IRS Security Faults Leave Taxpayer Data At Risk

coondoggie writes "In this tax season, when billions of dollars and tons of personal information is relayed to and from the government, it's more than disconcerting to hear that the Internal Revenue Service is still struggling to keep private information secure. A report out Friday from watchdogs at the Government Accountability Office says about 69% of the tax agency's previously noted security flaws remain unfixed and continue to jeopardize the confidentiality, integrity, and availability of the IRS's systems (PDF). The problems put the IRS at increased risk of unauthorized disclosure, modification, or destruction of financial and taxpayer information, the GAO concluded."

Different how?

[jofny]

Im not a fan of the IRS, but let's be real: 1. There are almost no government agencies or civilian organizations that don't have fairly terrible security...2. These checkbox requirements dont really tell a story. 2. These checkbox requirements dont tell a story of the actual level of security. You'd have to take a look at the whole architecture to figure out whether, for example, those UNIX passwords actually were important or not.

This goes contrary to what I've heard.

[Securityemo]

A long while back, someone came in on Slashdot and claimed to have consulted/worked with the IRS, and described a security culture and tolerance for hair-trigger detection measures that would make any security fascist drool. So these problems would most likely be on a purely bureaucratic level, then?

Re:These are basic best practices.

[Vellmont]

                * use passwords that are not complex,
                * ineffectively remove application accounts in a timely manner for separated employees,
                * allow personnel excessive file and directory permissions,
                * allow the unencrypted transmission of user and administrator login information,
                * install security patches in an untimely manner

I've seen most of those items every place I've worked. None of them are particularly "red alert" type problems on their own. For instance, are the passwords that aren't complex on publicly accessible systems? Someone logging into IRS.gov with "irs", "password" is a MAJOR MAJOR problem. Someone logging into a system only available in an IRS office with "s.johnson", "skipper2" is far less so.

The report is long and focuses on stuff auditors with no real IT experience sit around and worry about. I'm sure not going to read through the whole thing, but the parts I read are relatively yawn-worthy. An example would be how passwords were set to expire after 118 days on a certain system instead of 58 days. This despite the fact there's wide scale disagreement as to whether requiring people to change passwords has any real effect on security. Another example would be they didn't perfectly segregate important duties properly. (The example given was someone was both a database administrator and a system administrator).

The report is littered with statements like this:

For example, about 120 IRS employees had access to key documents, including cost data for input to its administrative
accounting system and a critical process-control spreadsheet used in IRS's cost allocation process. However, fewer than 10 employees needed this
access to perform their jobs...which could result in incorrect input and data processing... ultimately jeopardizing the information presented in IRS's annual financial statements.

(excuse me if this isn't something I'm going to write my congressman about)

If this is really the worst the GAO can come up with, I'd say we're all pretty safe. How many controls do you think your local H&R Block has?