Congress created FDIC in 1933 to restore and maintain public confidence in the nation’s banking system. In 1989 the Financial Institutions Reform, Recovery, and Enforcement Act was enacted to reform, recapitalize, and consolidate the federal deposit insurance system. It created the Bank Insurance Fund and the Savings Association Insurance Fund, which are responsible for protecting insured bank and thrift depositors, respectively, from loss due to institution failures. The act also created the FSLIC Resolution Fund to finalize the affairs of the former FSLIC and liquidate the assets and liabilities transferred from the former Resolution Trust Corporation. It also designated FDIC as the administrator of these funds. As part of this function FDIC has an examination and supervision program to monitor the safety of deposits held in member institutions. FDIC insures deposits in excess of $3.2 trillion for about 10,000 institutions. Together the three funds have about $49 billion in assets. FDIC had a budget of about $1.2 billion for calendar year 2001 to support its activities in managing the three funds. For that year, it processed more than 2.7 million financial transactions. FDIC relies extensively on computerized systems to support its financial operations and store the sensitive information it collects. These systems are interconnected by FDIC’s local and wide area networks. To support its financial management functions, it relies on several financial systems to process and track financial transactions that include premiums paid by its member institutions and disbursements made to support operations. In addition, FDIC supports other systems that maintain personnel information on its employees, examination data on selected financial institutions, and legal information on closed institutions. At the time of our review, there were about 5,400 authorized users on FDIC’s systems. Our objective was to evaluate the effectiveness of information systems general controls over the financial systems maintained and operated by FDIC during our 2001 financial statement audits. These information systems controls also affect the security and reliability of other sensitive data, including personnel, legal, and bank examination information maintained on the same computer systems as the corporation’s financial information. Specifically, we evaluated information systems controls intended to protect data and application programs from unauthorized access; prevent the introduction of unauthorized changes to application and provide segregation of duties involving application programming, system programming, computer operations, information security, and quality assurance; ensure recovery of computer processing operations in case of disaster or other unexpected interruption; and ensure an adequate information security management program. To evaluate these controls, we identified and reviewed FDIC’s policies and procedures, conducted tests and observations of controls in operation, and held discussions with FDIC staff to determine whether information systems controls were in place, adequately designed, and operating effectively. In addition, we reviewed corrective actions taken by FDIC to address vulnerabilities identified in our calendar year 2000 audit. Our evaluation was based on (1) our Federal Information System Controls Audit Manual, which contains guidance for reviewing information systems controls that affect the integrity, confidentiality, and availability of computerized data; and (2) our May 1998 report on security management best practices at leading organizations, which identifies key elements of an effective information security program. We performed our work at FDIC from October 2001 through April 2002. Our work was performed in accordance with generally accepted government auditing standards. In our audit of FDIC’s calendar year 2001 financial statements, we found that FDIC made progress in correcting previously identified weaknesses. For instance, in our 2000 financial statement audits, we determined that FDIC had not adequately limited access of authorized users, restricted physical access to computer facilities, performed comprehensive tests of the disaster recovery plan, implemented a computer security incident response process, established a security awareness program, developed security plans, and performed independent security reviews. These weaknesses placed critical corporation operations, such as financial management, personnel, and other operations, at greater risk of misuse and disruption. Except for actions still needed to fully implement a computer security management program, which are discussed later in this report, FDIC made progress in addressing our previously reported computer security weaknesses. For example, in our 2001 audits, we found that FDIC has limited access of its system programmers and security staff to certain developed corporate access authorization procedures; restricted modem connections and use of generic log on IDs to its improved physical security to its computer center by limiting access through the adjoining FDIC hotel; developed and performed tests of its computer center disaster recovery plans, including its network and designated remote facilities, to provide backup support for the corporation’s network and other operations; established a computer security awareness program for its employees developed security plans for its general support systems and implemented a requirement and process for independent security reviews to be performed at least every 3 years. In addition to correcting previously identified weaknesses, FDIC initiated other steps to improve computer security. These efforts included (1) reviews of system software, (2) improvements in physical security, including the use of guard service to provide security surveillance to its computer rooms, (3) completed management authorizations for major financial applications and general support