Oversight

GAO: SEC needs to bolster info security

broken lock

The Securities and Exchange Commission needs to strengthen its information security and better control access to one of its financial systems, according to a report by the Government Accountability Office.

Auditors said the financial data became vulnerable during a migration to a new production environment because the SEC did not appropriately monitor the company handling the transfer.

"Specifically, SEC did not consistently provide adequate contractor oversight and implement an effective risk management process during the migration to the new production environment at its data center in June 2013," the report states. "SEC relied on a contractor to migrate the key financial system to a new production environment, which included the completion of critical security-related tasks."

However, "SEC officials did not review the system's security and project migration plans to verify that security-related roles, resources and responsibilities were identified," the report states.

Additionally, auditors said the system has weaknesses in access controls, configuration and patch management, separation of duties, and disaster recovery planning. Although GAO proposed two recommendations in its public report, a separate report with limited distribution outlined 49 actions SEC officials need to take to address the weaknesses.

"At the time of the migration, our new automated system compliance oversight tools were not yet fully deployed to that particular environment," SEC officials wrote in response. "The appropriate level of attention was not applied to a contractor oversight during the migration of the financial system identified in your report. As a result, that particular system was deployed without meeting our configuration requirements."

They went on to say the new system was immediately shut down and access reverted to the properly configured environment as soon as GAO alerted them to the issues.

SEC officials agreed that their risk management process needs to be strengthened but said the missteps during the migration were not a true indicator of their approach to security.

"While we regret the lack of contractor oversight of the system migration, we remain confident that our layered defense architecture would have allowed us to detect and respond to attempted intrusions in a timely fashion, and our forensic investigation yielded no evidence of compromise to that system," they wrote.

About the Author

Reid Davenport is a former FCW editorial fellow. Connect with him on Twitter: @ReidDavenport.

Featured

  • Defense
    Soldiers from the Old Guard test the second iteration of the Integrated Visual Augmentation System (IVAS) capability set during an exercise at Fort Belvoir, VA in Fall 2019. Photo by Courtney Bacon

    IVAS and the future of defense acquisition

    The Army’s Integrated Visual Augmentation System has been in the works for years, but the potentially multibillion deal could mark a paradigm shift in how the Defense Department buys and leverages technology.

  • Cybersecurity
    Deputy Secretary of Homeland Security Alejandro Mayorkas  (U.S. Coast Guard photo by Petty Officer 3rd Class Lora Ratliff)

    Mayorkas announces cyber 'sprints' on ransomware, ICS, workforce

    The Homeland Security secretary announced a series of focused efforts to address issues around ransomware, critical infrastructure and the agency's workforce that will all be launched in the coming weeks.

Stay Connected