The SEC has some ways to go toward improving its computer networks – according to a report from the Government Accountability Office (GAO). While the SEC, as of September 2016, has resolved most (47) of the 58 recommendations served up in the GAO’s last report, it still needs to address the following:

• 11 prior recommendations that included consistently protecting its network boundaries from possible intrusions, identifying and authenticating users, authorizing access to resources, auditing and monitoring actions taken on its systems and network, or encrypting sensitive information while in transmission.

• 15 newly identified control deficiencies limited the effectiveness of SEC's controls for protecting the confidentiality, integrity, and availability of its information systems. For example:

►  SEC did not consistently control logical access to its financial and general support systems;
►  SEC used unsupported software to process financial data.
►  SEC did not adequately segregate incompatible duties for one of its personnel.
►  SEC did not fully implement key elements of its information security program – like, not maintaining up-to-date network diagrams and asset inventories in its system security plans for its general support system and its key financial system application to accurately and completely reflect the current operating environment.

The GAO notes that, until the SEC mitigates these deficiencies, its financial and support systems and the information they contain will continue to be at unnecessary risk of compromise. Among its recommendations:

• Recommendation:  To effectively manage its information security program, the SEC Chairman should maintain up-to-date network diagrams and asset inventories in the system security plans for General Support System and a key financial system to accurately and completely reflect the current operating environment.

• Recommendation: To effectively manage its information security program, the SEC Chairman should perform continuous monitoring using automated configuration and vulnerability scanning on the operating systems, databases, and network devices.