GAO: SEC needs to bolster info security

broken lock

The Securities and Exchange Commission needs to strengthen its information security and better control access to one of its financial systems, according to a report by the Government Accountability Office.

Auditors said the financial data became vulnerable during a migration to a new production environment because the SEC did not appropriately monitor the company handling the transfer.

"Specifically, SEC did not consistently provide adequate contractor oversight and implement an effective risk management process during the migration to the new production environment at its data center in June 2013," the report states. "SEC relied on a contractor to migrate the key financial system to a new production environment, which included the completion of critical security-related tasks."

However, "SEC officials did not review the system's security and project migration plans to verify that security-related roles, resources and responsibilities were identified," the report states.

Additionally, auditors said the system has weaknesses in access controls, configuration and patch management, separation of duties, and disaster recovery planning. Although GAO proposed two recommendations in its public report, a separate report with limited distribution outlined 49 actions SEC officials need to take to address the weaknesses.

"At the time of the migration, our new automated system compliance oversight tools were not yet fully deployed to that particular environment," SEC officials wrote in response. "The appropriate level of attention was not applied to a contractor oversight during the migration of the financial system identified in your report. As a result, that particular system was deployed without meeting our configuration requirements."

They went on to say the new system was immediately shut down and access reverted to the properly configured environment as soon as GAO alerted them to the issues.

SEC officials agreed that their risk management process needs to be strengthened but said the missteps during the migration were not a true indicator of their approach to security.

"While we regret the lack of contractor oversight of the system migration, we remain confident that our layered defense architecture would have allowed us to detect and respond to attempted intrusions in a timely fashion, and our forensic investigation yielded no evidence of compromise to that system," they wrote.

About the Author

Reid Davenport is an FCW editorial fellow. Connect with him on Twitter: @ReidDavenport.


  • Congress
    U.S. Capitol (Photo by M DOGAN / Shutterstock)

    Funding bill clears Congress, heads for president's desk

    The $1.3 trillion spending package passed the House of Representatives on March 22 and the Senate in the early hours of March 23. President Trump is expected to sign the bill, securing government funding for the remainder of fiscal year 2018.

  • 2018 Fed 100

    The 2018 Federal 100

    This year's Fed 100 winners show just how much committed and talented individuals can accomplish in federal IT. Read their profiles to learn more!

  • Census
    How tech can save money for 2020 census

    Trump campaign taps census question as a fund-raising tool

    A fundraising email for the Trump-Pence reelection campaign is trying to get supporters behind a controversial change to the census -- asking respondents whether or not they are U.S. citizens.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.