Information Security: Continued Progress Needed to Strengthen Controls at the Internal Revenue Service
Released: 2006-03-23T00:00:00

Letter

Background

Information security is an important consideration for any organization that depends on information systems and computer networks to carry out its mission or business. The same speed and accessibility that create the enormous benefits of the computer age can, if not properly controlled, allow individuals and groups with malicious intent to intrude into inadequately protected systems and use this access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer networks and systems.

Protecting computer systems that support critical operations and infrastructures is important due to the concern about attacks from individuals and groups, including terrorists. These concerns are well founded for a number of reasons, including the ease of obtaining and using hacking tools, the steady advance in the sophistication and effectiveness of attack technology, and the warnings of new and more destructive attacks to come.

Computer-supported federal operations are likewise at risk. Our previous reports, and those of agency inspectors general, describe persistent information security weaknesses that place a variety of critical federal operations, including those at IRS, at risk of disruption, fraud, and inappropriate disclosure. We have designated information security as a governmentwide high-risk area since 1997—a designation that remains today.

In December 2002, Congress enacted the Federal Information Security Management Act of 2002 (FISMA) to strengthen security of information and systems within federal agencies. FISMA requires each agency to develop, document, and implement an agencywide information security program to provide information security for the information and systems that support the operations and assets of the agency.

In its role as the nation’s tax collector, IRS has a demanding responsibility in collecting taxes, processing tax returns, and enforcing the nation’s tax laws. In fiscal year 2005, IRS collected about $2.3 trillion in tax payments, processed hundreds of millions of tax and information returns, and paid about $267 billion in refunds to taxpayers. IRS is a large and complex organization, with a unique mission that adds operational challenges for management. It employs tens of thousands of people in 10 service center campuses, three computing centers, and numerous other field offices throughout the United States. Because of the nature of its mission, IRS also collects and maintains a significant amount of personal and financial data on each American taxpayer. The confidentiality of this sensitive information must be protected; otherwise, taxpayers could be exposed to loss of privacy and to financial loss and damages resulting from identity theft or other financial crimes.

The Commissioner of Internal Revenue has overall responsibility for ensuring the confidentiality, availability, and integrity of information and information systems supporting the agency and its operations. The Chief of Mission Assurance and Security Services is responsible for developing policies and procedures regarding information technology security; providing assurance services to improve physical, data, and personnel security; conducting independent testing; and ensuring security is integrated into its modernization activities. To help accomplish these goals, IRS has developed and published information security policies, guidelines, standards, and procedures in the Internal Revenue Manual, Law Enforcement Manual, and other documents.

Objectives, Scope, and Methodology

The objectives of our review were to determine (1) the status of IRS’s actions to correct or mitigate previously reported weaknesses at two sites and (2) whether controls over key financial and tax processing systems located at the sites are effective in ensuring the confidentiality, integrity, and availability of financial and sensitive taxpayer data. We concentrated our evaluation primarily on threats emanating from internal sources on IRS’s computer networks. Our evaluation was based on (1) our Federal Information System Controls Audit Manual, which contains guidance for reviewing information system controls that affect the confidentiality, integrity, and availability of computerized data; (2) FISMA, which sets key elements that are required for an effective information security program; and (3) previous reports from the Treasury Inspector General for Tax Administration (TIGTA).

Specifically, we evaluated information security controls that are intended to prevent, limit, and detect electronic access to computer resources (data, programs, and systems), thereby protecting these resources against unauthorized disclosure, modification, and use; provide physical protection of computer facilities and resources from espionage, sabotage, damage, and theft; prevent the exploitation of vulnerabilities; prevent the introduction of unauthorized changes to application or ensure that work responsibilities for computer functions are segregated so that one individual does not perform or control all key aspects of computer-related operations and, thereby, have the ability to conduct unauthorized actions or gain unauthorized access to assets or records without detection by another individual performing assigned responsibilities.

In addition, we evaluated IRS’s information security program. Such a program includes assessing risk; developing and implementing policies, procedures, and security plans; providing security awareness and training; testing and evaluating control effectiveness; planning, implementing, evaluating, and documenting remedial action to address information security deficiencies; detecting, reporting, and responding to security incidents; and ensuring continuity of operations.

