Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security United States

IRS Doesn't Check Cyberaudit Logs 78

Posted by samzenpus from the check-your-work-twice dept.
An anonymous reader writes "The US Internal Revenue Service's IT staff hasn't routinely checked its cybersecurity audit logs, according to a report released this week by the agency's inspector general's office. The report is not exactly flattering for the IRS. The report, with large chunks redacted, recommends the IRS allow independent review of audit logs and establish procedures to save audit logs. It also recommended that the IRS regularly test its Internet gateways for compliance with standard security configurations."
This discussion has been archived. No new comments can be posted.

IRS Doesn't Check Cyberaudit Logs More

IRS Doesn't Check Cyberaudit Logs

Comments Filter:
  • Why don't we test their Internet gateways? Right now! Let's go, crowd, everybody start hammering their GWs! Hooray, we're helping!

  • Are you surprised? (Score:3, Interesting)

    by Spazztastic ( 814296 ) <spazztastic @ g m a i l . c om> on Thursday December 18, 2008 @08:06AM (#26158729)
    I'm not surprised. With how awful the UK has been with keeping a hold on our data, why should the US be any better at it? Just because we're not leaving it on subway cars or recycling computers without shredding the hard drives doesn't mean there isn't a fault somewhere else.

  • In Soviet Amerika, the IRS doesn't audit itself, it audits YOU!

    If you're not compliant, no excuses. If they're not compliant, don't complain comrade - they WILL auduit you!

  • irs.portforward.com (Score:3, Insightful)

    by martin_henry ( 1032656 ) on Thursday December 18, 2008 @08:08AM (#26158747)
    [Comment Redacted]

  • Why redacted? (Score:4, Insightful)

    by fprintf ( 82740 ) on Thursday December 18, 2008 @08:09AM (#26158761) Journal

    I cannot understand what needs to be so secret about anything in the IRS that any portion of a report would need to be redacted. I do understand that there might be investigations into white collar crime, but if the summary is correct and "large portions are redacted", what are they worried about us finding out? This is not the FBI or CIA here, it is the IRS, the US government agency charged with collecting taxes.

    Once again I think we have a serious issue with power and openness in our government. It has gotten so way out of control it seems ridiculous!

    • Re:Why redacted? (Score:5, Insightful)

      by fprintf ( 82740 ) on Thursday December 18, 2008 @08:16AM (#26158811) Journal

      Never mind. I just figured it out... social security numbers and private information. Once again, that little problem of social security numbers raises its ugly head. If it was just used for social security taxes, and nothing else we'd be fine. But now it is used for all kinds of financial transactions any organization has to guard those 9 numbers better than Fort Knox guards its gold.

      • Re: (Score:1, Offtopic)

        by Swizec ( 978239 )

        But now it is used for all kinds of financial transactions any organization has to guard those 9 numbers better than Fort Knox guards its gold.

        Fort Knox still has gold!? I thought with how all american money is based on credit they'd have stacks upon stacks of paper specifying just how much imaginary money there is. Guess I was wrong and that gold can just be pumped back into the economy thus saving the day. hooray

    • A security breech of key IRS servers would constitute a national security crisis. Without your tax dollars, all that stuff that the military, FBI, CIA, NSA, etc., do wouldn't happen. Someone's gotta pay for it, and guess what? It's you and me, buddy.

  • Why would I audit my security logs? I have a shell script running for that.

    • Why would I audit my security logs? I have a shell script running for that.

      Have you stopped to think that perhaps automated tools don't always work as expected?

      • Re:I don't either... (Score:5, Funny)

        by Anonymous Coward on Thursday December 18, 2008 @08:47AM (#26159061)
        Have you stopped to think that perhaps automated tools don't always work as expected?

        Frist Post!!1!

      • What good are your automation tools if they don't work as expected? Didn't you test them before deploying them?

        Sure, it's probably good to manually compare the output of the monitoring tools to the verbose logs once in a while, but unless you've got really bad automation that should be nothing more than an infrequent formality on historical data -- the day-to-day monitoring should all by done by tools that don't get bored by the thousands of nominal log entires.

        • Oh, agreed. But that infrequent formality has to happen. And the automated tools should be smart enough to give you useful daily data by analysis and filtering -- that way you'll notice something's amiss if you don't get the expected data.

          For example, I have a Python script that. for example, plots graphs of the number of successful vs. unsuccessful authentications. It graphs port connections, and a few other things as well. Another script shows resource utilization graphs. These are all posted on an i

  • Yet another case for some sort of tax revamping... (Score:3, Insightful)

    by Notquitecajun ( 1073646 ) on Thursday December 18, 2008 @08:28AM (#26158905)
    I'm not the biggest "flat tax" proponent, mostly supporting it just to enact some sort of simplification to the tax system....but issues like the IRS audit logs points yet again to the bloated American tax system - imagine what we could do with the economy when we don't have to add all the salaries of accountants and tax people, which add little to no value to a product (if not negative) through a simplification of the tax process. It's one of those self-propogating systems - the more laws we have on taxation, the more that companies have to spend to try and get around them.

    • You're mistake there is thinking that a simple tax system will catch more money than a complicated one. Why do you think the one we have is so complicated? Because companies pulled crap in the past that was 'within the letter of the law'.

