Editor’s Note: GAO Reportc GAO-14-419, “Information Security: SEC Needs to Improve Controls over Financial Systems and Data” is attached here. Below are excerpts.
Although SEC had implemented and made progress in strengthening information security controls, weaknesses limited their effectiveness in protecting the confidentiality, integrity, and availability of a key financial system. SEC did not consistently control access to this financial system’s network, servers, applications, and databases; manage its configuration; segregate duties; and plan for contingencies and disasters. These weaknesses existed, in part, because SEC did not effectively oversee and manage the migration of the key financial system to a new location. Consequently, SEC’s financial information and systems were exposed to increased risk of unauthorized access, disclosure, modification, and disruption.
Although SEC had issued policies and implemented controls based on those policies, it did not consistently protect its network boundary from possible intrusions; identify and authenticate users; authorize access to resources; ensure that sensitive data are encrypted; audit and monitor actions taken on the commission’s systems and network; and restrict physical access to sensitive assets.
However, SEC did not consistently implement strong password controls for identifying and authenticating users to certain servers, network devices, and databases in the key financial system’s environment. For example, password length on a network management device and a server contained fewer characters than required. User account passwords on another server were configured to never expire. Additionally, two databases had a user password that had the same name as the user account. As a result, SEC is at increased risk that accounts could be compromised and used by unauthorized individuals to access sensitive information.
Read complete GAO report here.
Leave a Reply