To evaluate IRS’s information security controls and program, we identified and reviewed pertinent IRS information security policies and procedures, guidance, security plans, relevant reports, and other documents, and we tested the effectiveness of these controls at two of IRS’s critical data processing sites. Specifically, our tests focused on three critical applications, as well as three general support systems located at the two sites. We also discussed with key security representatives and management officials whether information security controls were in place, adequately designed, and operating effectively.

We performed our review at the two previously mentioned IRS sites in accordance with generally accepted government auditing standards from June through November 2005. We discussed the results of our review with IRS officials.

IRS Has Made Progress in Correcting Previously Reported Weaknesses

IRS has made progress toward implementing more effective information security controls over key financial and tax processing systems that are located at two critical data processing sites, and has corrected or mitigated 41 of the 81 specific technical weaknesses that we reported as unresolved at the time of our last reviews at the selected sites. Actions have been taken to address weaknesses related to electronic access, physical access, and software change controls, among others. For example, IRS has implemented controls to protect mainframe system files that contain embedded user accounts and passwords; improved the security of authentication data for network devices, such as routers and switches; securely configured certain vulnerable network services to help prevent implemented procedures for periodically reviewing employee access to ensured that its software change control process includes the submission of documented test plans.

Additionally, IRS addressed critical mainframe weaknesses. In 2005, we reported that IRS had not implemented effective electronic access controls over its mainframe computing environment to logically separate its taxpayer data from the Financial Crimes Enforcement Network’s Bank Secrecy Act data, which include information related to financial crimes, terrorist financing, money laundering, and other illicit activities. These two types of data have different security requirements, and, accordingly, we made specific recommendations to correct these access control weaknesses. Since our last report, IRS has taken action to mitigate these weaknesses.

Although IRS has taken steps to strengthen its information security controls, it had not completed actions to correct or mitigate the remaining 40 previously reported technical weaknesses as illustrated in figure 1.

These weaknesses include routinely permitting unencrypted protocols for remote log-on capability; not taking sufficient measures to prevent attackers from accessing information, copying sensitive files, and introducing malicious code via CD-ROM drives; inadequately restricting access to certain accounts with powerful rights over the system’s operating system; and configuring servers without ensuring sufficient audit trails. Failure to resolve these issues will leave sensitive IRS computing resources and data vulnerable to unauthorized access, manipulation, and destruction.

In addition, last year we made three recommendations related to improving IRS’s information security program. These recommendations included ensuring that established security policies and procedures are consistently followed and implemented, ensuring that employees with significant information security responsibilities are provided with the sufficient training and understand their role in implementing security-related policies and controls, and implementing an ongoing process of testing and evaluating systems to ensure compliance with established policies and procedures. IRS agreed to implement these recommendations and is in the process of doing so.

Significant Weaknesses Place Financial and Taxpayer Data at Risk

Although IRS has made progress in implementing information security for its financial and tax processing systems and information by addressing many of its previously identified security weaknesses, significant weaknesses in electronic access and other information security controls continue to threaten the confidentiality, integrity, and availability of those systems and information. A primary reason for these weaknesses is that IRS has not yet fully implemented its information security program. As a result, weaknesses in controls over its key financial and tax processing systems could impair IRS’s ability to perform vital functions and increase the risk of unauthorized disclosure, modification, or destruction of taxpayer data.

Electronic Access Controls Were Inadequate

A basic management objective for any organization is to protect the resources that support its critical operations from unauthorized access. Organizations accomplish this objective by designing and implementing controls that are intended to prevent, limit, and detect unauthorized access to computing resources, programs, and information. Electronic access controls include those related to network management, user accounts and passwords, user rights and file permissions, and logging and monitoring of security-relevant events. Inadequate controls over electronic processes diminish the reliability of computerized information, and they increase the risk of unauthorized disclosure, modification, and destruction of sensitive information and of disruption of service.

IRS’s electronic access controls were inadequate. Serious weaknesses existed in network management, user accounts and passwords, user rights and file permissions, and logging and monitoring of security-relevant events.

Network Management

Networks are collections of interconnected computer systems and devices that allow individuals to share resources, such as computer programs and information. Because sensitive programs and information are stored on or transmitted along networks, effectively securing networks is essential to protecting computing resources and data from unauthorized access, manipulation, and use. Organizations secure their networks, in part, by installing and configuring network devices that permit authorized network service requests, deny unauthorized requests, and limit the services that are available on the network. Devices used to secure networks include (1) firewalls that prevent unauthorized access to the network, (2) routers that filter and forward data along the network, (3) switches that forward information among segments of a network, and (4) servers that host applications and data. Network services consist of protocols for transmitting data between network devices. Insecurely configured network services and devices can make a system vulnerable to internal or external threats, such as denial-of-service attacks. Because networks often include both external and internal access points for electronic information assets, failure to secure these assets increases the risk of unauthorized modification of sensitive information and systems, or disruption of service.

