The Internal Revenue Service has yet to address more than 100 cybersecurity recommendations made by a federal watchdog, including some that require fixing some basic cybersecurity measures.<\/p>\n\n\n\n
According to an audit by the Government Accountability Office released May 13, the IRS hasn\u2019t addressed 114 cybersecurity recommendations from previous audits. In addition, the watchdog made 18 new recommendations, bringing the number of open recommendations to 132.<\/p>\n\n\n\n
During the most recent audit, completed Sept. 30, the watchdog found 11 new information security \u201cdeficiencies\u201d related to access controls, configuration management and information security management.<\/p>\n\n\n\n
The audit evaluated the effectiveness of the IRS security controls, as well as followed up on the status of other cybersecurity recommendations the GAO made in September 2018.<\/p>\n\n\n\n
Among the 18 new recommendations were four relating to cryptography that revealed the IRS was failing to encrypt \u201ccertain data” in a system that processes taxpayer data and that the agency wasn\u2019t enforcing cryptography standards set forth by the National Institutes Standards and Technology.<\/p>\n\n\n\n
The IRS now has a total of 24 cryptography shortfalls, having closed just two recommendations since the September 2018 report. Encryption is considered to be a basic tenet of cybersecurity, especially if a system contains personally identifiable information.<\/p>\n\n\n\n
\u201cEffectively designed and implemented encryption controls can help prevent unauthorized access and disclosure of information (confidentiality) and detect changes to information (integrity),\u201d wrote Cheryl E. Clark, director of financial management and assurance, and Vijay A. D\u2019Souza, director of information technology and cybersecurity, in a letter sent to IRS Commissioner Charles Rettig.<\/p>\n\n\n\n
The IRS also failed to install multifactor authentication for accessing a \u201ccertain information system,” they wrote, another basic cybersecurity practice.<\/p>\n\n\n\n
\u201cNewly identified and continuing control deficiencies collectively represent a significant deficiency in IRS\u2019s internal control over financial reporting systems. Such deficiencies increase the risk of unauthorized access to, modification of, or disclosure of financial reporting and taxpayer data and disruption of critical operations,\u201d Clark and D\u2019Souza wrote.<\/p>\n\n\n\n
The IRS also didn\u2019t have properly signed authorization to operate memos or other documentation signed by proper official allowing use of external systems, such as those not owned by the IRS, the watchdog found.<\/p>\n\n\n\n
The IRS also reported to the GAO that it had addressed 14 of the 127 recommendations from prior audits, but the GAO found they had only sufficiently corrected 10.<\/p>\n\n\n\n
The IRS concurred with the GAO\u2019s recommendations and told the watchdog that it is \u201ccommitted\u201d to ensuring the effectiveness of its cybersecurity.<\/p>\n","protected":false},"excerpt":{"rendered":"
The Internal Revenue Service has yet to address more than 100 cybersecurity recommendations made by a federal watchdog, including some that require fixing some basic cybersecurity measures.<\/p>\n","protected":false},"author":7,"featured_media":37971,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"9":{"categories":["home","daily-brief","newsletters"],"primary_category":"home"}}},"categories":[1],"tags":[],"coauthors":[3242],"class_list":["post-12919","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"acf":{"subheadline":"","legacy_arc_id":"PTYUCOAHVNHRBGOPO3B5WDR77M","arc_canonical_url":"\/civilian\/2020\/05\/20\/irs-hasnt-implemented-more-than-100-federal-watchdogs-cybersecurity-recommendations\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n