Information security is a critical consideration for any organization that depends on information systems and computer networks to carry out its mission or business. It is especially important for government agencies, where the public’s trust is essential. The dramatic expansion in computer interconnectivity and the rapid increase in the use of the Internet are changing the way our government, the nation, and much of the world communicate and conduct business. Without proper safeguards, systems are unprotected from individuals and groups with malicious intent to intrude and use the access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. These concerns are well founded for a number of reasons, including the dramatic increase in reports of security incidents, the ease of obtaining and using hacking tools, the steady advance in the sophistication and effectiveness of attack technology, and the dire warnings of new and more destructive attacks to come. Computer-supported federal operations are likewise at risk. Our previous reports, and those of agency inspectors general, describe persistent information security weaknesses that place a variety of federal operations at risk of disruption, fraud, and inappropriate disclosure. We have designated information security as a governmentwide high-risk area since 1997—a designation that remains today. Recognizing the importance of securing federal information systems, in December 2002, Congress enacted the Federal Information Security Management Act (FISMA) to strengthen the security of information and systems within federal agencies. FISMA requires each agency to develop, document, and implement an agencywide information security program to provide information security for the information and systems that support the operations and assets of the agency, using a risk-based approach to information security management. Following the stock market crash of 1929, Congress passed the Securities Exchange Act of 1934, which established SEC to enforce securities laws, to regulate the securities markets, and to protect investors. In enforcing these laws, SEC issues rules and regulations to provide protection for investors and to help ensure that the securities markets are fair and honest. This is accomplished primarily by promoting adequate and effective disclosure of information to the investing public. The commission also oversees and requires the registration of other key participants in the securities industry, including stock exchanges, broker-dealers, clearing agencies, depositories, transfer agents, investment companies, and public utility holding companies. SEC is an independent, quasi-judicial agency that operates under a bipartisan commission appointed by the President and confirmed by the Senate. SEC had a budget of about $888 million and staff of 3,865 to monitor and regulate the securities industry in fiscal year 2005. In 2003, the volume traded on U.S. exchanges and NASDAQ exceeded $22 trillion and 850 billion shares. Each year the commission accepts, processes, and disseminates to the public more than 600,000 documents from companies and individuals, including annual reports from more than 12,000 reporting companies. In fiscal year 2005, SEC collected $595 million for filing fees and $1.6 billion in penalties and disgorgements. In addition, the commission uses other systems that maintain sensitive personnel information for its employees, filing data for corporations, and legal information on enforcement activities. SEC relies extensively on computerized systems to support its financial operations and store the sensitive information it collects. Its local and wide area networks interconnect these systems. To support the commission’s financial management functions, it relies on several financial systems to process and track financial transactions such as filing fees paid by corporations and penalties from enforcement activities. According to FISMA, the Chairman of SEC has responsibility for, among other things, (1) providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the agency’s information systems and information; (2) ensuring that senior agency officials provide information security for the information and information systems that support the operations and assets under their control; and (3) delegating to the agency CIO the authority to ensure compliance with the requirements imposed on the agency under FISMA. SEC’s CIO is responsible for developing and maintaining a departmentwide information security program and for developing and maintaining information security policies, procedures, and control techniques that address all applicable requirements. The objectives of our review were to assess (1) the status of SEC’s actions to correct or mitigate previously reported information security and (2) the effectiveness of the commission’s information system controls for ensuring the confidentiality, integrity, and availability of its information systems and information. Our evaluation was based on our Federal Information System Controls Audit Manual, which contains guidance for reviewing information system controls that affect the confidentiality, integrity, and availability of computerized data. Specifically, we evaluated information security controls that are intended to prevent, limit, and detect electronic access to computer resources (data, programs, and systems), thereby protecting these resources against unauthorized disclosure, modification, and use; provide physical protection of computer facilities and resources from espionage, sabotage, damage, and theft; prevent the exploitation of vulnerabilities; prevent the introduction of unauthorized changes to application or system software; and ensure that work responsibilities for computer functions are segregated so that one individual does not perform or control all key aspects of computer-related operations and, thereby, have the ability to conduct