Auditor: IRS still vulnerable to cyber breaches

LATEST NEWS

Computerworld is New Zealand's only specialised information systems fortnightly.
Subscribe now for $100 (23 issues) and save more than 37% off the cover price!

Get the latest news from Computerworld delivered via email.
Sign up now

US taxman makes slow progress on vulnerabilities

By Grant Gross | Washington | Monday, 19 January, 2009

The US Internal Revenue Service (IRS) remains exposed to a wide range of cybersecurity problems, while the agency has fixed less than half of the problems identified in a November audit, according to a recent report by the US Government Accountability Office (GAO).

The IRS has fixed just 49 of 115 computer security problems found by the GAO in the November audit, the GAO says. The agency, which collects about US$2.7 trillion (NZ$4.8 trillion) in taxes each year, still does not always enforce strong password management, does not encrypt some sensitive data and does not always limit the number of workers with access to sensitive information, the GAO says.

"IRS continues to, among other things, allow sensitive information, including IDs and passwords for mission-critical applications, to be readily available to any user on its internal network, and grant excessive access to individuals who do not need it," the GAO report says. "Despite IRS’s progress, information security control weaknesses continue to jeopardise the confidentiality, integrity, and availability of financial and sensitive taxpayer information."

The GAO report did note the IRS has taken several steps to improve information security since the November report.

The IRS has implemented controls for unauthorised network access on its mainframe. As well, it has encrypted sensitive data going across its network and has improved the patching of critical vulnerabilities, the GAO says.

However, the IRS has not yet implemented an agencywide information security programme, the GAO says. A programme should include periodic risk assessments, testing of security procedures and security training for IRS workers, according to the GAO.

"These deficiencies represent a material weakness in IRS's internal controls over its financial and tax processing systems," the GAO report says. "Until IRS takes these steps, financial and taxpayer information are at increased risk of unauthorised disclosure, modification, or destruction, and the agency's management decisions may be based on unreliable or inaccurate financial information."

IRS Commissioner Douglas Shulman says the agency will work with GAO to fix any problems.

"The security and privacy of taxpayer information is of utmost importance to us and the integrity of our financial systems continues to be sound," he wrote in a letter included with the GAO report. "We are committed to securing our computer environment as we continually evaluate processes, promote user awareness and apply innovative ideas to increase compliance."