GAO cites SEC for cybersecurity lapses

Weaknesses found in way agency authenticated users, authorized access and encrypted data

Apr 18, 2014 @ 11:32 am

By Mark Schoeff Jr.

SEC, GAO, Internet security, Internet threats, advisers, examinations
+ Zoom

In the same week that the Securities and Exchange Commission told advisers what kind of cybersecurity protections it wants them to implement, a government watchdog said the SEC should get its own house in order when it comes to defending against Internet threats.

In a report released Thursday, the Government Accountability Office said that SEC has not consistently protected itself from potential intrusions into its computer network. The GAO found weaknesses in the way the agency identified and authenticated users, authorized access and encrypted data, among other shortcomings.

The GAO study, conducted as part of GAO audits of the SEC's fiscal 2013 and 2014 financial statements, also found that the SEC did not exercise tight enough control over contractors working on its data system, failed to implement sufficiently strong password controls and poorly managed the migration of a key financial system to a new location.

“Cumulatively, these weaknesses decreased assurance regarding the reliability of the data processed by the key financial system and increased the risk that unauthorized individuals could gain access to critical hardware or software and intentionally or inadvertently access, alter, or delete sensitive data or computer programs,” the GAO report states.

“Until the SEC mitigates its control deficiencies and strengthens oversight of contractors performing security-related tasks as part of its information security program, it will continue to be at risk of ongoing deficiencies in the security controls over its financial and support systems and the information they contain,” the report continued.

Earlier this week, the SEC released a detailed checklist designed to give financial advisers guidance on what the agency will assess in cybersecurity exams of advisory firms and brokerages later this year.

Within the GAO report, the SEC said it has made significant investments in information-technology protection over the last three years and achieved improvements.

“While we regret the lack of contract oversight of the system migration, we remain confident that our layered defense architecture would have allowed us to detect and respond to attempted intrusions in a timely fashion, and our forensic investigation yielded no evidence of compromise to that system,” Thomas A. Bayer, the SEC's chief information officer, wrote in a March 31 letter attached to the report. “In 2014, the SEC will continue to optimize our controls and further improve the security of our systems that support financial processes and our overall risk management process.”

0
Comments

What do you think?

View comments

Recommended for you

Featured video

Events

Inside the first robo ETF

When it comes to exchange-traded funds, innovations come in all shapes and sizes. Check out Robo Global's Bill Studebaker discussing the first robo ETF.

Video Spotlight

Are Your Clients Prepared For Market Downturns?

Sponsored by Prudential

Video Spotlight

Path to growth

Video Spotlight

Path to growth

Latest news & opinion

What not to say to clients when the markets drop

Here's what advisers should steer clear of saying the next time stocks turn downward.

SEC bars former rep for alleged share price manipulation

George Thoreson tried to keep penny stock's price high to enable Nasdaq listing.

Nevada fiduciary law raises concerns among retirement professionals, brokerage industry

Critics complain that it conflicts with ERISA and SEC rules and has potential to spur other states to pass their own version of a fiduciary rule.

A special need for financial advice

Advisers don't have to be experts to help special needs families get a jump on lifelong planning.

Broker-dealers and RIAs at loggerheads over fiduciary rule delay

Companies and groups weighing in with comment letters have vastly different viewpoints on the delay's potential impact.

X

Subscribe and Save 60%

Premium Access
Print + Digital

Learn more
Subscribe to Print