Risk

3/17/2011
02:53 PM
50%
50%

GAO Says IRS Data Security Problems Persist

The General Accountability Office reported that the Internal Revenue Service is still exposing taxpayer and financial information to insider-threat risks, despite making some access-control improvements.

Top 10 Government Stories Of 2010
(click image for larger view)
Slideshow: Top 10 Government Stories Of 2010
The IRS still isn't doing enough security-wise to protect the confidentially of financial and taxpayer information -- particularly from insider threats – despite repeated tries at fixing previously identified security problems, a federal watchdog agency has found.

Weaknesses continue to plague a number of Internal Revenue Service IT access-control systems that leave sensitive data vulnerable, according to a report (PDF) released this week by the Government Accountability Office (GAO), which performed a fiscal-year 2010 audit on the agency.

Though the agency noted some security improvements, it still found that 65 of 88 weaknesses previously found in IRS access-control systems -- or 74% -- remain "unresolved or unmitigated." Moreover, the GAO identified 37 new weaknesses that leave data open to a number of insider threats.

"An underlying reason for these weaknesses is that IRS has not yet fully implemented key components of its comprehensive information security program," according to the GAO. "Although IRS has processes in place intended to monitor and assess its internal controls, these processes were not always effective."

Last year around the same time, the GAO delivered a similar report, finding that 69% of 89 security deficiencies identified during a 2008 fiscal-year audit remained unsolved. According to the latest report, it seems the IRS' problem is getting worse, not better.

Systems the GAO found to be vulnerable to intrusion include ones that restrict user access to only the databases they need to perform their jobs; one the IRS uses to support and manage its computer access request, approval, and review processes; and database software residing on servers that support the agency's general ledger system, among others.

The GAO presented a host of doomsday scenarios that are possible because of the vulnerabilities that persist in how the IRS stores and transports data internally. "As a result, financial and taxpayer information are at increased risk of unauthorized disclosure, modification, or destruction; financial data is at increased risk of errors that result in misstatement; and the agency's management decisions may be based on unreliable or inaccurate financial information," according to the report.

The GAO is recommending the IRS take a series of immediate actions to remedy its data-security woes. Among them are a series of updates to risk assessments for whenever there is a change to the system, for the facilities where the systems reside, and for the mainframe environment that supports the IRS general ledger for tax-related activities and processing, according to the report.

The IRS also should update employee password control policies and procedures to ensure they are consistent, as well as perform comprehensive testing of security controls over the mainframe environment to include all portions of the operating environment, the GAO said.

The agency also made 32 separate and detailed recommendations to correct specific weaknesses identified in its latest audit that are related to the following: identification and authentication, authorization, cryptography, audit and monitoring, physical security, configuration management, and segregation of duties.

The IRS responded to the audit by acknowledging that security is "of the utmost importance" and that it will provide "a detailed corrective action" to address each of the GAO's recommendation, according to the report.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Ransomware Grabs Headlines but BEC May Be a Bigger Threat
Marc Wilczek, Digital Strategist & CIO Advisor,  10/12/2017
20 Questions to Ask Yourself before Giving a Security Conference Talk
Joshua Goldfarb, Co-founder & Chief Product Officer, IDDRA,  10/16/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Be a unicorn, not a donkey...
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.