Oversight

GAO: IRS has information security control weaknesses

gold shield on top of computer code

The Internal Revenue Service continues to have weaknesses in information security control that the Government Accountability Office fears could affect the confidentiality, integrity and availability of financial and sensitive taxpayer data.

An April 8 GAO report found that although the IRS has improved on information security control and internal control over financial reporting, significant risks remain.

The agency has failed to consistently install the appropriate patches on all databases and servers to protect against known vulnerabilities, GAO found, and also failed to sufficiently monitor database controls and appropriately restrict access to its mainframe environment. The IRS has also allowed individuals to make changes to mainframe data processing without following required procedures.

“Without effective audit and monitoring, IRS’s ability to establish individual accountability, monitor compliance with security and configuration management policies, and investigate information systems security violations is limited,” the report reads.

GAO found one of the main reasons for the ongoing weaknesses is the failure of the IRS to implement portions of its information security program, which have not always functioned as intended, such as the agency’s testing procedures for financial reporting systems.  

GAO also provided three recommendations for the IRS to fix its weaknesses: update access request procedures to ensure appropriate access privileges; update information policies and procedures; and develop a plan to address the known and newly identified vulnerabilities.

About the Author

Mike Cipriano is a GCN editorial intern, and also writes occasionally for FCW. Connect with him on Twitter: @mikecip07.

Featured

  • Defense
    Soldiers from the Old Guard test the second iteration of the Integrated Visual Augmentation System (IVAS) capability set during an exercise at Fort Belvoir, VA in Fall 2019. Photo by Courtney Bacon

    IVAS and the future of defense acquisition

    The Army’s Integrated Visual Augmentation System has been in the works for years, but the potentially multibillion deal could mark a paradigm shift in how the Defense Department buys and leverages technology.

  • Cybersecurity
    Deputy Secretary of Homeland Security Alejandro Mayorkas  (U.S. Coast Guard photo by Petty Officer 3rd Class Lora Ratliff)

    Mayorkas announces cyber 'sprints' on ransomware, ICS, workforce

    The Homeland Security secretary announced a series of focused efforts to address issues around ransomware, critical infrastructure and the agency's workforce that will all be launched in the coming weeks.

Stay Connected