Infrastructure // Unified Communications
04:10 PM
Connect Directly
Repost This

GAO Reports Lax Data Protection At Securities And Exchange Commission

The Securities and Exchange Commission hasn't effectively implemented IT controls to protect the integrity, confidentiality, and availability of its financial and sensitive data, congressional auditors find.

Personal data held in a government database is at increased risk of unauthorized disclosure, modification, or loss—possibly without anyone knowing, government auditors reported Thursday.

The Government Accountability Office, the investigative arm of Congress, contends the Securities and Exchange Commission hasn't effectively implemented IT controls to protect the integrity, confidentiality, and availability of its financial and sensitive data.

Specifically, the GAO says in a 29-page report—addressed to SEC chairman William Donaldson—that the SEC hadn't consistently implemented effective electronic access controls, including user accounts and passwords, access rights and permissions, network security, and audit and monitoring of security-relevant events to prevent, limit, and detect access to its critical financial and sensitive systems.

In addition, the report says, weaknesses in other information system controls, including physical security, segregation of computer functions, application change controls, and service continuity, further increase risk to the SEC's information systems. "As a result, sensitive data—including payroll and financial transactions, personnel data, regulatory, and other mission-critical information—were at increased risk of unauthorized disclosure, modification, or loss, possibly without detection," Gregory Wilshusen, the GAO's director of information security issues, wrote in the report.

A major factor for the SEC's IT control weaknesses is that the commission hasn't fully developed and implemented a comprehensive agency information security program to provide reasonable assurance that effective controls are established and maintained and that information security receives sufficient management attention, Wilshusen says. Although the SEC has taken some actions to improve security management, including establishing a central security-management function and appointing a senior information security officer to manage the program, it had not clearly defined roles and responsibilities for security personnel.

In addition, the GAO says, the SEC had not fully assessed its risks, established or implemented security policies, promoted security awareness, and tested and evaluated the effectiveness of its information system controls. The commission doesn't have a solid foundation for resolving existing information system control weaknesses and continuously managing information security risks, Wilshusen says.

In response, the SEC agreed with the GAO recommendations that the commission's CIO Corey Booth moves to fully develop and implement an effective, agencywide information security program. In a letter to Wilshusen, Booth assured the GAO that the SEC already is addressing the problems raised by congressional auditors.

Comment  | 
Print  | 
More Insights
Building A Mobile Business Mindset
Building A Mobile Business Mindset
Among 688 respondents, 46% have deployed mobile apps, with an additional 24% planning to in the next year. Soon all apps will look like mobile apps and it's past time for those with no plans to get cracking.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Elite 100 - 2014
Our InformationWeek Elite 100 issue -- our 26th ranking of technology innovators -- shines a spotlight on businesses that are succeeding because of their digital strategies. We take a close at look at the top five companies in this year's ranking and the eight winners of our Business Innovation awards, and offer 20 great ideas that you can use in your company. We also provide a ranked list of our Elite 100 innovators.
Twitter Feed
Audio Interviews
Archived Audio Interviews
GE is a leader in combining connected devices and advanced analytics in pursuit of practical goals like less downtime, lower operating costs, and higher throughput. At GIO Power & Water, CIO Jim Fowler is part of the team exploring how to apply these techniques to some of the world's essential infrastructure, from power plants to water treatment systems. Join us, and bring your questions, as we talk about what's ahead.