E-filing security.The General Accounting Office (GAO) recently released a Report to the Chairman of the Senate Committee on Governmental Affairs, entitled Information Security--IRS Electronic Filing Systems. The report examines the computer controls of the IRS's electronic filing (e-filing) systems and electronically transmitted taxpayer data that ensure information security. According to according to prep. 1. As stated or indicated by; on the authority of: according to historians. 2. In keeping with: according to instructions. 3. the GAO, during last year's filing season, IRS An abbreviation for the Internal Revenue Service, a federal agency charged with the responsibility of administering and enforcing internal revenue laws. computer controls were inadequate. During the 2000 filing season, the GAO demonstrated that hackers could have gained access to the IRS's e-filing systems, as well as the electronically transmitted tax return data held by those systems. Such access would allow an individual accessing the data to view and modify the taxpayer data. The GAO identified the following five major shortcomings A shortcoming is a character flaw. Shortcomings may also be:
* Computers that supported the e-filing program were not effectively restricted to external users. * The operating system operating system (OS) Software that controls the operation of a computer, directs the input and output of data, keeps track of files, and controls the processing of computer programs. that ran the e-filing systems was not securely configured. * Sufficient password management and user account practice implementation were lacking. * Access to computer files and directories that contained tax return information and e-filing system data was not adequately restricted. * The IRS had not yet begun to protect tax return data with file encryption. Technical recommendations included improvement of specific access controls dealing with the e-filing systems and networks. The GAO also suggested that the IRS complete certification and accreditation of its e-filing systems, assess security risks and routinely monitor effectiveness of access controls dealing with such risks, improve data reliability and integrity controls and notify taxpayers of privacy risks associated with e-filing. On notification of the problems with its e-filing systems, IRS officials moved quickly to correct the weaknesses identified by the GAO before the beginning of the 2001 tax filing season. However, the GAO plans to monitor the system to ensure the success of the IRS's steps taken to correct the e-filing problems. In addition, the Office of the Treasury Inspector General for Tax Administration (TIGTA TIGTA Treasury Inspector General for Tax Administration ) is working with the IRS to develop a cadre of computer specialists and criminal investigators to respond to external computer intrusion An incident of unauthorized access to data or an automated information system. incidents. The new team will also investigate intentional disruption of the IRS network and conduct recurring systems penetration tests A test of a network's vulnerabilities by having an authorized individual actually attempt to break into the network. The tester may undertake several methods, workarounds and "hacks" to gain entry, often initially getting through to one seemingly harmless section, and from there, to detect new vulnerabilities. Recent TIGTA audits have identified significant weaknesses in the areas of intrusion detection See IDS and IPS. , disaster recovery, physical security of facilities and systems and certification of security controls for sensitive systems. The risks are not from external forces only; unethical unethical said of conduct not conforming with professional ethics. employees have also viewed and manipulated taxpayer records. TIGTA uses detection criteria that search the IRS's tax administration files to uncover employees' unauthorized access to taxpayer information. As a result of TIGTA's detection of that unauthorized access, 373 IRS employees have either resigned or been removed. In 65 cases, the IRS successfully criminally prosecuted the former employee. [GRAPH OMITTED] |
|
||||||||||||||||||||
Printer friendly
Cite/link
Email
Feedback
Reader Opinion