Oversight

GAO: SEC needs to bolster info security

broken lock

The Securities and Exchange Commission needs to strengthen its information security and better control access to one of its financial systems, according to a report by the Government Accountability Office.

Auditors said the financial data became vulnerable during a migration to a new production environment because the SEC did not appropriately monitor the company handling the transfer.

"Specifically, SEC did not consistently provide adequate contractor oversight and implement an effective risk management process during the migration to the new production environment at its data center in June 2013," the report states. "SEC relied on a contractor to migrate the key financial system to a new production environment, which included the completion of critical security-related tasks."

However, "SEC officials did not review the system's security and project migration plans to verify that security-related roles, resources and responsibilities were identified," the report states.

Additionally, auditors said the system has weaknesses in access controls, configuration and patch management, separation of duties, and disaster recovery planning. Although GAO proposed two recommendations in its public report, a separate report with limited distribution outlined 49 actions SEC officials need to take to address the weaknesses.

"At the time of the migration, our new automated system compliance oversight tools were not yet fully deployed to that particular environment," SEC officials wrote in response. "The appropriate level of attention was not applied to a contractor oversight during the migration of the financial system identified in your report. As a result, that particular system was deployed without meeting our configuration requirements."

They went on to say the new system was immediately shut down and access reverted to the properly configured environment as soon as GAO alerted them to the issues.

SEC officials agreed that their risk management process needs to be strengthened but said the missteps during the migration were not a true indicator of their approach to security.

"While we regret the lack of contractor oversight of the system migration, we remain confident that our layered defense architecture would have allowed us to detect and respond to attempted intrusions in a timely fashion, and our forensic investigation yielded no evidence of compromise to that system," they wrote.

About the Author

Reid Davenport is an FCW editorial fellow. Connect with him on Twitter: @ReidDavenport.

The 2014 Federal 100

Get to know the 100 women and men honored this year for going above and beyond in federal IT.

Reader comments

Wed, Apr 23, 2014 Gary Morgan Ft Worth Texas

It is not addressed in the article but Nist/OMB-130, requires re-certification of a network when major changes occur such as a migration. The CIO and system owner IAW FIPS/FISMA conduct risk assessment/BIA. The overall It security systems design compliance tools should also be reassessed.

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above