Posts Tagged ‘ US Government Accountability Office ’

GAO: IRS Taxpayer Data not Secure Enough

March 22nd, 2012. By AbiK

Your taxpayer info may be at risk. That’s comforting news as millions of Americans are gearing up to submit those 1040’s, eh?

Yes, the GAO—that would be the US Government Accountability Office—released a report this month titled: “Report to the Commissioner of Internal Revenue; Information Security: IRS Needs to Further Enhance Internal Control over Financial Reporting and Taxpayer Data”. It gives new meaning to the phrase “IRS Audit”…

So here’s the deal:  your taxpayer information may not be safe over at the IRS, which sounds like a security breach waiting to happen.

Hearing this is reminiscent of that AA 12-step adage: ‘admission is the first step to recovery’; i.e., it’s one thing when others point the finger about a problem—it’s another when you point the finger at yourself. Hell, then the problem must really exist—and that’s what’s a bit disturbing here—this is a government report pointing the finger at…the government. Time to raise an eyebrow, folks.

According to the GAO Report (GAO-12-393, 3/16/12), while the IRS did implement security controls and procedures for its financial and tax-processing systems, there are weaknesses in those controls and procedures. Weaknesses the GAO point-blank states “continue to jeopardize the confidentiality, integrity, and availability of the financial and sensitive taxpayer information processed by IRS’systems.”

Here’s another gem from the report: “…IRS’s security testing and monitoring continued to not detect many of the vulnerabilities GAO identified during this audit.”

Remember that viral TSA video last week—the one where Jonathan Corbett makes a mockery of TSA full-body scanners? The scanner in that instance ‘continued to not detect vulnerabilities’, too. That video has gotten roughly 1.9M views on YouTube to date and caused outrage on social networks. But, ok, not everyone flies or is online keeping abreast of viral videos—everyone, however, pays taxes. Everyone should be outraged by this.

Specifically, the GAO points to the following as examples in which the IRS systems fail to control access to information:

• IRS had not always implemented controls for identifying and authenticating users–such as having users create new passwords after set time intervals;
• IRS hadn’t appropriately restricted access to certain servers;
• IRS had not always ensured that sensitive data were encrypted as the data were being transmitted;
• IRS didn’t always audit and monitor systems to ensure that unauthorized activities would be detected;
• IRS had not always ensured management validation of access to restricted areas;
• IRS had not always patched or updated software leaving the agency exposed to known vulnerabilities;
• IRS had not enforced backup procedures for a ‘key system’;

Anyone for storming the Bastille after reading that?

Tags: GAO, GAO IRS Audit, Internal Revenue Service, IRS Security, Taxpayer Data, US Government Accountability Office
Posted in Emerging Issues, Internet/E-commerce, Personal Injury | No Comments »