IRS Has Demanding Responsibilities as the United States’ Tax Collector

IRS has demanding responsibilities in collecting taxes, processing tax  returns, and enforcing the federal tax laws, and relies extensively on  computerized systems to support its financial and mission-related  operations. IRS Has Made Progress in Correcting Previously Reported Weaknesses

During fiscal year 2009, IRS has made progress toward correcting  previously reported information security control weaknesses and  information security program deficiencies at its three computing centers,  another facility, and enterprisewide. IRS had corrected or mitigated 28 of  the 89 previously identified weaknesses and deficiencies that were  unresolved at the end of our prior audit. This includes 21 of 74 control  weaknesses and 7 of 15 program deficiencies. For example, it has    changed vendor-supplied user accounts and passwords,    avoided storing clear-text passwords in scripts,    deactivated proximity cards for separated employees in a timely manner,    ensured that security guards follow established procedures and screen  packages and briefcases for prohibited items. For example, IRS has enhanced its policies and procedures for configuring  mainframe operations and established an alternate processing site for its  procurement system. Nonetheless, of the previously identified security weaknesses and program  deficiencies reported as unresolved at the completion of our prior year’s  audit, 61 of them—or about 69 percent—remain unresolved or  unmitigated. As a result, IRS is at increased risk of unauthorized disclosure,  modification, or destruction of financial and taxpayer information. These weaknesses—both old and new—continue to jeopardize the  confidentiality, integrity, and availability of IRS’s systems and were the  basis of our determination that IRS had a material weakness in internal  controls over financial reporting related to information security in fiscal  year 2009. Organizations accomplish this objective by designing and implementing  controls that are intended to prevent, limit, and detect unauthorized  access to computing resources, programs, information, and facilities. IRS did not always enforce strong identification and authentication  controls. Further, IRS did  not sufficiently protect passwords during transmission. To restrict legitimate users’  access to only those programs and files they need to do their work,  organizations establish access rights and permissions. IRS did not always log and monitor important security events on its  systems. Subsequent to our site visit, IRS informed us  that it had corrected this weakness. IRS Has Not Fully Implemented All Elements of Its Information Security Program

A key reason for the information security weaknesses in IRS’s financial  and tax processing systems is that it has not yet fully implemented its  agencywide information security program to ensure that controls are  effectively established and maintained. FISMA requires each agency to  develop, document, and implement an information security program that,  among other things, includes    periodic assessments of the risk and magnitude of harm that could result  from the unauthorized access, use, disclosure, disruption, modification, or  destruction of information and information systems;   policies and procedures that (1) are based on risk assessments, (2) cost- effectively reduce information security risks to an acceptable level, (3)  ensure that information security is addressed throughout the life cycle of  each system, and (4) ensure compliance with applicable requirements;   plans for providing adequate information security for networks, facilities,    security awareness training to inform personnel of information security  risks and of their responsibilities in complying with agency policies and  procedures, as well as training personnel with significant security  responsibilities for information security;   periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices, to be performed with a frequency  depending on risk, but no less than annually, and that includes testing of  management, operational, and technical controls for every system  identified in the agency’s required inventory of major information systems;    a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in its information security  policies, procedures, or practices; and    plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency. Identifying and assessing information security risks are  essential to determining what controls are required. Although remedial action plans were in place, corrective actions were not  always appropriately verified. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to determine (1) the status of the  Internal Revenue Service’s (IRS) actions to correct or mitigate previously  reported information security weaknesses and (2) whether controls over  key financial and tax processing systems were effective in protecting the  confidentiality, integrity, and availability of financial and sensitive  taxpayer information.
Why GAO Did This Study

The Internal Revenue Service (IRS) relies extensively on computerized systems to carry out its demanding responsibilities to collect taxes, process tax returns, and enforce the nation's tax laws. Effective information security controls are essential to protect financial and taxpayer information from inadvertent or deliberate misuse, improper disclosure, or destruction. As part of its audit of IRS's fiscal years 2009 and 2008 financial statements, GAO assessed (1) the status of IRS's actions to correct or mitigate previously reported information security weaknesses and (2) whether controls over key financial and tax processing systems are effective in ensuring the confidentiality, integrity, and availability of financial and sensitive taxpayer information. To do this, GAO examined IRS information security policies, plans, and procedures; tested controls over key financial applications; and interviewed key agency officials at six sites.

What GAO Found

IRS has continued to make progress during fiscal year 2009 in correcting previously reported information security weaknesses that GAO reported as unresolved at the conclusion of its fiscal year 2008 audit. Specifically, IRS has corrected or mitigated 28 of the 89 weaknesses and deficiencies--21 of 74 previously identified information security control weaknesses and 7 of 15 previously identified program deficiencies. For example, it has (1) changed vendor-supplied user accounts and passwords; (2) avoided storing clear-text passwords in scripts; (3) enhanced its policies and procedures for configuring mainframe operations; and (4) established an alternate processing site for its procurement system. While IRS has corrected 28 control weaknesses and program deficiencies, 61 of them--or about 69 percent--remain unresolved or unmitigated. For example, IRS continued to install patches in an untimely manner and used passwords that were not complex. In addition, IRS did not always verify that remedial actions were implemented or effectively mitigated the security weaknesses. According to IRS officials, they continued to address uncorrected weaknesses and, subsequent to GAO's site visits, had completed additional corrective actions on some of them. Despite these actions, newly identified and the unresolved information security control weaknesses in key financial and tax processing systems continue to jeopardize the confidentiality, integrity, and availability of financial and sensitive taxpayer information. IRS did not consistently implement controls that were intended to prevent, limit, and detect unauthorized access to its systems and information. For example, IRS did not always (1) enforce strong password management for properly identifying and authenticating users; (2) authorize user access to permit only the access needed to perform job functions; (3) log and monitor security events on a key system; and (4) physically protect its computer resources. A key reason for these weaknesses is that IRS has not yet fully implemented its agencywide information security program to ensure that controls are appropriately designed and operating effectively. Although IRS has made important progress in developing and documenting its information security program, it did not, among other things, review risk assessments at least annually for certain systems or ensure contractors receive awareness training. Until these control weaknesses and program deficiencies are corrected, the agency remains unnecessarily vulnerable to insider threats related to the unauthorized access to and disclosure, modification, or destruction of financial and taxpayer information, as well as the disruption of system operations and services. The new and unresolved weaknesses and deficiencies are the basis for GAO's determination that IRS had a material weakness in internal controls over financial reporting related to information security in fiscal year 2009.