GAO report: Weak security at SEC

The SEC has not consistently applied access controls, network security, or monitoring of security events in order to protect its critical systems, the GAO reported.

"A key reason for SEC's information system control weaknesses is that the commission has not fully developed and implemented a comprehensive agency information security program to provide reasonable assurance that effective controls are established and maintained and that information security receives sufficient management attention," according to the GAO.

Although the SEC has taken some steps by creating a central security management function and appointing a senior infosec officer to oversee the effort, it has not fully assessed its risks, defined security roles, implemented security policies, or promoted security awareness, the report states.

The SEC agreed with the GAO's recommendation to fully develop and implement an agency-wide infosec program and said it has made progress in addressing the weaknesses cited in the audit.

www.gao.gov