Information security is an important consideration for any organization that depends on information systems and computer networks to carry out its mission or business. The same speed and accessibility that create the enormous benefits of the computer age can, if not properly controlled, allow individuals and groups with malicious intent to intrude into inadequately protected systems and use this access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer networks and systems. Protecting computer systems that support critical operations and infrastructures is important due to the concern about attacks from individuals and groups, including terrorists. These concerns are well founded for a number of reasons, including the ease of obtaining and using hacking tools, the steady advance in the sophistication and effectiveness of attack technology, and the warnings of new and more destructive attacks to come. Computer-supported federal operations are likewise at risk. Our previous reports, and those of agency inspectors general, describe persistent information security weaknesses that place a variety of critical federal operations, including those at IRS, at risk of disruption, fraud, and inappropriate disclosure. We have designated information security as a governmentwide high-risk area since 1997—a designation that remains today. In December 2002, Congress enacted the Federal Information Security Management Act of 2002 (FISMA) to strengthen security of information and systems within federal agencies. FISMA requires each agency to develop, document, and implement an agencywide information security program to provide information security for the information and systems that support the operations and assets of the agency. In its role as the nation’s tax collector, IRS has a demanding responsibility in collecting taxes, processing tax returns, and enforcing the nation’s tax laws. In fiscal year 2005, IRS collected about $2.3 trillion in tax payments, processed hundreds of millions of tax and information returns, and paid about $267 billion in refunds to taxpayers. IRS is a large and complex organization, with a unique mission that adds operational challenges for management. It employs tens of thousands of people in 10 service center campuses, three computing centers, and numerous other field offices throughout the United States. Because of the nature of its mission, IRS also collects and maintains a significant amount of personal and financial data on each American taxpayer. The confidentiality of this sensitive information must be protected; otherwise, taxpayers could be exposed to loss of privacy and to financial loss and damages resulting from identity theft or other financial crimes. The Commissioner of Internal Revenue has overall responsibility for ensuring the confidentiality, availability, and integrity of information and information systems supporting the agency and its operations. The Chief of Mission Assurance and Security Services is responsible for developing policies and procedures regarding information technology security; providing assurance services to improve physical, data, and personnel security; conducting independent testing; and ensuring security is integrated into its modernization activities. To help accomplish these goals, IRS has developed and published information security policies, guidelines, standards, and procedures in the Internal Revenue Manual, Law Enforcement Manual, and other documents. The objectives of our review were to determine (1) the status of IRS’s actions to correct or mitigate previously reported weaknesses at two sites and (2) whether controls over key financial and tax processing systems located at the sites are effective in ensuring the confidentiality, integrity, and availability of financial and sensitive taxpayer data. We concentrated our evaluation primarily on threats emanating from internal sources on IRS’s computer networks. Our evaluation was based on (1) our Federal Information System Controls Audit Manual, which contains guidance for reviewing information system controls that affect the confidentiality, integrity, and availability of computerized data; (2) FISMA, which sets key elements that are required for an effective information security program; and (3) previous reports from the Treasury Inspector General for Tax Administration (TIGTA). Specifically, we evaluated information security controls that are intended to prevent, limit, and detect electronic access to computer resources (data, programs, and systems), thereby protecting these resources against unauthorized disclosure, modification, and use; provide physical protection of computer facilities and resources from espionage, sabotage, damage, and theft; prevent the exploitation of vulnerabilities; prevent the introduction of unauthorized changes to application or ensure that work responsibilities for computer functions are segregated so that one individual does not perform or control all key aspects of computer-related operations and, thereby, have the ability to conduct unauthorized actions or gain unauthorized access to assets or records without detection by another individual performing assigned responsibilities. In addition, we evaluated IRS’s information security program. Such a program includes assessing risk; developing and implementing policies, procedures, and security plans; providing security awareness and training; testing and evaluating control effectiveness; planning, implementing, evaluating, and documenting remedial action to address information security deficiencies; detecting, reporting, and responding to security incidents; and ensuring continuity of operations. To evaluate IRS’s information security controls and program, we identified and reviewed pertinent IRS information security policies and procedures, guidance, security plans, relevant reports, and other documents, and we tested the effectiveness of these controls at two of IRS’s critical data processing sites. Specifically, our tests focused on three critical applications, as well as three general support systems located at the two sites. We also