FDIC infosec program lacks controls

The FDIC has corrected 19 out of the 22 IT system weaknesses the GAO identified in its 2003 audit. But the 2004 audit revealed more weaknesses involving access controls, network security, segregation of functions, physical security, and application change control, according to the GAO report, issued last week.

"A key reason for FDIC's weaknesses in information system controls is that it had not fully implemented a complete test and evaluation process, which is a key element of a comprehensive agency information security program with effective controls," GAO auditors wrote.

The FDIC failed to ensure that all key control areas supporting its financial environment - including electronic access and network security - are routinely reviewed and tested, auditors said.

The GAO recommended that the FDIC implement an ongoing, comprehensive process of tests and evaluations for the key control areas, which the agency said it has already made progress in doing.

Another report by the GAO found federal agencies have not secured their wireless networks, despite well-known risks associated with the technology.

www.gao.gov