Information Technology OCCs Network and Systems Security Controls Were Deficient

This report represents the results of our audit of network and systems security at the Office of the Comptroller of the Currency (OCC). Our objective was to determine whether sufficient protections exist to prevent and detect unauthorized access into OCC's network and systems. To accomplish our objective, we performed a series of internal and external vulnerability assessments and penetration tests on OCC's workstations, servers, network-attached peripherals (such as cameras and printers), infrastructure devices, and Internet websites. We also tested the physical security of OCC's headquarters and performed social engineering tests by e-mail and phone phishing. Additionally, we followed up on the findings in our prior report from 2008. Due to the time that has passed since our prior report, we did not determine if the findings that are repeated in this report were issues that had been resolved and then deteriorated back to the initial condition, or if they were long standing issues that had not been addressed. We performed our fieldwork in Washington, DC, in February and March 2013. Our objective, scope, and methodology are described in more detail in appendix 1.