FDIC was established by Congress to maintain the stability of and public confidence in the nation’s financial system by insuring deposits, examining and supervising financial institutions, and resolving troubled institutions. Congress created FDIC in 1933 in response to the thousands of bank failures that had occurred throughout the late 1920s and early 1930s. The Bank Insurance Fund and the Savings Association Insurance Fund were established as FDIC responsibilities under the Financial Institutions Reform, Recovery, and Enforcement Act of 1989, which sought to reform, recapitalize, and consolidate the federal deposit insurance system. The Bank Insurance Fund and the Savings Association Insurance Fund merged into the Deposit Insurance Fund on February 8, 2006, as a result of the passage of the Federal Deposit Insurance Reform Act of 2005. As administrator of the Deposit Insurance Fund, FDIC insures the deposits of banks and savings associations (insured depository institutions). In cooperation with other federal and state agencies, the FDIC promotes the safety and soundness of insured depository institutions by identifying, monitoring, and addressing risks to the Deposit Insurance Fund. FDIC is also the administrator of the Federal Savings and Loan Insurance Corporation Resolution Fund. This fund was created to close out the business of the former Federal Savings and Loan Insurance Corporation and liquidate the assets and liabilities transferred from the former Resolution Trust Corporation. FDIC relies extensively on computerized systems to support its mission, including financial operations, and to store the sensitive information that it collects. The corporation uses local and wide area networks to interconnect its systems. To support its financial management functions, FDIC uses, among other things, the following information technology (IT) resources: a corporate-wide system that functions as a unified set of financial and payroll systems that are managed and operated in an integrated fashion; a system to calculate and collect FDIC deposit insurance premiums and Financing Corporation interest amounts from insured institutions; a Web-based application that provides full functionality to support franchise marketing, asset marketing, and asset management; an application and Web portal to provide acquiring institutions with a secure method for submitting required data files to FDIC; computer programs used to derive the corporation’s estimate of losses from shared loss agreements; a system to request access to and receive permission for the computer applications and resources available to its employees, contractors, and other authorized personnel; and a primary receivership and subsidiary financial processing and reporting system. The federal government has seen a marked increase in the number of information security incidents affecting the integrity, confidentiality, and availability of government information, systems, and services. Without proper safeguards, computer systems are vulnerable to individuals and groups with malicious intentions who can intrude and use their access to obtain sensitive information, commit fraud and identity theft, disrupt operations, or launch attacks against other computer systems and networks. Cyber-based threats to information systems and cyber-related critical infrastructure can come from sources internal and external to the organization. External threats include the ever-growing number of cyber- based attacks that can come from a variety of sources such as individuals, groups, and countries who wish to do harm to an organization’s systems. Internal threats include errors or mistakes, as well as fraudulent or malevolent acts by employees or contractors working within an organization. Under the Federal Information Security Modernization Act of 2014 (FISMA), the Chairman of FDIC is responsible for, among other things, (1) providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the agency’s information systems and information; (2) ensuring that senior agency officials provide information security for the information and information systems that support the operations and assets under their control; and (3) delegating to the corporation’s Chief Information Officer (CIO) the authority to ensure compliance with the requirements imposed on the agency under FISMA. FISMA states that the CIO is responsible for developing and maintaining a corporate-wide information security program and for developing and maintaining information security policies, procedures, and control techniques that address all applicable requirements. FISMA also states that the CIO is to designate a senior agency information security officer to carry out the CIO’s responsibilities for information security under the law. In most federal organizations, this official is referred to as the Chief Information Security Officer. At FDIC, the CIO is responsible for, among other things, (1) establishing the information security risk management program and ensuring that it is properly implemented; (2) establishing the overall strategy for how the corporation frames, assesses, responds to, and monitors information security risks; and (3) establishing and promulgating agency-wide information security risk awareness programs and practices. The responsibilities of the FDIC Chief Information Security Officer include, among other things, (1) overseeing the corporation’s information technology security risk management program; (2) providing information security standards, control frameworks, security policy, best practices, and security architecture oversight; (3) ensuring appropriate staffing and support of all information security positions that support the risk management program; and (4) managing and maintaining the continuous monitoring program. For calendar years 2016 and 2015, FDIC