GAO report: Weak security at SEC

Weak infosec controls at the Securities and Exchange Commission (SEC) put sensitive data such as payroll and financial transactions at risk, according to a recent report by the Government Accountability Office (GAO).

The SEC has not consistently applied access controls, network security, or monitoring of security events in order to protect its critical systems, the GAO reported.

"A key reason for SEC's information system control weaknesses is that the commission has not fully developed and implemented a comprehensive agency information security program to provide reasonable assurance that effective controls are established and maintained and that information security receives sufficient management attention," according to the GAO.

Although the SEC has taken some steps by creating a central security management function and appointing a senior infosec officer to oversee the effort, it has not fully assessed its risks, defined security roles, implemented security policies, or promoted security awareness, the report states.

The SEC agreed with the GAO's recommendation to fully develop and implement an agency-wide infosec program and said it has made progress in addressing the weaknesses cited in the audit.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.