From: InfoSec News (alertsinfosecnews.org)
Date: Mon Jan 12 2009 - 01:11:23 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

http://www.cio.com/article/475395/Auditor_IRS_Still_Vulnerable_to_Cyber_Breaches

By Grant Gross
IDG News Service
January 09, 2009

The U.S. Internal Revenue Service remains vulnerable to a wide range of
cybersecurity problems, and the agency has fixed less than half of the
vulnerabilities identified in a November audit, according to a report by
the U.S. Government Accountability Office released Friday.

The IRS has fixed just 49 of 115 computer security problems found by the
GAO in the November audit, the GAO said. The agency, which collects
about US$2.7 trillion in taxes each year, still does not always enforce
strong password management, does not encrypt some sensitive data and
does not always limit the number of workers with access to sensitive
information, the GAO said.

"IRS continues to, among other things, allow sensitive information,
including IDs and passwords for mission-critical applications, to be
readily available to any user on its internal network, and grant
excessive access to individuals who do not need it," the GAO report
said. "Despite IRS's progress, information security control weaknesses
continue to jeopardize the confidentiality, integrity, and availability
of financial and sensitive taxpayer information."

The GAO report [1] did note that the IRS has taken several steps to
improve information security since the November report.

[1] http://www.gao.gov/new.items/d09136.pdf

_______________________________________________
Please help InfoSecNews.org with a donation!
http://www.infosecnews.org/donate.html

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]