By NWV News Writer Jim Kouri
Following the heated debate and passage of Obamacare, the Treasury Department reported that the U.S. Internal Revenue Service — an agency under the direction of Treasury Secretary Timothy Geithner — would hire upwards of 10,000 more agents to enforce several provisions of the far-reaching health care program, according to a government report.
With the IRS set to take a significant role in the new health care law signed by President Barack Obama on national television, that part of the Obamacare plan continues to worry those who have little faith in government efficiency, especially when Americans' privacy issues are involved, according to the American Society for Effective Healthcare.
Many security experts fear that Americans' patient information will be vulnerable to unauthorized access and distribution with perpetrators being outside hackers or IRS insiders.
Today's Internal Revenue Service relies extensively on computerized systems to carry out its demanding responsibilities to collect taxes, process tax returns, and enforce the nation's tax laws.
Add the new responsibilities of taxing health care under the guise of levying fines on those who violate Obamacare provisions as well as record keeping, and there now exists a greater likelihood of patient information being unlawfully accessed or accidentally released to third parties.
"Effective information security controls are essential to protect financial and taxpayer information from inadvertent or deliberate misuse, improper disclosure, or destruction," said Sidney Franes, owner of FLT Security Services.
"Having a person's medical records along with other personal information is an identity thief's dream come true, especially the [computer] hackers," said Franes.
As part of its audit of IRS's financial statements, Congress requested the Government Accountability Office to assess the status of IRS's actions to correct or mitigate previously reported information security weaknesses, and whether controls over key financial and tax processing systems are effective in ensuring the confidentiality, integrity, and availability of financial and sensitive taxpayer information.
To do this, GAO examined IRS information security policies, plans, and procedures; tested controls over key financial applications; and interviewed key agency officials at six sites, said officials.
The GAO reported that the IRS has continued to make progress in correcting previously reported information security weaknesses that GAO reported as unresolved at the conclusion of its audit.
Specifically, IRS has corrected or mitigated 28 of the 89 weaknesses and deficiencies — 21 of 74 previously identified information security control weaknesses and 7 of 15 previously identified program deficiencies, according to GAO officials.
For example, it has changed vendor-supplied user accounts and passwords and avoided storing clear-text passwords in scripts. It also enhanced its policies and procedures for configuring mainframe operations and established an alternate processing site for its procurement system.
While IRS has corrected 28 control weaknesses and program deficiencies, 61 of them — or about 69 percent — remain unresolved or unmitigated, stated the GAO report.
The IRS continued to install patches in an untimely manner and used passwords that were not complex. In addition, IRS did not always verify that remedial actions were implemented or effectively mitigated the security weaknesses, the GAO report revealed.
According to IRS officials, they continued to address uncorrected weaknesses and, subsequent to GAO's site visits, had completed additional corrective actions on some of them. Despite these actions, newly identified and the unresolved information security control weaknesses in key financial and tax processing systems continue to jeopardize the confidentiality, integrity, and availability of financial and sensitive taxpayer information.
The IRS did not consistently implement controls that were intended to prevent, limit, and detect unauthorized access to its systems and information. For example, IRS officials did not always enforce strong password management for properly identifying and authenticating users. It also failed the authorized user access tests that permit only the access needed to perform job functions. It also failed to log and monitor security events on a key system and did not physically protect its computer resources, the GAO analysts stated.
A key reason for these weaknesses is that IRS has not yet fully implemented its agency-wide information security program to ensure that controls are appropriately designed and operating effectively. Although IRS has made important progress in developing and documenting its information security program, it did not, among other things, review risk assessments at least annually for certain systems or ensure contractors receive awareness training.
Until these control weaknesses and program deficiencies are corrected, the agency remains unnecessarily vulnerable to insider threats related to the unauthorized access to and disclosure, modification, or destruction of financial and taxpayer information, as well as the disruption of system operations and services, the analysts pointed out in their report to Congress.
The new and unresolved weaknesses and deficiencies are the basis for GAO's determination that IRS had a material weakness in internal controls over financial reporting related to information security last year. The GAO advised the IRS that it should develop and implement policies and procedures for more securely configuring routers to encrypt network traffic, configuring switches to defend against attacks that could crash the network, and for notifying CSIRC of network changes that could affect its ability to detect unauthorized access.