance the reach and impact of their actions. For example, cyber attackers do not need to be physically close to their targets, their attacks can easily cross state and national borders, and cyber attackers can readily preserve their anonymity. Further, the interconnectivity among information systems presents increasing opportunities for such attacks. Indeed, reports of security incidents from federal agencies are on the rise, increasing by more than 400 percent from fiscal year 2006 to fiscal year 2009. Specifically, the number of incidents reported by federal agencies to the United States Computer Emergency Readiness Team (US-CERT) has increased dramatically over the past 4 years: from 5,503 incidents reported in fiscal year 2006 to about 30,000 incidents in fiscal year 2009. Compounding the growing number and kinds of threats are the significant deficiencies in security controls on the information systems at federal agencies, which have resulted in vulnerabilities in both financial and nonfinancial systems and information. These deficiencies continue to place assets at risk of inadvertent or deliberate misuse, financial information at risk of unauthorized modification or destruction, and critical operations at risk of disruption. Accordingly, we have designated information security as a governmentwide high-risk area since 1997, a designation that remains in force today. Recognizing the importance of securing federal agencies’ information systems, Congress enacted the Federal Information Security Management Act (FISMA) in December 2002 to strengthen the security of information and systems within federal agencies. FISMA requires each agency to develop, document, and implement an agencywide information security program to provide information security for the information and systems that support the operations and assets of the entities, using a risk- based approach to information security management. FDIC was created by Congress to maintain the stability of and public confidence in the nation’s financial system by insuring deposits, examining and supervising financial institutions, and resolving troubled institutions. Congress created FDIC in 1933 in response to the thousands of bank failures that occurred in the 1920s and early 1930s. FDIC identifies, monitors, and addresses risks to the deposit insurance fund when a bank or thrift institution fails. The Bank Insurance Fund and the Savings Association Insurance Fund were established as FDIC responsibilities under the Financial Institutions Reform, Recovery, and Enforcement Act of 1989, which sought to reform, recapitalize, and consolidate the federal deposit insurance system. The act also designated FDIC as the administrator of the Federal Savings & Loan Insurance Corporation Resolution Fund, which was created to complete the affairs of the former Federal Savings & Loan Insurance Corporation and liquidate the assets and liabilities transferred from the former Resolution Trust Corporation. The Bank Insurance Fund and the Savings Association Insurance Fund merged into the Deposit Insurance Fund on February 8, 2006, as a result of the passage of the Federal Deposit Insurance Reform Act of 2005. FDIC relies extensively on computerized systems to support its mission, including financial operations, and to store the sensitive information that it collects. Its local and wide area networks interconnect these systems. To support its financial management functions, the corporation relies on many systems, including a corporatewide system that functions as a unified set of financial and payroll systems that are managed together and operated in an integrated fashion, a system to calculate and collect FDIC deposit insurance premiums and Financing Corporation bond principal and interest amounts from insured financial institutions; a Web-based application that provides full functionality to support franchise marketing, asset marketing, and asset management; a system to request access to and receive permission for the computer applications and resources available to its employees, contractors, and other authorized personnel; and a primary receivership and subsidiary financial processing and reporting system. FDIC financial systems process and track financial transactions such as disbursements made to support operations. FDIC protects its computerized systems using a layered approach to security defense. Under FISMA, the Chairman of FDIC is responsible for, among other things, (1) providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the entity’s information systems and information; (2) ensuring that senior agency officials provide information security for the information and information systems that support the operations and assets under their control; and (3) delegating to the corporation’s Chief Information Officer the authority to ensure compliance with the requirements imposed on the agency under FISMA. The Chief Information Officer is responsible for developing and maintaining a corporatewide information security program and for developing and maintaining information security policies, procedures, and control techniques that address all applicable requirements. The Chief Information Officer also serves as the authorizing official with the authority to approve the operation of the information systems at an acceptable level of risk to the corporation. The Chief Information Security Officer reports to the Chief Information Officer and serves as the Chief Information Officer’s designated representative. The Chief Information Security Officer is responsible for the overall support of certification and accreditation activities. According to FDIC policy, the Chief Information Security Officer is responsible for the development, coordination, and implementation of FDIC’s security policy and the coordination of information security and privacy efforts across the corporation. The Chief Information Security Officer coordinates the process of building a corporatewide security strategy and vision to include the creation and maintenance of FDIC’s information security policy, security risk assessment efforts, information technology risk assessments, disaster recovery, security monitoring, security awareness and training program, and security protection architecture. FDIC did not sufficiently implement access and other controls intended to protect the confidentiality, integrity, and availability of its financial systems and information and other sensitive information. A key reason for these weaknesses is that FDIC did not always fully implement key information security program activities such as effectively developing and implementing security policies, and implementing an effective continuous monitoring program. These control deficiencies, which collectively constituted a significant deficiency for calendar year 2009, reduced FDIC’s ability to ensure that authorized users had only the access needed to perform their assigned duties, and that its systems were sufficiently protected from unauthorized access. As a result, increased risk exists that financial information and other sensitive information could be disclosed or modified without authorization. A basic management objective for any organization is to protect the resources that support its critical operations and assets from unauthorized access. Organizations accomplish this by designing and implementing controls that are intended to prevent, limit, and detect unauthorized access to computer resources (e.g., data, programs, equipment, and facilities), thereby protecting them from unauthorized disclosure, modification, and loss. Specific access controls include authorization restrictions, system boundary protections, identification and authentication of users, cryptography, and audit and monitoring procedures. Without adequate access controls, unauthorized individuals, including intruders and former employees, can surreptitiously read and copy sensitive data and make undetected changes or deletions for malicious purposes or personal gain. In addition, authorized users can intentionally or unintentionally modify or delete data or execute changes that are outside of their authority. Authorization is the process of granting or denying access rights and privileges to a protected resource, such as a network, system, application, function, or file. A key component of granting or denying access rights is the concept of “least privilege,” which refers to granting users only the access rights and permissions that they need to perform their official duties. To restrict legitimate users’ access to only those programs and files that they need in order to do their work, organizations establish user access rights: allowable actions that can be assigned to users or to groups of users. File and directory permissions are rules that are associated with a particular file or directory, regulating which users can access it—and the extent of their access rights. To avoid unintentionally giving a user unnecessary access to sensitive files and directories, an organization should give careful consideration to its assignment of rights and permissions. In addition, National Institute of Standards and Technology (NIST) guidance states that an organization should enforce approved authorizations for logical access to its information systems with access mechanisms such as access control lists within the network system. Furthermore, NIST guidance states that access should be allowed only for authorized users and only for the tasks necessary to accomplish their work in accordance with the organization’s missions and business functions. FDIC did not always sufficiently restrict system access and privileges to only those users who needed access to perform their assigned duties. For example, FDIC did not always configure access control lists on all its network devices to limit or restrict configure access control lists on servers dedicated to network management to restrict access to only those users who require it, ensure access to sensitive files of critical network devices was adequately control access to a database supporting an accounting application used to process receivership asset financial activity, and limit user access rights to only those roles necessary to perform their duties. As a result, increased risk exists that a user could gain inappropriate access to computer resources, circumvent security controls, and deliberately or inadvertently read, modify, or delete financial information and other sensitive information. Boundary protection controls logical connectivity into and out of networks and controls connectivity to and from network-connected devices.