The Internal Revenue Service has over 120 IT security recommendations from the Government Accountability Office, over 80 percent of which are from previous audits, according to a July 18 report.<\/p>\n\n\n\n
In the GAO\u2019s fiscal year 2018 audit of the IRS, the watchdog agency identified 14 new security control shortfalls relating to the tax collector\u2019s IT security and issued 20 new recommendations.<\/p>\n\n\n\n
Overall, the GAO found that the IRS had 127 unaddressed IT security recommendations from the GAO. Ninety-three of those recommendations pertain to access controls, such as authentication and encryption. Of those 93, 82 are left over from prior audits.<\/p>\n\n\n\n
Eight of the 14 security shortfalls identified by the GAO relate to access management, while an additional four weaknesses pertain to configuration management. The final two shortfalls pertained to segregation of duties and a contingency plan deficiency.<\/p>\n\n\n\n
The GAO said that the deficiencies it identified were not great risks, but needed to receive attention.<\/p>\n\n\n\n
\u201cWe identified ongoing and new information system security control deficiencies that while not collectively considered a material weakness, were important enough to merit attention by those charged with governance of IRS and therefore represented a significant deficiency in IRS\u2019s internal control over its financial reporting systems,\u201d the GAO wrote.<\/p>\n\n\n\n
The IRS doesn\u2019t have several security measures meant to protect critical agency data from unauthorized use. The GAO found that the agency didn\u2019t use multifactor authentication for access to certain agency applications, a violation of policy from the Office of Management and Budget. It also didn\u2019t enforce requirements for electronic signatures and password resets.<\/p>\n\n\n\n
The GAO also identified specific IRS shortfalls in its use of encryption to protect confidential information. The GAO report found the IRS did not encrypt certain servers, its email service, or enforce specific encrypted database connections.<\/p>\n\n\n\n
In total, there are 36 open recommendations regarding identification and authentication, and 22 encryption recommendations.<\/p>\n\n\n\n
The watchdog also found that the IRS wasn\u2019t properly updating or upgrading out-of-date software and implementing \u201cmandatory\u201d access controls.<\/p>\n\n\n\n
\u201cEffective configuration management provides reasonable assurance that systems are operating securely and as intended,\u201d the report found.<\/p>\n\n\n\n
The IRS also did not have a sufficient contingency plan for its email, with only one person assigned to administering it, the GAO wrote.<\/p>\n\n\n\n
\u201cWithout effective information system security controls, computer systems are vulnerable to human actions committed in error or with malicious intent,\u201d the GAO wrote. \u201cPeople acting with malicious intent can use their access to obtain sensitive information, commit fraud and identity theft, disrupt operations, or launch attacks against other computer systems and networks.\u201d<\/p>\n\n\n\n
Last year, the IRS told the GAO that it had taken \u201ccorrective action\u201d on 87 of 154 of the watchdog\u2019s recommendations from previous audits. But during its audit of the 2018 fiscal year, the GAO found that the IRS had only \u201ceffectively addressed\u201d 43 of the 87 recommendations the IRS said it had addressed.<\/p>\n\n\n\n
\u201cFinancial reporting and sensitive taxpayer data on IRS computer systems will remain vulnerable until the agency addresses the deficiencies for which we previously made 107 recommendations, as well as the 20 new recommendations,\u201d the GAO wrote.<\/p>\n","protected":false},"excerpt":{"rendered":"
The federal government’s watchdog recommends the Internal Revenue Service implement over 100 old and new recommendations to address a significant deficiency in the agency’s control over its reporting systems.<\/p>\n","protected":false},"author":7,"featured_media":53121,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":10,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[10],"tags":[],"coauthors":[3252],"class_list":["post-19672","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber"],"acf":{"subheadline":"","legacy_arc_id":"WWV562VGDFCF5K44HCHOQAHYQI","arc_canonical_url":"\/it-networks\/2019\/07\/23\/irs-missing-basic-it-security-measures\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n