The Internal Revenue Service needs to do a better job of protecting its computer systems and taxpayer data as it expands its use of wireless technology, according to a new government report.
The
TIGTA reviewed whether the IRS has implemented effective controls to detect the unauthorized use of wireless technology and reviewed its plans for increasing use of WLAN technology. The report found that the IRS: established a wireless security policy that was generally in compliance with federal standards; deployed continuous monitoring procedures for detecting rogue wireless access points and other computing devices; and used a virtual private network to facilitate the secure transfer of sensitive data during remote access using wireless technology.
However, the TIGTA inspectors also found that some IRS employees were using personal unauthorized wireless devices on their laptops to connect to the IRS network. While these employees were authorized to access the network, the use of personal wireless devices is prohibited.
In addition, the IRS developed software to allow laptops to wirelessly connect to the IRS network from non-IRS facilities, such as a home, airport, or hotel, and allowed its use by approximately 300 users before the software was properly tested and approved for use enterprise-wide.
“While wireless communications can allow IRS employees to operate more efficiently, protecting the security of taxpayer data must always be the top priority,” said TIGTA Inspector General J. Russell George in a statement.
TIGTA recommended that the IRS implement automated nationwide network scans for unauthorized wireless activity, devices, and software; ensure that a security assessment and authorization is completed for all wireless technologies prior to use in the IRS environment; and resume monitoring of the WLAN at the National Distribution Center at appropriate intervals to ensure all files are set in accordance with IRS security policy.
The IRS agreed to take action to address two of TIGTA’s recommendations, but disagreed that IRS policy requires completion of a security assessment and authorization on wireless technologies that it is piloting or demonstrating.
“In the case of IRS’s wireless pilot, a risk assessment was performed to allow the IRS to understand what risks might exist so that the responsible Authorizing Official could make an informed decision before he or she signed a memo authorizing the pilot to begin,” wrote IRS chief technology officer Terence V. Milholland. “Also, a full SA&A for the pilot would be premature as the wireless network was still in a design phase and being conducted in an area where users had little access to any taxpayer data.”
TIGTA, for its part, maintained that prior to placing wireless technologies on the live IRS network, the IRS should ensure that it has completed the required security assessment and authorization.
