Oversight

GAO: SEC needs to bolster info security

broken lock

The Securities and Exchange Commission needs to strengthen its information security and better control access to one of its financial systems, according to a report by the Government Accountability Office.

Auditors said the financial data became vulnerable during a migration to a new production environment because the SEC did not appropriately monitor the company handling the transfer.

"Specifically, SEC did not consistently provide adequate contractor oversight and implement an effective risk management process during the migration to the new production environment at its data center in June 2013," the report states. "SEC relied on a contractor to migrate the key financial system to a new production environment, which included the completion of critical security-related tasks."

However, "SEC officials did not review the system's security and project migration plans to verify that security-related roles, resources and responsibilities were identified," the report states.

Additionally, auditors said the system has weaknesses in access controls, configuration and patch management, separation of duties, and disaster recovery planning. Although GAO proposed two recommendations in its public report, a separate report with limited distribution outlined 49 actions SEC officials need to take to address the weaknesses.

"At the time of the migration, our new automated system compliance oversight tools were not yet fully deployed to that particular environment," SEC officials wrote in response. "The appropriate level of attention was not applied to a contractor oversight during the migration of the financial system identified in your report. As a result, that particular system was deployed without meeting our configuration requirements."

They went on to say the new system was immediately shut down and access reverted to the properly configured environment as soon as GAO alerted them to the issues.

SEC officials agreed that their risk management process needs to be strengthened but said the missteps during the migration were not a true indicator of their approach to security.

"While we regret the lack of contractor oversight of the system migration, we remain confident that our layered defense architecture would have allowed us to detect and respond to attempted intrusions in a timely fashion, and our forensic investigation yielded no evidence of compromise to that system," they wrote.

About the Author

Reid Davenport is a former FCW editorial fellow. Connect with him on Twitter: @ReidDavenport.

Featured

  • Defense
    The U.S. Army Corps of Engineers and the National Geospatial-Intelligence Agency (NGA) reveal concept renderings for the Next NGA West (N2W) campus from the design-build team McCarthy HITT winning proposal. The entirety of the campus is anticipated to be operational in 2025.

    How NGA is tackling interoperability challenges

    Mark Munsell, the National Geospatial-Intelligence Agency’s CTO, talks about talent shortages and how the agency is working to get more unclassified data.

  • Veterans Affairs
    Veterans Affairs CIO Jim Gfrerer speaks at an Oct. 10 FCW event (Photo credit: Troy K. Schneider)

    VA's pivot to agile

    With 10 months on the job, Veterans Affairs CIO Jim Gfrerer is pushing his organization toward a culture of constant delivery.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.