IRS did not consistently configure network services and devices securely to prevent unauthorized access to and ensure the integrity of computer systems operating on its networks. For example, it did not sufficiently prevent the use of vulnerable remote services on servers. In addition, IRS’s network management traffic was not segregated from normal user traffic, and IRS continued to rely on unencrypted protocols for remote management of certain devices. As a result, the agency is at increased risk of system compromise, such as unauthorized access to and manipulation of sensitive system data, disruption of services, and denial of service.

According to IRS officials, the agency took actions to mitigate the network traffic management weakness subsequent to our site visits.

User Accounts and Passwords

A computer system must be able to identify and differentiate among users so that activities on the system can be linked to specific individuals. When an organization assigns unique user accounts to specific users, the system distinguishes one user from another—a process called identification. The system must also establish the validity of a user’s claimed identity though some means of authentication, such as a password, that is known only to its owner. The combination of identification and authentication—such as user account/password combinations—provides the basis for establishing individual accountability and for controlling access to the system. Accordingly, agencies (1) establish password parameters, such as number of characters, type of characters, and the frequency with which users should change their passwords, in order to strengthen the effectiveness of passwords for authenticating the identity of users; (2) require encryption for passwords to prevent their disclosure to unauthorized individuals; and (3) implement procedures to control the use of user accounts. IRS policy identifies and prescribes minimum requirements for creating and managing passwords, such as minimum password length.

IRS did not adequately control user accounts and passwords to ensure that only authorized individuals were granted access to its systems. Although IRS has a policy in place addressing password expiration and complexity, it has not always implemented these requirements. For example, the agency did not always implement the use of complex passwords on its Windows servers. It also set the password expiration on a Windows server to a value inconsistent with its policy, and did not adequately control the storage of passwords on its systems. For example, instead of using encryption, IRS stored clear text passwords in readable form at one of the sites. Further, it had not implemented procedures to control user accounts by not adequately limiting the number of superuser accounts for over half of the UNIX servers reviewed. These practices increase the risk that individuals might gain unauthorized access to critical resources without attribution.

User Rights and File Permissions The concept of “least privilege” is a basic underlying principle for securing computer systems and data. It means that users are granted only those access rights and permissions that they need to perform their official duties. To restrict legitimate users’ access to only those programs and files that they need to do their work, organizations establish access rights and permissions. “User rights” are allowable actions that can be assigned to users or to groups of users. File and directory permissions are rules that are associated with a particular file or directory and regulate which users can access them and the extent of that access. To avoid unintentionally giving users unnecessary access to sensitive files and directories, an organization must give careful consideration to its assignment of rights and permissions. IRS policy states that users should only be given the minimum level of permissions needed to perform job duties.

IRS permitted excessive access to key financial systems, granting rights and permissions that allowed more access than users needed to perform their jobs. For example, IRS granted administrators of certain Windows servers a user right that could allow them to add false entries into the security log. In addition, it granted all users on one Windows server “read” access to a certain registry setting that would allow users to remotely read sensitive system settings. Further, IRS granted mainframe users privileges that were not needed to perform assigned job duties. For example, all mainframe users were granted a powerful privilege that would allow users to read, execute, modify, delete, or create new datasets without restriction. Inappropriate access to sensitive files and directories provides opportunities for individuals to circumvent security controls to deliberately or inadvertently read, modify, or delete critical or sensitive information.

Logging and Monitoring of Security-Relevant Events

To establish individual accountability, monitor compliance with security policies, and investigate security violations, it is crucial to determine what, when, and by whom specific actions have been taken on a system. Organizations accomplish this by implementing system or security software that provides an audit trail, or logs of system activity, that they can use to determine the source of a transaction or attempted transaction and to monitor users’ activities. The way in which organizations configure system or security software determines the nature and extent of information that can be provided by the audit trail. To be effective, organizations should configure their software to collect and maintain audit trails that are sufficient to track security-relevant events. IRS policy states that audit logs must be generated for use in monitoring security-related events on all multiuser systems, and that these logs must be periodically reviewed. Further, National Institute of Standards and Technology (NIST) guidance states that organizations should deploy centralized logging servers and configure devices to send duplicates of their log entries to the centralized servers.

