Less than three months after the Treasury Inspector General for Tax Administration reported that there were major security vulnerabilities in two crucial systems Internal Revenue Service, the IRS's security practices have been panned by another government entity.
This time, the criticism (download pdf) comes from the Government Accountability Office, which last week released a report Highlighting several problems with how the IRS protects taxpayer data. The 24-page assessment examined existing policies and controls as well as IRS efforts to fix security issues reported in a previous audit Gao.
The report shows that taxpayer and other sensitive data continues to remain dangerously underprotected at the IRS. According to Gao, while the IRS has addressed 49 of 115 Previously reported security issues, several critical areas remain Vulnerable.
For example, the IRS still does not always enforce strong password management rules for identifying and authenticating users of its systems, nor does it encrypt certain types of sensitive data, the Gao said. It also noted that the IRS has a tendency to allow sensitive information such as passwords and user IDS to be "readily available" to any user on its networks. Weak passwords and excessive access on the network for authenticated users were also cited as potential threats to taxpayer data.
A lot of the issues are the result of a continued failure by the IRS to implement any agency-wide information security program or risk Assessments review annually, the Gao said. As a result, the agency remains "particularly Vulnerable" to Insider threats and malicious attacks that could Expose financial and taxpayer data.
Gao pointed to the specific security problems, including the following: Exposed usernames and passwords on an IRS contractor-maintained Web site; authenticated users on the IRS network with access to shared drives containing taxpayer information, performance appraisal data and sensitive data such as Social Security numbers for other IRS employees, financial information and account data that was transmitted in the clear from the IRS's financial accounting system; inadequate logging of security events for Windows and Unix servers at a data center, and a similar lack of controls for logging changes to Mainframe data sets at another data center; a failure to maintain or enforce a configuration baseline for a Mainframe system, which supports the operation of revenue accounting records and other critical applications.
The steps the IRS has taken to improve security include setting up better controls to prevent network access by unauthenticated users; paying more attention to patching critical vulnerabilities; and formulating better Contingency plans for documenting critical business processes.
In a one-page response to the report, IRS Commissioner Douglas Shulman said data security and privacy are of utmost Importance "to the IRS, and he pledged that the agency would provide a" detailed Corrective action plan "that addresses the concerns raised by the Gao. A spokesperson at the IRS could not be immediately reached for comment.
The Gao's report follows one released last October by the inspector general for tax administration that was also critical of the IRS's security controls for sensitive data. That report focused specifically on security vulnerabilities in a new system the IRS is rolling out called the Customer Account Data Engine (Cade), plus a related piece of technology called the Account Management Services (AMS) system. The $ 1 billion Cade system is designed to eventually manage all taxpayer accounts and replace the agency's existing Master File tax processing systems by 2012. The $ 700 million AMS system, Meanwhile, is designed to provide faster access to the taxpayer information stored in the database Cade.
The October inspector general's report (download pdf) identified several Weaknesses with access control, system access monitoring, and disaster recovery involving the Cade and AMS systems. Those Weaknesses posed direct threats to taxpayer data, according to the report.
Just a week before that, the inspector general had issued a separate report detailing Weaknesses in several other IRS systems.
Less than three months after the Treasury Inspector General for Tax Administration reported that there were major security vulnerabilities in two crucial systems Internal Revenue Service, the IRS's security practices have been panned by another government entity.
This time, the criticism (download pdf) comes from the Government Accountability Office, which last week released a report Highlighting several problems with how the IRS protects taxpayer data. The 24-page assessment examined existing policies and controls as well as IRS efforts to fix security issues reported in a previous audit Gao.
The report shows that taxpayer and other sensitive data continues to remain dangerously underprotected at the IRS. According to Gao, while the IRS has addressed 49 of 115 Previously reported security issues, several critical areas remain Vulnerable.
For example, the IRS still does not always enforce strong password management rules for identifying and authenticating users of its systems, nor does it encrypt certain types of sensitive data, the Gao said. It also noted that the IRS has a tendency to allow sensitive information such as passwords and user IDS to be "readily available" to any user on its networks. Weak passwords and excessive access on the network for authenticated users were also cited as potential threats to taxpayer data.
A lot of the issues are the result of a continued failure by the IRS to implement any agency-wide information security program or risk Assessments review annually, the Gao said. As a result, the agency remains "particularly Vulnerable" to Insider threats and malicious attacks that could Expose financial and taxpayer data.
Gao pointed to the specific security problems, including the following: Exposed usernames and passwords on an IRS contractor-maintained Web site; authenticated users on the IRS network with access to shared drives containing taxpayer information, performance appraisal data and sensitive data such as Social Security numbers for other IRS employees, financial information and account data that was transmitted in the clear from the IRS's financial accounting system; inadequate logging of security events for Windows and Unix servers at a data center, and a similar lack of controls for logging changes to Mainframe data sets at another data center; a failure to maintain or enforce a configuration baseline for a Mainframe system, which supports the operation of revenue accounting records and other critical applications.
The steps the IRS has taken to improve security include setting up better controls to prevent network access by unauthenticated users; paying more attention to patching critical vulnerabilities; and formulating better Contingency plans for documenting critical business processes.
In a one-page response to the report, IRS Commissioner Douglas Shulman said data security and privacy are of utmost Importance "to the IRS, and he pledged that the agency would provide a" detailed Corrective action plan "that addresses the concerns raised by the Gao. A spokesperson at the IRS could not be immediately reached for comment.
The Gao's report follows one released last October by the inspector general for tax administration that was also critical of the IRS's security controls for sensitive data. That report focused specifically on security vulnerabilities in a new system the IRS is rolling out called the Customer Account Data Engine (Cade), plus a related piece of technology called the Account Management Services (AMS) system. The $ 1 billion Cade system is designed to eventually manage all taxpayer accounts and replace the agency's existing Master File tax processing systems by 2012. The $ 700 million AMS system, Meanwhile, is designed to provide faster access to the taxpayer information stored in the database Cade.
The October inspector general's report (download pdf) identified several Weaknesses with access control, system access monitoring, and disaster recovery involving the Cade and AMS systems. Those Weaknesses posed direct threats to taxpayer data, according to the report.
Just a week before that, the inspector general had issued a separate report detailing Weaknesses in several other IRS systems.
Jaikumar Vijayan, Computerworld
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment