TIGTA Report: IRS Computer Security Center Effective, Could Be Better

By AccountingWEB Staff
 
The Computer Security Incident Response Center (CSIRC), which is responsible for monitoring the IRS network for cyber attacks and computer vulnerabilities (twenty-four hours, 365 days a year), "is effectively performing most of its responsibilities for preventing, detecting, and responding to computer security incidents," according to a new report publicly released by the Treasury Inspector General for Tax Administration (TIGTA).
 
"However, further improvements could be made," said Treasury Inspector General for Tax Administration J. Russell George.
 
While Treasury Inspector General for Tax Administration J. Russell George states that the CSIRC "is effectively performing most of its responsibilities for preventing, detecting, and responding to computer security incidents," he says further improvements could be made.
George noted that:
  • The CSIRC's host-based intrusion detection system is not monitoring 34 percent of IRS servers, which puts the IRS network and data at risk.
  • The CSIRC is not reporting all computer security incidents to the Department of the Treasury, as required. 
  • The CSIRC incident response policies, plans, and procedures are either nonexistent or are inaccurate and incomplete.

The TIGTA recommended that the Assistant Chief Information Officer, Cybersecurity, direct the CSIRC to:

  1. Develop its Cybersecurity Data Warehouse capability to correlate and reconcile active servers connected to the IRS network with servers monitored by the host-based intrusion detection system;
  2. Revise and expand the Memorandum of Understanding with the TIGTA Office of Investigations to ensure that all reportable and relevant security incidents are shared with the CSIRC;
  3. Collaborate with the TIGTA Office of Investigations to create common identifiers to help the CSIRC reconcile its incident tracking system with the TIGTA Office of Investigations' incident system; 
  4. Develop a standalone incident response policy or update the policy in the IRS's Internal Revenue Manual with current and complete information; 
  5. Develop an incident response plan; and
  6. Develop, update, and formalize all critical standard operating procedures.
 
The IRS agreed with the recommendations, and corrective actions are planned or in process for five of the six recommendations. Although the IRS agreed with the recommendation to correlate and reconcile active servers connected to the IRS network with servers monitored by the host-based intrusion detection system, its proposed corrective actions did not address the TIGTA's recommendation. Specifically, the IRS did not commit to implementing the controls the TIGTA recommended.
 
 
Related articles:

 

You may like these other stories...

AgFeed agrees to pay $18 million to settle SEC accounting fraud caseMichael Rapoport of the Wall Street Journal reported on Monday that AgFeed Industries Inc. has agreed to pay $18 million to settle US Securities and...
Many accountants struggle with payroll, either because they have too much of it or they don't want to do any of it. Either way, they are at odds with the needs of their business clients. Most clients are looking for a...
Hertz and Icahn make peaceThere won’t be any nasty, protracted proxy battle between Hertz Global Holdings and activist investor Carl Icahn. The rental car chain agreed last Thursday to give Icahn – who has...

Already a member? log in here.

Upcoming CPE Webinars

Sep 18
In this course, Amber Setter will shine the light on different types of leadership behavior- an integral part of everyone's career.
Sep 24
In this jam-packed presentation Excel expert David Ringstrom, CPA will give you a crash-course in creating spreadsheet-based dashboards. A dashboard condenses large amounts of data into a compact space, yet enables the end user to easily drill down into details when warranted.
Sep 30
This webcast will include discussions of important issues in SSARS No. 19 and the current status of proposed changes by the Accounting and Review Services Committee in these statements.
Oct 23
Amber Setter will show the value of leadership assessments as tools for individual and organizational leadership development initiatives.