IRS was not adequately logging and monitoring security-relevant events. For example, two Windows servers at one site were not configured to log successful and failed attempts to access directory services. In addition, neither of the sites visited had implemented centralized logging and monitoring of logs for any of the UNIX servers reviewed. Further, at one site, although IRS was logging system developer activity in the production environment, they were not monitoring the logs. As a result, the agency is at increased risk that unauthorized or inappropriate system activity may not be detected.

Other Information System Controls Were Not Sufficient

In addition to electronic access controls, other important controls should be in place to ensure the confidentiality, integrity, and availability of an organization’s data. These controls include policies, procedures, and control techniques to physically secure computer resources, prevent exploitation of vulnerabilities, and prevent unauthorized changes to system software. Weaknesses in these areas increase the risk of unauthorized use, disclosure, modification, or loss of IRS’s information systems and information.

Physical Security

Physical security controls are important for protecting computer facilities and resources from espionage, sabotage, damage, and theft. These controls restrict physical access to computer resources, usually by limiting access to the buildings and rooms in which the resources are housed and by periodically reviewing the access granted, in order to ensure that access continues to be appropriate. Examples of physical security controls include perimeter fencing, surveillance cameras, security guards, and locks. The agency has developed and documented policies that identify minimum physical protection measures for facilities used to process, transmit, or store sensitive but unclassified information in support of critical operations and missions. For example, one such IRS policy requires that a facility risk assessment should be performed at least once every 5 years. Inadequate physical security could lead to loss of life and property, disruption of functions and services, and unauthorized disclosure of documents and information.

Although IRS has implemented physical security controls, certain weaknesses reduce the effectiveness of these controls in protecting and controlling physical access to assets at the two sites we reviewed. For example, guards at one site did not always examine IRS-issued photo identification to verify employees’ identities as they entered the facility. Failure to check IRS-issued photo identification increases the risk that unauthorized individuals could gain entrance to the facility. However, following our notification of this issue, agency officials took immediate action during our visit to ensure that the security guards always verified each employee’s identity against official IRS photo identification.

In addition, IRS has not fully implemented a procedure for periodically reviewing employee access to sensitive areas. Although steps have been taken to implement such a procedure, access to sensitive areas was not being limited to individuals with an ongoing need for that access. Site officials acknowledged this problem and stated that efforts are under way to correct it.

Further, although IRS policy requires that a facility risk assessment be performed at least once every 5 years, one site’s most recent facility risk assessment was conducted about 5 years ago, and agency officials confirmed that an updated assessment was not planned or under way. The lack of a current facility risk assessment hinders IRS’s ability to determine the effectiveness and appropriateness of existing safeguards and security guidelines.

Patch Management

Patch management is a critical process that can help alleviate many of the challenges of securing computing systems. As vulnerabilities in a system are discovered, attackers may attempt to exploit them, possibly causing significant damage. Malicious acts can range from defacing Web sites to taking control of entire systems and thereby being able to read, modify, or delete sensitive information; disrupt operations; or launch attacks against other organizations’ systems. After a vulnerability is validated, the software vendor may develop and test a patch or workaround. Incident response groups and software vendors issue information updates on the vulnerability and the availability of patches. IRS’s patch management policy assigns organizational responsibilities for the patch management process— including the application of countermeasures to mitigate system vulnerabilities if patch testing fails—and requires that patches be kept up to date or that officials otherwise apply for a waiver.

IRS did not consistently install software patches in a timely manner. For example, IRS’s installation of critical or high-priority patches through the configuration management process for Windows systems was not timely. Further, several patches—some that had been issued in 2001—had not been applied to certain UNIX servers that we reviewed in 2005. Because IRS had not yet installed the latest patches, servers used for processing financial information and taxpayer data were vulnerable to denial-of- service attacks and to execution of arbitrary code that will allow administrative privileges.

System Change Controls

It is important to ensure that only authorized and fully tested systems are placed in operation. To ensure that changes to systems are necessary, work as intended, and do not result in the loss of data or program integrity, such changes should be documented, authorized, tested, and independently reviewed. In addition, according to IRS policy, a security goal of configuration management is to know what changes occur and how they will affect system security.