systems, and (4) assessments of the sensitivity of corporate data to determine the level of security needed to protect it. However, we found additional control weaknesses in FDIC’s information systems in connection with our calendar year 2001 financial statement audits. Specifically, FDIC has not adequately limited access to data and programs by controlling mainframe access authority, providing sufficient network security, or establishing a comprehensive program to monitor access activities. Other information system control weaknesses were also identified that could likewise hinder FDIC’s ability to provide adequate physical security for its computer facility, appropriate segregation of computer functions, effective control of system software changes, or ensure continuity of operations. Consequently, financial, and personnel programs and data maintained by FDIC are at risk of inadvertent or deliberate misuse, fraudulent use, and unauthorized alteration or destruction, which may occur without detection. The following sections summarize the results of our review. A separate report designated for “Limited Official Use Only” details specific weaknesses in information systems controls that we identified, provides our recommendations for correcting each weakness, and indicates FDIC’s planned actions or those already taken for each weakness. An evaluation of the adequacy of this action plan will be part of our planned work at FDIC. A basic management control objective for any organization is to protect data supporting its critical operations from unauthorized access, which could lead to improper modifications, disclosure, or deletion. Organizations can protect this critical information by granting employees the authority to read or modify only those programs and data that they need to perform their duties and by periodically reviewing access granted to ensure that it is appropriate. In addition, effective network security controls should be established to authenticate local and remote users and include a program to monitor the access activities of the network and mainframe systems. Although progress was made in limiting access, FDIC’s information systems controls were not adequately protecting financial and sensitive information. Specifically, FDIC had not appropriately limited mainframe access authority, sufficiently secured its network, or established a comprehensive program to monitor access activities. These weaknesses place the corporation’s information systems at risk of unauthorized access, which could lead to the improper disclosure, modification, or deletion of sensitive information and the disruption of critical operations. Effective mainframe access controls should be designed to prevent, limit, and detect access to computer programs and data. These controls include access rights and permissions, system software controls, and software library management. While FDIC restricted access to many users who previously had broad access to critical programs, software, and data, we identified instances in which the corporation had not sufficiently restricted access to legitimate users. A key weakness in FDIC’s controls was that its data center did not sufficiently restrict user access, as described below. Hundreds of users had access privileges that allowed them to modify financial software and read, modify, or copy financial data. This risk was further heightened because the corporation was not actively monitoring the access activities of these users. Many users had unnecessary access to powerful commands. About 55 users had access to a specific transaction command that could be used to circumvent the security of sensitive FDIC information, including its bank examination files. These users included 26 help-desk employees and 14 database staff, users who do not need this access to perform their daily job functions. About 15 users outside of the system programming function had access privileges to one sensitive system software library that is allowed to perform system functions that can be used to circumvent all security controls. Such access increases the risk that users can bypass security controls to alter or delete any computer data or programs on the system. Typically such access privileges are limited to system programmers. About 30 users had access to powerful operator commands that could be used to circumvent system security or compromise the operational integrity of the system. Prior to the completion of our work, the acting CIO told us that this access privilege had been removed for these users. One reason for FDIC’s user access vulnerabilities was that not all access authority granted based on job responsibility was being collectively reviewed. Instead, individual access privileges were reviewed by data owners but only to determine the appropriateness of each user’s access to a data owner’s resource. As a result, there was no comprehensive review to determine the appropriateness of all access granted to any one user. Such reviews would have allowed FDIC to identify and correct inappropriate access. FDIC said that it was reviewing staff access and would limit this access to that required to carry out job responsibilities. Further, the corporation plans to develop and implement procedures to comprehensively review all access granted and ensure that access remains appropriate. Network security controls are key to ensuring that only authorized individuals gain access to sensitive and critical agency data. These controls include a variety of tools such as user passwords, intended to authenticate authorized users who access the network from local and remote locations. In addition, network controls provide safeguards to ensure that the system software is adequately configured to prevent users from bypassing network access controls or causing network failures. The risks introduced by the weaknesses we identified in access controls were compounded by network security weaknesses.