TIGTA: The IRS lacks secure Web servers

Unauthorized and insecure Web servers connect to the Internal Revenue Service’s network, which puts the agency’s computers and entire network at risk of unauthorized access to taxpayer and personally identifiable information, the Treasury Inspector General for Tax Administration said in a recent report.

The IRS has 1,811 unapproved internal Web servers on the network and 2,093 internal Web servers that have some security weaknesses, the TIGTA report, released Sept. 3, states.

The IRS requires that business units register all internal Web sites and Web servers with the Modernization and Information Technology Services organization, but some fail to register their servers, the report states. The IRS might block unregistered servers from sharing information with the network.

Because no office had responsibility for the Web registration program, the IRS has not enforced the requirement, allowing Web servers to connect to the network without proper authorization and accountability, the report states.

“Malicious hackers or disgruntled employees could exploit the vulnerabilities on these Web servers to manipulate data on the server or use the servers as a launching point to attack other computers on the network,” said Michael Phillips, deputy IG for audit.

The IRS also was using 33 different Web server software packages. Phillips said the agency should use as few products as possible to limit security risks.

Among its recommendations, TIGTA urged the IRS’ chief information officer to:


  • Assign responsibility for overseeing the Web registration program to one division of the agency.



  • Enforce rules that ban unauthorized Web servers from sharing data with the agency’s network.



  • Require an annual scan of Web servers, compare the results with the Web registration database and immediately disconnect unauthorized servers from the IRS network.



  • Perform quarterly network scans of Web servers to measure compliance with security requirements.


In response, IRS Chief Information Officer Arthur Gonzalez said the associate CIO for enterprise operations would be responsible for the Web registration program and database by Oct. 1. The IRS also will take steps to identify unauthorized Web servers and create policies and procedures to prohibit them from providing data via the IRS network by May 1, 2009. In addition, Gonzalez said the IRS will compare annual scans and disconnect noncompliant Web servers and perform quarterly security assessments of Web servers to measure compliance by Aug. 1, 2009.

About the Author

Mary Mosquera is a reporter for Federal Computer Week.

Featured

  • Contracting
    8 prototypes of the border walls as tweeted by CBP San Diego

    DHS contractors face protests – on the streets

    Tech companies are facing protests internally from workers and externally from activists about doing for government amid controversial policies like "zero tolerance" for illegal immigration.

  • Workforce
    By Mark Van Scyoc Royalty-free stock photo ID: 285175268

    At OPM, Weichert pushes direct hire, pay agent changes

    Margaret Weichert, now acting director of the Office of Personnel Management, is clearing agencies to make direct hires in IT, cyber and other tech fields and is changing pay for specialized occupations.

  • Cloud
    Shutterstock ID ID: 222190471 By wk1003mike

    IBM protests JEDI cloud deal

    As the deadline to submit bids on the Pentagon's $10 billion, 10-year warfighter cloud deal draws near, IBM announced a legal protest.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.