IRS did not consistently document changes to critical mainframe system files. Changes to key file directories—which could contain program files that can override security controls—were not always logged. Without proper documentation of changes to critical system files, IRS is unable to effectively detect unusual or unauthorized modifications to its systems. This increases the risk that undocumented changes could be made, jeopardizing the security of sensitive information and increasing the likelihood of disruptions to system operations.

Information Security Program Is Not Yet Fully Implemented

A key reason for the information security weaknesses in IRS’s financial and tax processing systems was that although the agency has developed and documented policies and procedures, it has not yet fully implemented its information security program to help ensure that effective controls were established and maintained.

FISMA requires agencies to develop, document, and implement an information security program that includes periodic assessments of the risk and the magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems; policies and procedures that (1) are based on risk assessments, (2) cost- effectively reduce risks, (3) ensure that information security is addressed throughout the life cycle of each system, and (4) ensure compliance with applicable requirements; plans for providing adequate information security for networks, facilities, and systems; security awareness training to inform personnel—including contractors and other users of information systems—of information security risks and of their responsibilities in complying with agency policies and procedures; at least annual testing and evaluation of the effectiveness of information security policies, procedures, and practices relating to management, operational, and technical controls of every major information system that is identified in the agencies’ inventories; a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in their information security policies, procedures, or practices; procedures for detecting, reporting, and responding to security plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency.

IRS has made important progress in developing a framework for its information security program. IRS’s policy on information technology security requires each of these FISMA elements, and the agency has initiatives under way in each of these areas. Specifically, IRS has established a methodology for its general support system certification and accreditation process, including guidance on conducting risk assessments and security test and evaluations, and developing security plans; the office of Mission Assurance and Security Services for developing policies and procedures regarding information technology security; a policy describing requirements for its security awareness and training a working group to develop and execute an approach to managing the remedial action tracking and implementation process; the Computer Security Incident Response Center for detecting and responding to intrusions and misuse; and business resumption plans that address continuity of operations for certain systems.

However, we identified instances in which the information security program had not been fully or consistently implemented for IRS’s information systems. In discussions during our review, agency officials recognized that more work is needed to continue to improve their information security program.

Risk Assessments

Identifying and assessing information security risks are essential steps in determining what controls are required. Moreover, by increasing awareness of risks, these assessments can generate support for the policies and controls that are adopted in order to help ensure that these policies and controls operate as intended. Office of Management and Budget (OMB) Circular A-130, appendix III, prescribes that risk be reassessed when significant changes are made to computerized systems—or at least every 3 years. Consistent with NIST guidance, IRS requires its risk assessment process to detail the residual risk assessed, potential threats, and recommended corrective actions for reducing or eliminating the vulnerabilities identified.

IRS generally identified and assessed information security risks. The six risk assessments that we reviewed were current and documented residual risk assessed, potential threats, and recommended corrective actions for reducing or eliminating the vulnerabilities identified.

Policies and Procedures

Another key element of an effective information security program is to develop and implement risk-based policies, procedures, and technical standards that govern security over an agency’s computing environment. If properly implemented, policies and procedures should help reduce the risk that could come from unauthorized access or disruption of services. Technical security standards provide consistent implementing guidance for each computing environment. Establishing and documenting security policies is important because they are the primary mechanism by which management communicates its views and requirements; these policies also serve as the basis for adopting specific procedures and technical controls. In addition, agencies need to take the actions necessary to effectively implement or execute these procedures and controls. Otherwise, agency systems and information will not receive the protection that should be provided by the security policies and controls.

IRS has developed information security policies, standards, and guidelines that generally provide appropriate guidance to personnel responsible for securing IRS information systems and data. Yet, we noted instances where policies and procedures were inconsistent with federal guidance, incomplete, and not consistently implemented. For example, IRS’s policies and procedures did not always include minimum security requirements as outlined in NIST or National Security Agency (NSA) guidance. To illustrate, password standards, such as password age and password history, set in IRS policies are less stringent than those strongly encouraged by NIST guidance, and specific requirements for certain systems, such as use of superuser accounts and configuration of registry keys, do not meet the guidance issued by NSA. In addition, IRS’s methodology for the certification and accreditation of their general support systems is incomplete, with several key sections of it missing information or left completely blank. Further, we continue to report that IRS has not consistently implemented policies and procedures contained in the Law Enforcement Manual and Internal Revenue Manual pertaining to network management, user accounts and passwords, user rights and file permissions, and other information system controls. Without effectively updating these policies to establish appropriate minimum security requirements, ensuring that policies and procedures are complete, and implementing them, IRS has less assurance that their systems and information are sufficiently protected.

