GAO: SEC needs to bolster info security

The Securities and Exchange Commission needs to strengthen its information security and better control access to one of its financial systems, according to a report by the Government Accountability Office.

Auditors said the financial data became vulnerable during a migration to a new production environment because the SEC did not appropriately monitor the company handling the transfer.

"Specifically, SEC did not consistently provide adequate contractor oversight and implement an effective risk management process during the migration to the new production environment at its data center in June 2013," the report states. "SEC relied on a contractor to migrate the key financial system to a new production environment, which included the completion of critical security-related tasks."

However, "SEC officials did not review the system's security and project migration plans to verify that security-related roles, resources and responsibilities were identified," the report states.

Additionally, auditors said the system has weaknesses in access controls, configuration and patch management, separation of duties, and disaster recovery planning. Although GAO proposed two recommendations in its public report, a separate report with limited distribution outlined 49 actions SEC officials need to take to address the weaknesses.

"At the time of the migration, our new automated system compliance oversight tools were not yet fully deployed to that particular environment," SEC officials wrote in response. "The appropriate level of attention was not applied to a contractor oversight during the migration of the financial system identified in your report. As a result, that particular system was deployed without meeting our configuration requirements."

They went on to say the new system was immediately shut down and access reverted to the properly configured environment as soon as GAO alerted them to the issues.

SEC officials agreed that their risk management process needs to be strengthened but said the missteps during the migration were not a true indicator of their approach to security.

"While we regret the lack of contractor oversight of the system migration, we remain confident that our layered defense architecture would have allowed us to detect and respond to attempted intrusions in a timely fashion, and our forensic investigation yielded no evidence of compromise to that system," they wrote.