Monday, February 04, 2008
Computer security problems found at IRS
Computer security problems found at IRS
Employees provided computer data without questioning identity
By Jim Abrams
The Associated Press
updated 10:53 a.m. CT, Fri., Aug. 3, 2007
WASHINGTON - IRS employees ignored security rules and turned over sensitive computer information to a caller posing as a technical support person, according to a government study.
Sixty-one of the 102 people who got the test calls, including managers and a contractor, complied with a request that the employee provide his or her user name and temporarily change his or her password to one the caller suggested, according to the Treasury Inspector General for Tax Administration, an office that does oversight of Internal Revenue Service.
The caller asked for assistance to correct a computer problem.
The report said that by failing to question the identity of the caller the employees were putting the IRS at risk of providing unauthorized people access to taxpayer data that could be used for identity theft and other fraudulent schemes.
"This is especially disturbing because the IRS has taken many steps to raise employee awareness of the importance of protecting their computers and passwords," said Inspector General J. Russell George.
Only eight of the 102 employees contacted either the inspector general's office or IRS security offices to validate the legitimacy of the caller.
The report said the IRS took measures to improve security after two similar test telephone calls in 2001 and 2004. "However, the corrective actions have not been effective," it said.
The IRS agreed with recommendations from the inspector general that it should take steps to make employees more aware of hacker tactics such as posing as an internal employee and to remind people to report such incidents to security officials.
The IRS has nearly 100,000 employees and contractors with access to tax return information processed on about 240 computer systems and more than 1,500 databases.
Employees provided computer data without questioning identity
By Jim Abrams
The Associated Press
updated 10:53 a.m. CT, Fri., Aug. 3, 2007
WASHINGTON - IRS employees ignored security rules and turned over sensitive computer information to a caller posing as a technical support person, according to a government study.
Sixty-one of the 102 people who got the test calls, including managers and a contractor, complied with a request that the employee provide his or her user name and temporarily change his or her password to one the caller suggested, according to the Treasury Inspector General for Tax Administration, an office that does oversight of Internal Revenue Service.
The caller asked for assistance to correct a computer problem.
The report said that by failing to question the identity of the caller the employees were putting the IRS at risk of providing unauthorized people access to taxpayer data that could be used for identity theft and other fraudulent schemes.
"This is especially disturbing because the IRS has taken many steps to raise employee awareness of the importance of protecting their computers and passwords," said Inspector General J. Russell George.
Only eight of the 102 employees contacted either the inspector general's office or IRS security offices to validate the legitimacy of the caller.
The report said the IRS took measures to improve security after two similar test telephone calls in 2001 and 2004. "However, the corrective actions have not been effective," it said.
The IRS agreed with recommendations from the inspector general that it should take steps to make employees more aware of hacker tactics such as posing as an internal employee and to remind people to report such incidents to security officials.
The IRS has nearly 100,000 employees and contractors with access to tax return information processed on about 240 computer systems and more than 1,500 databases.
Labels: IRS
Tuesday, April 10, 2007
IRS Still Has Security Weaknesses to Address
IRS Still Has Security Weaknesses to Address, Says GAO (April 4, 2007) According to a report from the Government Accountability Office (GAO), the IRS "has made limited progress toward correcting or mitigating previously reported information security weaknesses at two data processing sites." Two-thirds of previously identified weaknesses are still present. Areas of progress include improving password controls on servers and "enhanced audit and monitoring efforts for mainframe and Windows user activity." Problems yet to be addressed include inadequate access controls, inadequate segregation of duties and the lack of an implemented agency-wide information security program, which is required by the Federal Information Security Management Act (FISMA). GAO developed two sets of recommendations - one for the Commissioner of Internal Revenue "to take several actions to fully implement a comprehensive agency-wide information security program," and another set, limited in its scope of distribution, with recommendations for "actions to be taken to correct ... specific information security weaknesses."
Labels: IRS
IRS Data Not Adequately Protected
--IRS Data Not Adequately Protected, Says IG (April 5, 2007) According to a March 23, 2007 report from Treasury Inspector General for Tax Administration J. Russell George, "the IRS is not adequately protecting taxpayer data on laptop computers and other portable electronic media devices." In the three-and-a-half year period from January 2003 through June 2006, nearly 500 IRS laptops were lost or stolen. Many of the incidents were not reported to the IRS computer security office. While there is "limited definitive information" about the data on the missing and stolen computers, the IG's office tested 100 laptops currently in use at the IRS and found 44 with "unencrypted sensitive data, including taxpayer data and employee personnel data."
IRS Commissioner Mark Everson says the agency has installed automatic encryption software on almost all laptops currently in use and all laptops have been issued locks.
IRS Commissioner Mark Everson says the agency has installed automatic encryption software on almost all laptops currently in use and all laptops have been issued locks.
Labels: IRS
