IRS Also Provides Processing Support for FinCEN

In addition to processing its own financial and tax information, IRS  provides information processing support to FinCEN, another Treasury  bureau. Objectives, Scope, and Methodology

The objectives of our review were to determine (1) the status of IRS’s  actions to correct or mitigate previously reported weaknesses and  (2) whether controls over key financial and tax processing systems located  at the facility have been effective in ensuring the confidentiality, integrity,  and availability of sensitive financial and taxpayer data. Specifically, we evaluated information system controls intended to   limit, detect, and monitor logical and physical access to sensitive  computing resources and facilities, thereby safeguarding them from  misuse and protecting them from unauthorized disclosure and  modification;  maintain operating system integrity through effective administration  and control of powerful computer programs and utilities that execute  privileged instructions;  prevent the introduction of unauthorized changes to application  software in the existing software environment;  ensure that work responsibilities are segregated, so that one individual  does not perform or control all key aspects of computer-related  operations and thereby have the ability to conduct unauthorized actions  or gain unauthorized access to assets or records;  minimize the risk of unplanned interruptions and recover critical  computer processing operations in the case of disaster or other  unexpected interruptions; and  implement an agencywide information security program that includes a  continuing cycle of assessing risk, implementing and promoting policies  and procedures to reduce such risk, and monitoring the effectiveness of  those activities. The agency has corrected or mitigated 32 of the 53  weaknesses that we reported as unresolved at the time of our last review in  2002. While IRS has taken steps to strengthen its information security controls, it  had not completed actions to correct or mitigate the remaining 21  previously reported weaknesses. Serious Weaknesses Place Taxpayer and Bank Secrecy Act Data at Risk

IRS has not effectively implemented information security controls to  properly protect the confidentiality, integrity, and availability of data  processed by the facility’s computers and networks. Collectively, these weaknesses threaten IRS’s ability to perform its  operational missions, such as processing tax returns and law enforcement  information, both of which rely on IRS’s computer systems and networks to  process, store, and transmit data. Access controls over the mainframe computing environment did not  logically separate IRS’s data from FinCEN’s data. For example, IRS did not adequately secure its network  against known vulnerabilities or misconfigured network services on  several of its infrastructure devices. Unless these weaknesses are corrected, sensitive taxpayer and Bank  Secrecy Act data will remain at risk of unauthorized disclosure, use,  modification, or destruction, possibly without detection. Information Security Program Is Not Fully Implemented at IRS

The weaknesses described in this report are symptomatic of an agencywide  information security program that is not fully implemented across IRS. In  addition, weaknesses in physical security, segregation of duties, and  service continuity increase the level of risk. Although IRS continues to  make progress in mitigating previously reported information security  weaknesses and implementing general controls over key financial and tax  processing systems at the facility, it has not taken all the necessary steps to  mitigate known information security control weaknesses and to ensure the  confidentiality, integrity, and availability of taxpayer and Bank Secrecy Act  data.
Why GAO Did This Study

The Internal Revenue Service (IRS) relies extensively on computerized systems to support its financial and mission-related operations. In addition, IRS provides computer processing support to the Financial Crimes Enforcement Network (FinCEN)--another Treasury bureau. As part of IRS's fiscal year 2004 financial statements, GAO assessed (1) the status of IRS's actions to correct or mitigate previously reported weaknesses at one of its critical data processing facilities and (2) the effectiveness of IRS's information security controls in protecting the confidentiality, integrity, and availability of key financial and tax processing systems.

What GAO Found

IRS has made progress in correcting or mitigating previously reported information security weaknesses and in implementing controls over key financial and tax processing systems that are located at one of its critical data processing facilities. It has corrected or mitigated 32 of the 53 weaknesses that GAO reported as unresolved at the time of our prior review in 2002. However, in addition to the remaining 21 previously reported weaknesses for which IRS has not completed actions, 39 newly identified information security control weaknesses impair IRS's ability to ensure the confidentiality, integrity, and availability of its sensitive financial and taxpayer data and FinCEN's Bank Secrecy Act data. For example, IRS has not implemented effective electronic access controls over its mainframe computing environment to logically separate its taxpayer data from FinCEN's Bank Secrecy Act data--two types of data with different security requirements. In addition, IRS has not effectively implemented certain other information security controls relating to physical security, segregation of duties, and service continuity at the facility. Collectively, these weaknesses increase the risk that sensitive taxpayer and Bank Secrecy Act data will be inadequately protected from unauthorized disclosure, modification, use, or destruction. Moreover, weaknesses in service continuity and business resumption plans heighten the risk that assets will be inadequately protected and controlled to ensure the continuity of operations when unexpected interruptions occur. An underlying cause of these information security control weaknesses is that IRS has not fully implemented certain elements of its agencywide information security program. Until IRS fully implements a comprehensive agencywide information security program, its facilities and computing resources and the information that is processed, stored, and transmitted on its systems will remain vulnerable.