FHFA’s Security Controls Were Not Effective to Protect Its Network and Systems Against Internal Threats

Submitting OIG:

Federal Housing Finance Agency OIG

Date Issued:

Monday, August 12, 2024

Agency Reviewed / Investigated:

Federal Housing Finance Agency

Submitting OIG-Specific Report Number:

AUD-2024-007

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

Recommendation Number	Recommendation Status	Significant Recommendation
AUD-2024-007-1	Open	No
FHFA’s Chief Information Officer should restrict user access to the folders and files on FHFA’s network in accordance with least privilege principle.
AUD-2024-007-2	Open	No
FHFA’s Chief Information Officer should evaluate the need for the software script to generate and record user login records and restrict access to the log files in accordance with least privilege principle.
AUD-2024-007-3	Open	No
FHFA’s Chief Information Officer should ensure that the default or initial login passwords are changed for all 179 users whose passwords were compromised in this audit.
AUD-2024-007-4	Open	No
FHFA’s Chief Information Officer should ensure that upon initial login, FHFA users establish a new password that meets FHFA requirements for length and complexity and that the password is not a commonly used or a known compromised password.
AUD-2024-007-5	Open	No
FHFA’s Chief Information Officer should ensure that standard user accounts and privileged user accounts are not set up with the same default or initial login password.
AUD-2024-007-6	Open	No
FHFA’s Chief Information Officer should ensure that personnel are trained on standard and privileged user FHFA authentication and identification policies.
AUD-2024-007-7	Open	No
FHFA’s Chief Information Officer should identify and implement a solution, in coordination with vendors, to ensure that multifactor authentication is required to access FHFA’s network. If there are no viable solutions, document any risk-based decisions, including compensating controls.
AUD-2024-007-8	Open	No
FHFA’s Chief Information Officer should change the credentials for the compromised cloud administrator account.
AUD-2024-007-9	Open	No
FHFA’s Chief Information Officer should use the secure access method recommended by FHFA’s cloud service provider to access the FHFA cloud environment.
AUD-2024-007-10	Open	No
FHFA’s Chief Information Officer should identify and implement a solution, in coordination with vendors, to ensure multifactor authentication is required for privileged users to access FHFA’s cloud environment. If there are no viable solutions, document any risk-based decisions, including compensating controls.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

AUD-2024-007-1

Open

FHFA’s Chief Information Officer should restrict user access to the folders and files on FHFA’s network in accordance with least privilege principle.

AUD-2024-007-2

Open

FHFA’s Chief Information Officer should evaluate the need for the software script to generate and record user login records and restrict access to the log files in accordance with least privilege principle.

AUD-2024-007-3

Open