implemented numerous information security controls intended to protect its key financial systems. In addition, the corporation addressed 15 of 21 recommendations to mitigate control weaknesses that we had previously identified in our reports in 2013, 2014, 2015, and 2016. Nevertheless, weaknesses remained in FDIC’s implementation of access, configuration management, and information security program controls that threaten the confidentiality, integrity, and availability of its financial systems and information. As we have previously reported, the collective effect of weaknesses in access and configuration management controls, both new and unresolved from previous audits, contributed to our determination that FDIC had a significant deficiency in internal control over financial reporting as of December 31, 2016. An agency can better protect the resources that support its critical operations and assets from unauthorized access, disclosure, modification, or loss by designing and implementing controls for protecting information system boundaries, identifying and authenticating users, restricting user access to only what has been authorized, encrypting sensitive data, and auditing and monitoring systems to detect potentially malicious activity, among other actions. Although FDIC had implemented numerous controls in these areas, weaknesses nevertheless continued to challenge the corporation in ensuring the confidentiality, integrity, and availability of its information and information systems. Boundary protection controls are intended to restrict logical access into and out of networks and control connectivity to and from network- connected devices. Any connections to the Internet or to other external and internal networks or information systems should occur through controlled interfaces (for example, gateways, routers, switches, and firewalls). In addition, networks should be appropriately configured to adequately protect access paths between systems; this can be accomplished through the use of access control lists and firewalls. National Institute of Standards and Technology (NIST) guidance recommends that organizations employ boundary protection mechanisms to separate organization-defined information system components supporting organization-defined missions and/or business functions. Such isolation limits unauthorized information flows among system components and also provides the opportunity to deploy greater levels of protection for selected components. Consistent with NIST guidance, Office of Management and Budget Circular A-130 requires agencies to isolate sensitive or critical information resources (e.g., information systems, system components, applications, databases, and information) into separate security domains with appropriate levels of protection based on the sensitivity or criticality of those resources. FDIC did not implement sufficient internal boundary protection controls on its network to isolate financial systems from other parts of its network. Although the corporation partially isolated financial systems from other parts of the environment using virtual local area networks, it did not always implement controls on network devices to prevent unauthorized users and systems from communicating with the financial systems. According to FDIC, a plan to isolate sensitive systems had been made, but implementation of the plan had been delayed due to other competing priorities. Until it appropriately isolates its financial systems, FDIC faces increased risk that unauthorized or malicious attempts to communicate with its financial systems could go undetected. Identification is the process of distinguishing one user from all others, usually through user identifications (ID). These are important because they are the means by which specific access privileges are assigned and recognized by the computer. However, because the confidentiality of a user ID is typically not protected, other means of authenticating users— that is, determining whether individuals are who they say they are—are typically implemented. The combination of identification and authentication—such as user account-password combinations—provides the basis for establishing accountability and for controlling access to the system. NIST SP 800-53, revision 4 recommends that agency information systems uniquely identify and authenticate organizational users or processes acting on behalf of organizational users. FDIC did not implement sufficient controls to ensure that users would be held accountable for the use of a key privileged account. Although the corporation employed a software tool to control access to privileged accounts, it did not use the tool to control access to a privileged account that was used by multiple engineers to manage the corporation’s virtual environment. As a result, FDIC’s ability to attribute authorized, as well as unauthorized, system activity to specific individuals could be diminished. Authorization is the process of granting or denying access rights and privileges to a protected resource, such as a network, system, application, function, or file. A key component of granting or denying access rights is the concept of “least privilege,” which refers to granting a user only the access rights and permissions needed to perform official duties. To restrict a legitimate user’s access to only those programs and files needed, organizations establish user access rights: allowable actions that can be assigned to a user or to groups of users. File and directory permissions are rules that are associated with a particular file or directory, regulating which users can access it—and the extent of their access rights. To avoid unintentionally giving a user unnecessary access to sensitive files and directories, an organization should give careful consideration to its assignment of rights and permissions.