TREASURY INSPECTOR GENERAL FOR TAX ADMINISTRATION
Office of Audit
THE OFFICE OF RESEARCH, ANALYSIS, AND
STATISTICS NEEDS TO ADDRESS COMPUTER SECURITY WEAKNESSES
Issued on September 17, 2008
Highlights
Highlights of
Report Number: 2008-20-176 to the
Internal Revenue Service Director, Office of Research, Analysis, and Statistics
IMPACT ON TAXPAYERS
Information
technology personnel in the Internal Revenue Service (IRS) Office of Research,
Analysis, and Statistics (RAS organization) manage computer systems that users
query to obtain enormous amounts of taxpayer data. However, security weaknesses existed on each
of the three computer systems TIGTA reviewed. These weaknesses increase the risks of
unauthorized disclosure of taxpayer data and significant disruption to computer
operations.
WHY TIGTA DID THE AUDIT
This audit was initiated
as part of TIGTA’s statutory requirement to annually review the adequacy and
security of IRS technology. The overall
objective was to determine whether the RAS organization maintained effective
security controls over its information systems.
WHAT TIGTA FOUND
TIGTA identified
several weaknesses in the management of access to the RAS organization’s
computer systems. Managers and system
administrators had not placed sufficient emphasis on maintaining the security
and privacy of the taxpayer data they were charged with protecting. Managers did not carry out their
responsibilities to ensure that 1) users were authorized to access the computer
systems, 2) access accounts for former employees and current employees who no
longer needed access were removed, and 3) system administrators removed or
locked unnecessary generic or shared administrator accounts that provide
additional opportunities for intruders to gain access to the systems.
In addition,
password settings did not conform to IRS information security standards. For example, passwords were not always
sufficiently complex, passwords were not set to expire after the required
length of time, and new users were not required to change their passwords at
initial login.
Unencrypted
sensitive data were transferred between computers.
Controls to detect
inappropriate security events were not effective. For example, TIGTA found that audit logs were
not adequately retained or reviewed.
Intrusion detection systems were not installed and virus protection
software was not current. In addition,
data received from other sources were not scanned with virus protection
software before being uploaded to the server.
TIGTA also identified
database security vulnerabilities within the systems reviewed. Database patching was not adequate, access
permissions were set incorrectly, password settings were incorrect, and the
auditing feature was not properly enabled to detect unauthorized activities in
the databases. TIGTA also found that
system backup files were not stored offsite.
WHAT TIGTA RECOMMENDED
TIGTA recommended that
the Director, Office of Research, Analysis, and Statistics, 1) designate a
security officer to monitor compliance with IRS security requirements and
remind managers and employees of their security responsibilities, 2) require system
administrators and managers to ensure that all system access controls are
followed, and to follow up on identified security weaknesses to ensure that they
are corrected in a timely manner, 3) coordinate with the Modernization and
Information Technology Services organization to implement secure processes for
transferring sensitive data between computers, and ensure that scanning
software is used to periodically scan the systems for security weaknesses, 4) implement
and monitor a process by which managers validate that system access is limited
to only those who have a need, 5) ensure that audit and accountability controls
are sufficient by requiring that audit logs are maintained a minimum of 6 years
and are reviewed by the security officer, 6) require managers to ensure that
offsite storage is used for system and data backup files, and 7) coordinate
with the Chief Information Officer to verify that intrusion detection systems
are installed to protect all systems and that virus protection software is
current.
IRS officials agreed
with the findings and recommendations and reported they have already taken many
corrective actions to address the recommendations.
READ THE FULL REPORT
To view the report,
including the scope, methodology, and full IRS response, go to:
http://www.treas.gov/tigta/auditreports/2008reports/200820176fr.html.
Email Address: inquiries@tigta.treas.gov
Phone Number: 202-622-6500
Web Site:
http://www.tigta.gov