US Accountability Body Criticizes SEC Infosec Approach
![sec-building sec-building](/sites/default/files/styles/landscape_750_463/public/import/IMG/435/223435/sec-building-580x358.jpg.webp?itok=tDHdVlfH)
In its findings summary, the GAO said that the SEC did not adequately protect its system boundaries from intrusion, and failed to consistently authenticate users, monitor network activity, implement proper authorization procedures for sensitive data and restrict access at physical locations. Damningly, the GAO also found that the SEC did not properly segregate its development and production environments, with accounts for the former live on the latter's servers. The GAO also noted that despite the SEC had put a disaster recovery and contingency plan in place, this did not include a critical system.
"[The] SEC continues to make progress in improving information security controls over its key financial systems," the GAO report summarizes. "However, information security control weaknesses in a key financial system's production environment may jeopardize the confidentiality, integrity, and availability of information residing in and processed by the system. These included deficiencies in [the] SEC's controls over access control, configuration management, segregation of duties, and contingency and disaster recovery planning. In addition, [the] SEC did not consistently provide adequate contractor oversight and implement an effective risk management process during the migration of an important financial system to its new location."
The report recommends that the SEC increases its oversight of contractors, and institute a proper risk management program. A separate document, which was not widely distributed, makes 49 specific suggestions.
In its comments, the SEC acknowledged issues with the oversight of contractors and the wider criticisms made in the report, but said that once weaknesses were identified with server configurations, they were immediately rectified.
Only users who have a paid subscription or are part of a corporate subscription are able to print or copy content.
To access these options, along with all other subscription benefits, please contact info@waterstechnology.com or view our subscription options here: http://subscriptions.waterstechnology.com/subscribe
You are currently unable to print this content. Please contact info@waterstechnology.com to find out more.
You are currently unable to copy this content. Please contact info@waterstechnology.com to find out more.
Copyright Infopro Digital Limited. All rights reserved.
You may share this content using our article tools. Printing this content is for the sole use of the Authorised User (named subscriber), as outlined in our terms and conditions - https://www.infopro-insight.com/terms-conditions/insight-subscriptions/
If you would like to purchase additional rights please email info@waterstechnology.com
Copyright Infopro Digital Limited. All rights reserved.
You may share this content using our article tools. Copying this content is for the sole use of the Authorised User (named subscriber), as outlined in our terms and conditions - https://www.infopro-insight.com/terms-conditions/insight-subscriptions/
If you would like to purchase additional rights please email info@waterstechnology.com
More on Trading Tech
Ace high or busted flush? Digital Asset’s mixed fortunes mirror DLT adversity
The vendor hoped to remodel post-trade using blockchain technology—and it still might—but its bumpy progress raises questions over the future of DLT in finance.
This Week: BlackRock/Preqin, Trading Technologies, FIA Tech and more
A summary of some of the past week’s financial technology news.
Adaptive’s Aeron goes live on Microsoft Azure Marketplace
The messaging software used for building bespoke trading platforms is now available on Microsoft’s marketplace, making it accessible through major cloud providers.
Bloomberg, industry bodies push back on Cboe’s proposed OEMS rule change
Some industry bodies disagree with the options exchange’s proposal to carve its Silexx OEMS out of the SEC’s definition of an exchange facility and place it into a separate business line.
Waters Wrap: CME, Google and the pursuit of ultra-low-latency trading
CME Group and Google have announced Aurora, Illinois, as the location for the exchange’s new co-location facility. Anthony explains why this is more than just the next phase of the two companies’ originally announced project.
WatersTechnology latest edition
Check out our latest edition, plus more than 12 years of our best content.
Natixis refines in-house interoperability model
The French asset manager has refined its canonical data model over the last decade, as the interoperability movement continues to evolve.
Zeros and ones: Industry contemplates T+0 as the next step
With the North American transition to T+1 settlement complete, same-day settlement could be the next goalpost set, though skeptics are many.