Taxpayer Data At IRS Remains Vulnerable 62
CWmike writes "A new Government Accountability Office report (PDF) finds that taxpayer and other sensitive data continues to remain dangerously underprotected at the IRS. The news comes less than three months after the Treasury Inspector General for Tax Administration reported that there were major security vulnerabilities in two crucial IRS systems. Two big standouts in the latest finding: The IRS still does not always enforce strong password management rules for identifying and authenticating users of its systems, nor does it encrypt certain types of sensitive data, the GAO said."
It's not the first time, it won't be the last. (Score:5, Interesting)
That reminds me of what happened in Australia with the taxation department a few years ago.
The ATO put everyone's tax details online and used their Tax File Number ( everyone who pays tax has one ).
Some bright spark noticed his TFN in the URL the day they launched their new service and changed the number only to find that it gave him access to someone else's data.
There were accusations of hacking and all, but it conveniently left out the discussion that it was a pretty obvious and blatant flaw.
The minister responsible was never held accountable. That's why these security breaches keep on happening over here.
I'm pretty sure that there's a similar situation in the US.
GrpA
Re:What's the big secret? (Score:5, Interesting)
I hope you're being funny.
If others knew what I make, I would get a pay cut. My pay has been negotiated between myself and management. There would be a brouhaha if others in similar, but less accountable, roles thought I was "paid too much" or some such.*
My pay is not something I would want broadcast. Also, I would not want marketers to know my pay, nor family (aside from my spouse).
-nB
* I say this who has worked their way up from the bottom, where I used to think I was mighty damn important, now I know my absolute value may be low but my relative value is higher. I don't expect others who are in the boat I was in to necessarily understand this, and would rather avoid the conflict.
Government Solutions Office (Score:5, Interesting)
What we need is a counterpart to the GAO.
The GAO should be able to exact fines from any agency for waste, insecurity etc etc.
All of this fine money should be funneled into a Government Solutions Office whose task is to spend that money back into the program to fix it.
GAO finds improper encryptions. Fines IRS. GSO hires a security expert to create new policies and purchase needed training.
Just a thought.