Fintech

GAO cites SEC for cybersecurity lapses

Weaknesses found in way agency authenticated users, authorized access and encrypted data.

In the same week that the Securities and Exchange Commission told advisers what kind of cybersecurity protections it wants them to implement, a government watchdog said the SEC should get its own house in order when it comes to defending against Internet threats.

In a report released Thursday, the Government Accountability Office said that SEC has not consistently protected itself from potential intrusions into its computer network. The GAO found weaknesses in the way the agency identified and authenticated users, authorized access and encrypted data, among other shortcomings.

The GAO study, conducted as part of GAO audits of the SEC’s fiscal 2013 and 2014 financial statements, also found that the SEC did not exercise tight enough control over contractors working on its data system, failed to implement sufficiently strong password controls and poorly managed the migration of a key financial system to a new location.

“Cumulatively, these weaknesses decreased assurance regarding the reliability of the data processed by the key financial system and increased the risk that unauthorized individuals could gain access to critical hardware or software and intentionally or inadvertently access, alter, or delete sensitive data or computer programs,” the GAO report states.

“Until the SEC mitigates its control deficiencies and strengthens oversight of contractors performing security-related tasks as part of its information security program, it will continue to be at risk of ongoing deficiencies in the security controls over its financial and support systems and the information they contain,” the report continued.

Earlier this week, the SEC released a detailed checklist designed to give financial advisers guidance on what the agency will assess in cybersecurity exams of advisory firms and brokerages later this year.

Within the GAO report, the SEC said it has made significant investments in information-technology protection over the last three years and achieved improvements.

“While we regret the lack of contract oversight of the system migration, we remain confident that our layered defense architecture would have allowed us to detect and respond to attempted intrusions in a timely fashion, and our forensic investigation yielded no evidence of compromise to that system,” Thomas A. Bayer, the SEC’s chief information officer, wrote in a March 31 letter attached to the report. “In 2014, the SEC will continue to optimize our controls and further improve the security of our systems that support financial processes and our overall risk management process.”