Security Plans

The objective of system security planning is to improve the protection of information technology resources. A system security plan provides an overview of the system’s security requirements and describes the controls that are in place—or planned—to meet those requirements. OMB Circular A-130 requires that agencies develop and implement system security plans for major applications and for general support systems, and that these plans address policies and procedures for providing management, operational, and technical controls. Further, NIST guidelines state that when nonmajor applications are bundled with a general support system, the security requirements for each of the nonmajor applications should be included in the general support system’s security plan. IRS policy requires that security plans be developed and provides guidance on developing security plans. According to both IRS and NIST guidance, plans should include elements such as security controls currently in place or planned, the individual responsible for the security of the system, a description of the system and its interconnected environment, and rules of behavior.

The six security plans we reviewed generally included elements such as security controls currently in place or planned, the individual responsible for the security of the system, a description of the system and its interconnected environment, and rules of behavior. However, we identified instances where plans were incomplete. Of the three security plans for general support systems with nonmajor applications that we reviewed, none addressed specific controls for the nonmajor applications nor assigned specific accountability for those controls. TIGTA identified similar issues, and noted that business unit owners of nonmajor applications may rely too heavily on the general support system controls to protect sensitive data. Without complete security plans, IRS cannot ensure that appropriate controls are in place to protect its systems and critical information.

Security Awareness and Training

Another important element of an information security program involves promoting awareness and providing required training so that users understand the system security risks and their role in implementing related policies and controls to mitigate those risks. Computer intrusions and security breakdowns often occur because computer users fail to take appropriate security measures. For this reason, it is vital that employees who use computer resources in their day-to-day operations be made aware of the importance and sensitivity of the information they handle, as well as the business and legal reasons for maintaining its confidentiality, integrity, and availability. FISMA mandates that all federal employees and contractors who use agency information systems be provided with information security awareness training. Further, FISMA requires agency chief information officers (CIO) to ensure that personnel with significant information security responsibilities get specialized training. OMB and NIST also require agencies to implement system-specific security training.

IRS has developed and implemented several methods for notifying employees and contractors of their security-related roles and responsibilities. These methods include specifying security roles and responsibilities in various policy manuals available to employees and contractors, providing security awareness training during new hire orientations, distributing security awareness bulletins and brochures, and creating information security poster boards. As reported by TIGTA in its 2005 FISMA report, security awareness training was provided to all IRS employees and contractors.

Despite the agency’s efforts in providing security awareness training, it did not always provide specialized training to individuals with significant information security responsibilities. In its fiscal year 2005 FISMA submission, IRS reported it has 2,737 employees with significant information technology security responsibilities, yet only 300 (11 percent) of those employees received specialized training (see fig. 2).

IRS did not always provide specialized training for its contractor personnel with information security responsibilities. For example, it did not provide Computer Security Incident Response Center contractors with specialized training. IRS has taken some key steps to address this area, including establishing a working group to improve its training program. Without sufficiently trained security personnel, security lapses are more likely to occur and could contribute to further information security weaknesses.

Tests and Evaluations of Control Effectiveness

Another key element of an information security program is the testing and evaluation of systems to ensure that they are in compliance with security policies and that those policies and controls are both appropriate and effective. This type of oversight is a fundamental element because it demonstrates management’s commitment to the security program, reminds employees of their roles and responsibilities, and identifies and mitigates areas of noncompliance and ineffectiveness. Although control tests and evaluations may encourage compliance with security policies, the full benefits are not achieved unless the results improve the security program. Analyzing the results of security reviews provides security specialists and business managers with a means of identifying new problem areas, reassessing the appropriateness of existing controls, and identifying the need for new controls. FISMA requires that the frequency of tests and evaluations be based on risks, but occur no less than annually. Furthermore, IRS policy requires periodic testing and evaluation of the effectiveness of information security policies and procedures.

Although IRS had conducted system tests and evaluations for the three systems we reviewed, its tests did not identify key security vulnerabilities. For example: At one of the IRS sites we visited, one system’s security test and evaluation report did not identify any vulnerabilities. However, during our review, we identified several vulnerabilities, including unpatched software.

