IRS systems leave taxpayer data at risk, audit finds
Connecting state and local government leaders
The agency has developed security policies, but incomplete implementation results in weak access controls that expose sensitive data to internal threats, GAO says.
An audit of IRS security policies and controls found that the agency has made improvements in securing its systems in the last year, but still falls short.
“It's not as much as we had hoped or even IRS had hoped,” Gregory C. Wilshusen, director of information security issues at the Government Accountability Office, said of the progress in an online interview. “IRS still needs to do more in order to appropriately protect the information that taxpayers deserve.”
The failings are documented in a report on the most recent audit. The weaknesses described deal primarily with internal controls and threats rather than outside attacks or breaches.
Related coverage:
IRS coughs up $320M for to overhaul website
According to the report, IRS corrected just 29 of 105 weaknesses that had previously been reported. GAO also found that 13 of the 29 fixes had been done improperly or incompletely. The problem was not a lack of policy, but a lack of follow-through, Wilshusen said.
“We found that the Internal Revenue Service had not always implemented controls that are intended to prevent, limit, and detect unauthorized access to its systems and data,” he said.
Specific failures include a lack of controls for identifying and authenticating users, including requirements for strong passwords; access to certain servers not appropriately restricted; sensitive data being transmitted without encryption; lax physical access controls; and a lack of adequate configuration management that left known vulnerabilities in software.
In October 2011, the Treasury Inspector General for Tax Administration said that security of taxpayer data, including securing computer systems, was the top priority in its list of management challenges for IRS in fiscal year 2012. The agency’s security policy calls for identifying risks, ensuring consistent and specific policies and procedures, updating all system security plans, providing security training to all personnel, including contractors, effectively testing and evaluating policies, procedures, and controls, and validating corrective actions.
Despite the high priority and having established a comprehensive information security framework, IRS has not fully implemented all components of its program, however GAO found. In addition to the incompletely implemented IT security program, outdated and unsupported software continues to expose the agency to known vulnerabilities, and there are shortcomings in performing system backup that place data availability at risk.
IRS policy calls for strong, eight-character alpha-numeric passwords with both upper and lower case characters that are changed regularly and cannot be reused within 10 changes. But the policy is not uniformly applied. GAO found the same situation with authorization controls, some of which could be circumvented to allow unauthorized access. The internal use of encryption is being expanded, but also is not uniformly used.
IRS policy calls for monitoring traffic on intrusion detection systems and audit logging on systems; but this was not always done. An Enterprise Security Audit Trails Project Management Office has been established to oversee these processes. The program is currently in its early stages and new procedures are being implemented, but they are a long way from operating effectively.
GAO recommendations to correct problems include:
- Document a baseline configuration standard for tasks initiated on the mainframe operating system.
- Document monitoring procedures that staff use to review audit logs for a key financial system.
- Fully document monitoring procedures for the procurement system.
- Expand testing of the agency’s enterprise continuous monitoring process to include access controls and system tests.
- Implement a compliance verification application to ensure appropriate security patches have been applied in the Unix environment.
- Implement a compliance verification application, or other appropriate process, to ensure configuration policies are comprehensively tested on the mainframe.
In a separate report with limited distribution, GAO also is making 23 detailed recommendations for actions to correct specific weaknesses related to identity management, authentication and authorization, audit and monitoring, physical security, configuration management, and contingency planning.
The IRS said that it plans to provide a response to the GAO findings with detailed corrective actions to the weaknesses.