Carl Hoecker - We'll Be Hearing A Lot From Him in the Future.

[ by Howard Haykin ]

For Carl Hoecker, the new SEC Inspector General, it was his first audit since taking over for former Inspector General H. David Kotz, who left the agency in early 2012.   

In 2 separate audits completed late last month, the SEC's new Inspector General found vulnerabilities in the SEC's information technology system.  Sensitive non-public information could be compromised if the SEC fails to take additional steps to improve its internal controls, an agency watchdog has found.

• In the 1st audit, dated 3/25/13, Mr. Hoecker examined how well the SEC maintains controls to protect sensitive information that it shares with the U.S. Financial Stability Oversight Council, or FSOC, a body of regulators that guards against systemic risks.
• The 2nd audit, dated 3/29/13, reviewed the SEC's compliance with the Federal Information Security Management Act, a federal law that lays down a framework for government agencies to protect themselves against threats and ensure data is secure.

Both audits were conducted as routine reviews to ensure compliance with federal rules and regulations, and were not investigating any wrongdoing. 

Results Run Counter to Administration Objectives.   The White House wants critical companies to comply with minimum security standards and also wants to help protect private information turned over to the government. The audit findings also coincide with renewed negotiations between Congress and the White House on legislation aimed at improving U.S. defenses against cyber attacks. 

Where the SEC Tripped Up.  Hoecker's 3/25 audit found, among other things, that:

• SEC needs to take more steps to safeguard critical information provided by such companies as hedge funds.
• Such information, largely proprietary in nature, is later reviewed by the FSOC.
• SEC lacks controls for remote accessing of government servers:  employees and contractors are subject to no restrictions or preventive controls when using a non-government computer to remotely access e-mail via the Internet, or and when uploading or saving non-public information.
  • "As a result, sensitive or nonpublic information could potentially be saved to a non-SEC computer."
  • "There is a risk that an unauthorized person could gain access to sensitive or nonpublic SEC information."
  • Based on an earlier account of these audit findings, the SEC is not aware, and does not believe, that any sensitive information was actually compromised.

The second audit found, in general, that:

• SEC needs to improve how it continually monitors the security of its systems;
• SEC should properly disable network accounts for employees or contractors at the time they leave the Agency.
  • Failure to disable these accounts, enables unauthorized employees and/or contractors to maintain access to the SEC's network.

The SEC concurred with the recommendations and said it would take steps to correct the problems.

For further details, go to:   [Reuters, 4/3/13].