At the same site, IRS did not detect control deficiencies during its test and evaluation of the mainframe. For example, IRS was not using standardized naming conventions for its datasets and was not logging changes to software on the mainframe. These weaknesses could have been detected and corrected using the results of effective security tests and evaluations.

In addition, in its 2005 FISMA report, TIGTA reported that security tests and evaluations for major applications did not comply with NIST standards. Tests did not include all system components, such as encryption, telecommunication links, and user account management. Without appropriate tests and evaluations, IRS cannot be assured that employees and contractors are complying with established policies or that policies and controls are appropriate and working as intended.

Remedial Actions

Remedial action plans are a key component described in FISMA. They assist agencies in identifying, assessing, prioritizing, and monitoring the progress in correcting security weaknesses that are found in information systems. According to OMB Circular A-123, agencies should take timely and effective action to correct deficiencies that they have identified through a variety of information sources. To accomplish this, remedial action plans should be developed for each deficiency, and progress should be tracked for each. IRS policy also requires a process for ensuring remedial action to address any significant deficiencies.

According to TIGTA, IRS has made noteworthy progress in the area of tracking remedial actions. In its 2005 FISMA report, TIGTA reported that it was able to verify that IRS’s remedial action plans included weaknesses from various reviews and were tailored to specific applications.

Although IRS had developed remedial plans to address information security weaknesses identified through previous reviews, the plans we reviewed were incomplete. All four remedial plans were missing certain key elements. For example, none of the four plans specified the funds required to correct identified weaknesses. In addition, three of the plans did not identify scheduled completion dates for correcting or mitigating identified weaknesses. Further, the fourth plan was outdated because it included scheduled completion dates that had already passed. For example, weaknesses that were still considered “open” in June 2005 had scheduled completion dates of April 2005. IRS officials explained that the remedial plans were a “work in progress,” since the documents were not due to be submitted to OMB until September 2005. However, OMB requires at least quarterly updates of agency remedial plans; therefore, the plan should have been updated during the time of our review. Without complete and current remedial action plans, the agency may not be able to prioritize and monitor progress in correcting security weaknesses.

Incident Handling

Even strong controls may not block all intrusions and misuse, but organizations can reduce the risks associated with such events if they promptly take steps to detect and respond to them before significant damage can be done. In addition, accounting for and analyzing security problems and incidents are effective ways for organizations to gain a better understanding of threats to their information and of the costs of their security-related problems. Such analyses can pinpoint vulnerabilities that need to be eliminated so that they will not be exploited again. Problem and incident reports can provide valuable input for risk assessments, can help in prioritizing security improvement efforts, and can be used to illustrate risks and related trends for senior management.

IRS has implemented an incident handling program and established the Computer Security Incident Response Center in 2001. The center’s mission is to detect, react, and respond to computer security incidents targeting the IRS enterprise information infrastructure. It provides assistance and guidance in both cyber and physical incident response and uses a centralized approach to incident handling across IRS. The agency has also defined procedures for detecting, responding to, and reporting computer and network security incidents, and has created several detailed incident detection and response procedures outlining the roles and responsibilities of center personnel and event analysis. In 2005, TIGTA reported that the center was effective at preventing, detecting, and responding to computer security incidents, but it recommended further improvements in reporting and documenting remedial actions related to incidents.

Continuity of Operations

Continuity of operations controls, which includes disaster recovery planning, should be designed to ensure that when unexpected events occur, key operations continue without interruption or are promptly resumed, and that critical and sensitive data are protected. These controls include environmental controls and procedures designed to protect information resources and minimize the risk of unplanned interruptions, along with a plan to recover critical operations should interruptions occur. If continuity of operations controls are inadequate, even a relatively minor interruption could result in significant adverse nationwide impact on IRS operations. IRS requires that continuity of operations, or business resumption, plans be included as part of its certification and accreditation process.