discussed with key security representatives and management officials whether information security controls were in place, adequately designed, and operating effectively. We performed our review at the two previously mentioned IRS sites in accordance with generally accepted government auditing standards from June through November 2005. We discussed the results of our review with IRS officials. IRS has made progress toward implementing more effective information security controls over key financial and tax processing systems that are located at two critical data processing sites, and has corrected or mitigated 41 of the 81 specific technical weaknesses that we reported as unresolved at the time of our last reviews at the selected sites. Actions have been taken to address weaknesses related to electronic access, physical access, and software change controls, among others. For example, IRS has implemented controls to protect mainframe system files that contain embedded user accounts and passwords; improved the security of authentication data for network devices, such as routers and switches; securely configured certain vulnerable network services to help prevent implemented procedures for periodically reviewing employee access to ensured that its software change control process includes the submission of documented test plans. Additionally, IRS addressed critical mainframe weaknesses. In 2005, we reported that IRS had not implemented effective electronic access controls over its mainframe computing environment to logically separate its taxpayer data from the Financial Crimes Enforcement Network’s Bank Secrecy Act data, which include information related to financial crimes, terrorist financing, money laundering, and other illicit activities. These two types of data have different security requirements, and, accordingly, we made specific recommendations to correct these access control weaknesses. Since our last report, IRS has taken action to mitigate these weaknesses. Although IRS has taken steps to strengthen its information security controls, it had not completed actions to correct or mitigate the remaining 40 previously reported technical weaknesses as illustrated in figure 1. These weaknesses include routinely permitting unencrypted protocols for remote log-on capability; not taking sufficient measures to prevent attackers from accessing information, copying sensitive files, and introducing malicious code via CD-ROM drives; inadequately restricting access to certain accounts with powerful rights over the system’s operating system; and configuring servers without ensuring sufficient audit trails. Failure to resolve these issues will leave sensitive IRS computing resources and data vulnerable to unauthorized access, manipulation, and destruction. In addition, last year we made three recommendations related to improving IRS’s information security program. These recommendations included ensuring that established security policies and procedures are consistently followed and implemented, ensuring that employees with significant information security responsibilities are provided with the sufficient training and understand their role in implementing security-related policies and controls, and implementing an ongoing process of testing and evaluating systems to ensure compliance with established policies and procedures. IRS agreed to implement these recommendations and is in the process of doing so. Although IRS has made progress in implementing information security for its financial and tax processing systems and information by addressing many of its previously identified security weaknesses, significant weaknesses in electronic access and other information security controls continue to threaten the confidentiality, integrity, and availability of those systems and information. A primary reason for these weaknesses is that IRS has not yet fully implemented its information security program. As a result, weaknesses in controls over its key financial and tax processing systems could impair IRS’s ability to perform vital functions and increase the risk of unauthorized disclosure, modification, or destruction of taxpayer data. A basic management objective for any organization is to protect the resources that support its critical operations from unauthorized access. Organizations accomplish this objective by designing and implementing controls that are intended to prevent, limit, and detect unauthorized access to computing resources, programs, and information. Electronic access controls include those related to network management, user accounts and passwords, user rights and file permissions, and logging and monitoring of security-relevant events. Inadequate controls over electronic processes diminish the reliability of computerized information, and they increase the risk of unauthorized disclosure, modification, and destruction of sensitive information and of disruption of service. IRS’s electronic access controls were inadequate. Serious weaknesses existed in network management, user accounts and passwords, user rights and file permissions, and logging and monitoring of security-relevant events. Networks are collections of interconnected computer systems and devices that allow individuals to share resources, such as computer programs and information. Because sensitive programs and information are stored on or transmitted along networks, effectively securing networks is essential to protecting computing resources and data from unauthorized access, manipulation, and use. Organizations secure their networks, in part, by installing and configuring network devices that permit authorized network service requests, deny unauthorized requests, and limit the services that are available on the network. Devices used to secure networks include (1) firewalls that prevent unauthorized access to the network, (2) routers that filter and forward data along the network, (3) switches that forward information among segments of a network, and (4) servers that host applications and data. Network services consist of protocols for transmitting data between network devices.