Six years ago the U.S. Government Accountability Office (GAO) criticized the IRS for lax security practices. Now it would seem that six years is plenty of time to get the right security policies in place, but while the IRS is showing progress, it has yet to remediate 65 of the 88 previously reported weaknesses – and now the most recent GAO audit has turned up 37 new weaknesses to add to the list. This news affects every tax-paying citizen in the U.S., as all of our information is at risk, and it’s a good example of why every organization needs to be paying attention to their own security policies.
It was reported that many of these security deficiencies are related to access control, configuration management and segregation of duties. Every day that employee responsibilities are not clearly defined and the right least privilege policies are not in place, the IRS, is putting their sensitive information – OUR sensitive information – at risk. Security weaknesses in these critical areas increase the risk of insider threats, both accidental and intentional.
Six years is way too long to know there are gaping holes in your security without taking steps to fix the problems. There isn’t time to waste, as every day that goes by without a security breach is just dumb luck. Organizations, including the IRS, need to take action now to implement comprehensive security plans, starting by getting least privilege and segregation-of-duty policies in place right away.
