IRS has demanding responsibilities in collecting taxes, processing tax  returns, and enforcing the nation’s tax laws, and relies extensively on  computerized systems to support its financial and mission-related  operations. IRS Demonstrated Progress in Correcting Previously Reported Weaknesses

Although IRS has continued to make progress toward correcting  previously reported information security weaknesses at three data centers  and an additional facility, many deficiencies remain. For  example, it has  implemented controls for unauthenticated network access and user IDs  on the mainframe; further limited access to its mainframe environment by limiting access  to system management utility functions and mainframe console  commands; taken several measures to protect information traversing its network,  such as installing a secure communication service for encryption; taken steps to improve its auditing and monitoring capability by  retaining audit logs of security-relevant events for its administrative  accounting system and ensuring that audit logs were being created for  such events on its procurement system; removed authority for unrestricted physical access to the computer  room and tape library from individuals who did not need it to perform  their job; improved controls over physical access proximity cards;   enhanced periodic reviews of mainframe configurations;  improved the disposal of removable media; improved patching of critical vulnerabilities, as well as the timeliness  of applying patches at certain facilities; and   updated contingency plans to document critical business processes. 1). For example, IRS continues to, among other things,    allow sensitive information, including user IDs and passwords for  mission-critical applications, to be readily available to any user on  IRS’s internal network;   use passwords that are not complex enough to avoid being guessed or    grant excessive electronic access to individuals;  inconsistently apply patches; and    not remove separated employees’ access in a timely manner for one of  its systems. According to IRS officials, they are continuing to address  the uncorrected weaknesses, and subsequent to our site visits, they had  completed corrective actions for some of the weaknesses. A key  reason for these weaknesses is that IRS has not yet fully implemented its  agencywide information security program to ensure that controls are  appropriately designed and operating effectively. Furthermore, these  weaknesses continue to jeopardize the confidentiality, integrity, and  availability of IRS’s systems and contributed to IRS’s material weakness in  information security during the fiscal year 2008 financial statement audit. Organizations accomplish this objective by designing and implementing  controls that are intended to prevent, limit, and detect unauthorized  access to computing resources, programs, information, and facilities. In  addition, IRS did not restrict access to sensitive personally identifiable  information. IRS did not always effectively monitor its systems. FISMA requires each agency to  develop, document, and implement an information security program that,  among other things, includes    periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems;   policies and procedures that (1) are based on risk assessments, (2) cost  effectively reduce information security risks to an acceptable level, (3)  ensure that information security is addressed throughout the life cycle  of each system, and (4) ensure compliance with applicable  requirements;   plans for providing adequate information security for networks,  facilities, and systems;   security awareness training to inform personnel of information security  risks and of their responsibilities in complying with agency policies and  procedures, as well as training personnel with significant security  responsibilities for information security;   periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls for  every system identified in the agency’s required inventory of major  information systems;   a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in its information security  policies, procedures, or practices; and   plans and procedures to ensure continuity of operations for  information systems that support the operations and assets of the  agency. Identifying and assessing  information security risks are essential to determining what controls are  required. Until IRS takes  these steps, financial and taxpayer information are at increased risk of  unauthorized disclosure, modification, or destruction, and the agency’s  management decisions may be based on unreliable or inaccurate financial  information. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to determine (1) the status of the  Internal Revenue Service’s (IRS) actions to correct or mitigate previously  reported information security weaknesses and (2) whether controls over  key financial and tax processing systems were effective in protecting the  confidentiality, integrity, and availability of financial and sensitive  taxpayer information.
Why GAO Did This Study

The Internal Revenue Service (IRS) relies extensively on computerized systems to carry out its demanding responsibilities to collect taxes (about $2.7 trillion in fiscal years 2008 and 2007), process tax returns, and enforce the nation's tax laws. Effective information security controls are essential to protect financial and taxpayer information from inadvertent or deliberate misuse, improper disclosure, or destruction. As part of its audits of IRS's fiscal years 2008 and 2007 financial statements, GAO assessed (1) the status of IRS's actions to correct previously reported weaknesses and (2) whether controls were effective in ensuring the confidentiality, integrity, and availability of financial and sensitive taxpayer information. To do this, GAO examined IRS information security policies and procedures and other documents; tested controls over key financial applications; and interviewed key agency officials.

What GAO Found

IRS has continued to make progress in correcting previously reported information security weaknesses. It has corrected or mitigated 49 of the 115 weaknesses that GAO reported as unresolved during its last audit. For example, the agency (1) implemented controls for unauthenticated network access and user IDs on the mainframe, (2) encrypted sensitive data going across its network, (3) improved the patching of critical vulnerabilities, and (4) updated contingency plans to document critical business processes. However, most of the previously identified weaknesses remain unresolved. For example, IRS continues to, among other things, allow sensitive information, including IDs and passwords for mission-critical applications, to be readily available to any user on its internal network, and grant excessive access to individuals who do not need it. According to IRS officials, they are continuing to address the uncorrected weaknesses and, subsequent to GAO site visits, had completed additional corrective actions. Despite IRS's progress, information security control weaknesses continue to jeopardize the confidentiality, integrity, and availability of financial and sensitive taxpayer information. IRS did not consistently implement controls that were intended to prevent, limit, and detect unauthorized access to its systems and information. For example, IRS did not always (1) enforce strong password management for properly identifying and authenticating users; (2) authorize user access, including access to personally identifiable information, to permit only the access needed to perform job functions; (3) encrypt certain sensitive data; (4) effectively monitor changes on its mainframe; and (5) physically protect its computer resources. A key reason for these weaknesses is that IRS has not yet fully implemented its agencywide information security program to ensure that controls are appropriately designed and operating effectively. Specifically, IRS did not annually review risk assessments for certain systems, comprehensively test for certain controls, or always validate the effectiveness of remedial actions. Until these weaknesses are corrected, the agency remains particularly vulnerable to insider threats and IRS is at increased risk of unauthorized access to and disclosure, modification, or destruction of financial and taxpayer information, as well as inadvertent or deliberate disruption of system operations and services.