Risk
3/17/2011
02:53 PM
50%
50%

GAO Says IRS Data Security Problems Persist

The General Accountability Office reported that the Internal Revenue Service is still exposing taxpayer and financial information to insider-threat risks, despite making some access-control improvements.

Top 10 Government Stories Of 2010
(click image for larger view)
Slideshow: Top 10 Government Stories Of 2010
The IRS still isn't doing enough security-wise to protect the confidentially of financial and taxpayer information -- particularly from insider threats – despite repeated tries at fixing previously identified security problems, a federal watchdog agency has found.

Weaknesses continue to plague a number of Internal Revenue Service IT access-control systems that leave sensitive data vulnerable, according to a report (PDF) released this week by the Government Accountability Office (GAO), which performed a fiscal-year 2010 audit on the agency.

Though the agency noted some security improvements, it still found that 65 of 88 weaknesses previously found in IRS access-control systems -- or 74% -- remain "unresolved or unmitigated." Moreover, the GAO identified 37 new weaknesses that leave data open to a number of insider threats.

"An underlying reason for these weaknesses is that IRS has not yet fully implemented key components of its comprehensive information security program," according to the GAO. "Although IRS has processes in place intended to monitor and assess its internal controls, these processes were not always effective."

Last year around the same time, the GAO delivered a similar report, finding that 69% of 89 security deficiencies identified during a 2008 fiscal-year audit remained unsolved. According to the latest report, it seems the IRS' problem is getting worse, not better.

Systems the GAO found to be vulnerable to intrusion include ones that restrict user access to only the databases they need to perform their jobs; one the IRS uses to support and manage its computer access request, approval, and review processes; and database software residing on servers that support the agency's general ledger system, among others.

The GAO presented a host of doomsday scenarios that are possible because of the vulnerabilities that persist in how the IRS stores and transports data internally. "As a result, financial and taxpayer information are at increased risk of unauthorized disclosure, modification, or destruction; financial data is at increased risk of errors that result in misstatement; and the agency's management decisions may be based on unreliable or inaccurate financial information," according to the report.

The GAO is recommending the IRS take a series of immediate actions to remedy its data-security woes. Among them are a series of updates to risk assessments for whenever there is a change to the system, for the facilities where the systems reside, and for the mainframe environment that supports the IRS general ledger for tax-related activities and processing, according to the report.

The IRS also should update employee password control policies and procedures to ensure they are consistent, as well as perform comprehensive testing of security controls over the mainframe environment to include all portions of the operating environment, the GAO said.

The agency also made 32 separate and detailed recommendations to correct specific weaknesses identified in its latest audit that are related to the following: identification and authentication, authorization, cryptography, audit and monitoring, physical security, configuration management, and segregation of duties.

The IRS responded to the audit by acknowledging that security is "of the utmost importance" and that it will provide "a detailed corrective action" to address each of the GAO's recommendation, according to the report.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.