Shortcomings in IRS’s ability to recover from disruptions due to unexpected events continue to exist. In 2004, we reported that non-IRS staff at an IRS site were not trained to restore operations in the event IRS staff were not available. In addition, in 2005, we reported that the disaster recovery plans we reviewed at an IRS site did not include disaster recovery procedures for its UNIX and Windows systems. Also, the site’s business resumption plans did not include UNIX and Windows systems. Although IRS has various initiatives under way to improve continuity of operations, these and other shortcomings still exist. Specifically, IRS has not procured and installed UNIX-based hardware and equipment for processing applications and data at its disaster recovery hot-site—an alternate processing location that can be used in case of an emergency. Further, in 2005, the agency reported that they had tested contingency plans for only 36 percent of its systems. Until the agency completes actions to address these weaknesses, it is at risk of not being able to appropriately recover in a timely manner from certain service disruptions.

Conclusions

IRS has made progress in correcting or mitigating previously reported weaknesses and in implementing controls over key financial and tax processing systems. However, information security weaknesses—both old and new—continue to impair its ability to ensure the confidentiality, integrity, and availability of financial and other sensitive data. A key reason for these weaknesses is that IRS has not yet fully implemented critical elements of its information security program, although it has developed a solid framework. Until IRS fully implements a comprehensive agencywide information security program that includes enhanced policies, procedures, plans, training, and continuity of operations, its facilities and computing resources and the information that is processed, stored, and transmitted on its systems will remain vulnerable.

Recommendations for Executive Action

To help establish effective information security over key financial systems, data, and interconnected networks, we recommend that you take the following five actions to implement an information security program: enhance policies and procedures related to password age and configuration settings to comply with federal guidelines; review system security plans to ensure that they appropriately address ensure contractors with significant information security responsibilities are provided with sufficient specialized training; ensure that remedial action plans are complete and up to date; and continue to enhance continuity of operations capabilities by training non-IRS staff to restore operations, updating disaster recovery plans to include disaster recovery procedures for UNIX and Windows systems, updating business resumption plans to include UNIX and Windows installing UNIX-based hardware and equipment for processing applications and data at IRS’s disaster recovery hot-site.

We are also making recommendations in a separate report with limited distribution. These recommendations consist of actions to be taken to correct the specific information security weaknesses we identified that are related to network management, user accounts and passwords, user rights and file permissions, audit and monitoring of security-related events, physical security, and patch management at the two sites we visited.

Agency Comments

In providing written comments (reprinted in app. I) on a draft of this report, the Commissioner of Internal Revenue acknowledged that IRS needs to continue to implement a comprehensive agencywide security program, and agreed to implement the five recommendations in this report. He said that efforts are under way to remedy weaknesses and will continue until all recommendations have been addressed.

The Commissioner also said that IRS is taking an agencywide approach to address the root cause of the weaknesses we identified. He also stated that many weaknesses have been corrected and additional controls have been implemented. Further, he said that IRS is continuing its aggressive initiative to complete required security activities at each of the computing centers. These activities include the development of security plans, security documentation, and security testing.

This report contains recommendations to you. As you know, 31 U.S.C. 720 requires the head of a federal agency to submit a written statement of the actions taken on our recommendations to the Senate Committee on Homeland Security and Governmental Affairs and to the House Committee on Government Reform not later than 60 days from the date of the report and to the House and Senate Committees on Appropriations with the agency’s first request for appropriations made more than 60 days after the date of this report. Because agency personnel serve as the primary source of information on the status of recommendations, GAO requests that the agency also provide it with a copy of your agency’s statement of action to serve as preliminary information on the status of open recommendations.

We are sending copies of this report to interested congressional committees and the Secretary of the Treasury. We will also make copies available to others upon request. In addition, this report will be available at no charge on the GAO Web site at http://www.gao.gov.

If you have any questions regarding this report, please contact Gregory Wilshusen at (202) 512-6244 or Keith Rhodes at (202) 512-6412. We can also be reached by e-mail at wilshuseng@gao.gov and rhodesk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix II.

Comments from the Commissioner of Internal Revenue

GAO Contacts and Staff Acknowledgments

GAO Contacts

Staff Acknowledgments

In addition to the persons named above, Edward Alexander Jr., Gerald Barnes, Bruce Cain, Mark Canter, Nicole Carpenter, Jason Carroll, Lon Chin, Kirk Daubenspeck, Neil Doherty, Patrick Dugan, Denise Fitzpatrick, Edward Glagola Jr., Nancy Glover, David Hayes, Franklin Jackson, Myong Suk Kim, Jeffrey Knott, Mary Marshall, Leena Mathew, Kevin Metcalfe, Duc Ngo, Tracy Pierson, Henry Sutanto, and Chris Warweg made key contributions to this report.