IRS Security Faults Leave Taxpayer Data At Risk 42
coondoggie writes "In this tax season, when billions of dollars and tons of personal information is relayed to and from the government, it's more than disconcerting to hear that the Internal Revenue Service is still struggling to keep private information secure. A report out Friday from watchdogs at the Government Accountability Office says about 69% of the tax agency's previously noted security flaws remain unfixed and continue to jeopardize the confidentiality, integrity, and availability of the IRS's systems (PDF). The problems put the IRS at increased risk of unauthorized disclosure, modification, or destruction of financial and taxpayer information, the GAO concluded."
These are basic best practices. (Score:4, Informative)
Shameful that any company would fail at these basic tasks. It would take any competent admin very little time to compose policies that would effectively handle most of these. the others would require procedural changes but why would they continue to let the issue go if they know it's an audit exposure? (no pun intended)
From TFA:
For example, the GAO stated that the IRS continues to:
* use passwords that are not complex,
* ineffectively remove application accounts in a timely manner for separated employees,
* allow personnel excessive file and directory permissions,
* allow the unencrypted transmission of user and administrator login information,
* install security patches in an untimely manner
Re:They fscked me. (Score:3, Informative)
The only identity theft I've ever suffered is through the IRS. Supposedly four years ago someone else filed with my SSN.
It sounds to me like the identity theft itself wasn't through the IRS, but through some individual picking your SSN. It's not uncommon for an illegal alien to pick someone else's SSN when applying for a job. It happened to a friend of mine about 10 years ago and he only found out about it when he had a landlord or employer did a background check on him and found a referenced employer that he never worked for. (I think it was some womens abuse shelter and the employer or landlord only read the word abuse, and thought he was an abuser himself).
The problem you bring up I'm sure is entirely real, and it isn't addressed in any way by the GAO report. I'm FAR more concerned about this kind of thing than I am about the nonsense they bring up in the report.