unauthorized actions or gain unauthorized access to assets or records without detection. In addition, we evaluated SEC’s information security program. Such a program includes assessing risk; developing and implementing policies, procedures, and security plans; providing security awareness and training; testing and evaluating the effectiveness of controls; planning, implementing, evaluating, and documenting remedial actions to address information security deficiencies; detecting, reporting, and responding to security incidents; and ensuring continuity of operations. To evaluate SEC’s information security controls and program, we identified and examined pertinent SEC security policies, procedures, guidance, security plans, and relevant reports. In addition, we conducted tests and observations of controls in operation and reviewed corrective actions taken by the commission to address vulnerabilities identified during our previous review. We also discussed whether information system controls were in place, adequately designed, and operating effectively with key security representatives, system administrators, and management officials. Although SEC has taken steps to address its information security controls weaknesses, most of the weaknesses persist. Specifically, the commission has corrected or mitigated 8 of the 51 weaknesses that we previously reported as unresolved. For example, SEC has replaced a vulnerable, publicly accessible workstation with a terminal that provides the minimum capabilities needed to accomplish its purpose and a more secure configuration; developed and implemented procedures to ensure that changes made to a major financial system are reviewed, tested, and approved prior to implementation; and hired contractors to appropriately segregate change management and security management functions for a major financial system. While SEC has made some progress in strengthening its information security controls, it has not completed actions to correct or mitigate the remaining 43 of the 51 previously reported weaknesses. These weaknesses include allowing remote access to production servers via unauthorized accounts; permitting inadequate and insecure password storage and configuration; allowing excessive access rights to Windows servers, network system accounts, and sensitive information; and failing to adequately secure access to sensitive computing environments. Failure to resolve these issues will leave SEC’s sensitive data and facilities vulnerable to unauthorized access, manipulation, and destruction. SEC has not effectively implemented information security controls to properly protect the confidentiality, integrity, and availability of its financial and sensitive information and information systems. In addition to the 43 previously reported weaknesses that remain uncorrected, we identified 15 new information security weaknesses during this review. Most of the 58 identified weaknesses pertained to electronic access controls, as illustrated in figure 1. A primary reason for these weaknesses is that SEC has not yet fully implemented its information security program. As a result, weaknesses in controls over its financial and sensitive data increase the risk of unauthorized disclosure, modification, or destruction of data. Protecting the resources that support critical operations from unauthorized access is a basic management objective for any organization. Organizations accomplish this objective by designing and implementing electronic controls that are intended to prevent, limit, and detect unauthorized access to computing resources, programs, and information. Electronic access controls include user accounts and passwords, access rights and permissions, network services and devices, and audit and monitoring of security-related events. Inadequate electronic access controls diminish the reliability of computerized information, and they increase the risk of unauthorized disclosure, modification, and destruction of sensitive information and of disruption of service. A computer system must be able to identify and differentiate users so that activities on the system can be linked to specific individuals. When an organization assigns unique user accounts to specific users, the system distinguishes one user from another—a process called identification. The system must also establish the validity of a user’s claimed identity through some means of authentication, such as a password, that is known only to its owner. The combination of identification and authentication, such as user account/password combinations, provides the basis for establishing individual accountability and for controlling access to the system. Accordingly, agencies (1) implement procedures to control the creation, use, and removal of user accounts and (2) establish password parameters, such as length, life, and composition, to strengthen the effectiveness of account/password combinations for authenticating the identity of users. SEC has not adequately controlled user accounts and passwords to ensure that only authorized individuals are granted access to its systems and data. For example, SEC has not finalized policies and procedures to enforce strong password management or ensure the most appropriate and secure password settings are used. Similarly, it did not complete efforts to develop and implement a policy and process to prevent unauthorized remote access to security accounts. As a result, there is increased risk that unauthorized users could gain authorized user identification and password combinations to claim a user identity and then use that identity to gain access to SEC systems. A basic underlying principle for security computer systems and data is the concept of least privilege, which means that users are granted only those access rights and permissions they need to perform their official duties. User rights are allowable actions that can be assigned to users or groups.