      > imagine what we could do with the economy when we don't have to add all the salaries of accountants and tax people,

      Accountants and auditing are the punishment companies go through because of past misbehavior. You CAN NOT rely on trust, when you're insisting someone

  • Not just a problem for IRS (Score:4, Insightful)

    by ACK!! ( 10229 ) on Thursday December 18, 2008 @08:32AM (#26158937) Journal
    I would bet money a lot of government and I know for a fact a lot of private organizations do NOT audit their general security logs in a timely and in an effective fashion. Of course, its scarier when its the government considering the host of private info they have on us. But keep in mind how many credit card companies have been compromised and how much info they have on us. The problem is of course much bigger than one organization.

    • Re: (Score:3, Funny)

      by pyro_peter_911 ( 447333 )

      I would bet money a lot of government and I know for a fact a lot of private organizations do NOT audit their general security logs in a timely and in an effective fashion.

      Don't forget to file your form 1099 after you win that bet.

      Peter

    • Re:Not just a problem for IRS (Score:4, Informative)

      by IceCreamGuy ( 904648 ) on Thursday December 18, 2008 @09:18AM (#26159367) Homepage
      Alright, so let's start a discussion here; what do you guys do to audit your security logs?

      I'm really not sure if I do enough. I have the FW logs all forwarded to both its own DB as well as Splunk. I then analyze the FW logs with Sawmill, but only when something comes up, and about once a month I'll kinda just poke around for anything abnormal. Where I really do most of the work is in Splunk though. I have alerts set up for Router and FW access, too many failed logon attempts from the DCs, excessive errors and all that, and about once a week I go in and just browse the logs (through Splunk). Is this enough? What do you guys do? I'm just a one-man team here and I really just implemented these procedures myself without any real policy outline in place.
      • I forgot, we also annually have an outside consultant come in and do intrusion and security testing.

      • Can't you have your log system send you an email every day with all abnormal entries? It's a bit of work to define "normal" initially, but it's generally not complicated -- 95% of your logs are going to be entries about access from authorized users on authorized networks doing a small number of authorized things, and those are pretty easy to filter even with something as simple as awk (and trivial with more advanced tools).

        Start with that remaining 5% and whittle it down bit-by-bit until the daily report is

        • That's a good idea, I'll have to look into that.

        • Re: (Score:2)

          by mortonda ( 5175 )

          Can't you have your log system send you an email every day with all abnormal entries?

          This is what logwatch is for. I glance over it once a day.

      • I'm just a one-man team

        Security is a series of trade-offs. Sure, you could "increase your security" by spending all day looking at logs. But it's probably not worth it if you can be increasing your upside instead.

  • Read the whole report (Score:5, Informative)

    by BenEnglishAtHome ( 449670 ) on Thursday December 18, 2008 @08:44AM (#26159027)

    It's linked from the story. [treas.gov] It's short and, like all such reports, its has a proforma organization that makes it easy to read. The synopsis tends to have the spin (and that's what got the attention of PC World and the Slashdot folks) but the actual findings are also clearly stated so that you can draw your own conclusions.

    The inspectors made three findings.

    1. "Intrusion detection systems were deployed effectively."

    2. "Access controls over firewall and router system administrator accounts are operating effectively"

    3. "Management of firewall and router audit logs needs to be improved."

    Under # 3, they found one high-risk error, the only high-risk error in the report. That finding was "Audit logs were not independently reviewed".

    The IRS agreed with all findings and promised to fix things.

    My personal opinion? I think a report that says, to paraphrase, "All your stuff works fine. However, you aren't regularly running it all past someone not in the normal administrative chain; that failure is a serious error" is certainly something to be taken seriously but it's unlikely to be a career-killer for anyone. I've seen far, far worse reports on many different subjects from amny different agencies. The IRS, however, is really big and touches everyone so a finding that procedures are suboptimal is far more newsworthy than some of the truly horrific crap that passes for security practice at other agencies. I certainly feel no ill will towards those who are publishing this stuff. When you work for the IRS, you get used to seeing bad news (mostly exaggerated bad news) almost exclusively. Such is life.

    • Yes, especially considering the poor grades the DOD and DHS were given on computer security, this doesn't seem too serious.

  • It would be such revenge to see an audit on the IRS with such scrupulous nature as that in itself, that the IFCC stop all communications from happening with the IRS until they took proper precautions, and were again given the stamp of approval.... although they themselves would not see the irony, everyone ever audited would sure think so!!!

    • At the IRS, we keenly appreciate such irony, especially where audits are concerned. Everyone who works here is audited; it's part of the hiring process. If you're hired right out of college, there's a substantial chance your audit will consist of someone looking at your returns, concluding there's nothing worth looking at, and re-filing them. Thus, some new employees don't even realize they've been audited. But it happens to everyone. When I came aboard, I'd just closed down a Schedule C business with

      • I doubt very much such is the case on a regular basis, you might be the exception to the rule.
        The IRS audited my uncle 6 years in a row, everything from his business to personal, he had to hire
        a lawyer, because it was harassment. Some noob on the job thought he would eventually find something, but each time nothing was "found out of place". Each year also, they had the balls to ask for the previous years audit info (like they didn't already have it). I am sure you have not had a REAL audit. The one you desc

        • How long ago was this? And were the people doing the work Revenue Agents, Revenue Officers, or Special Agents?

          I don't mean to be arcane, but there's a big difference between a tax audit, even an intrusive one, and the kinds of things that require "rummaging through the house." Rummaging through the house == a lot more than an audit. I can think of only a few things that warrant that sort of treatment.

          1. Many, many years ago if you wanted to compromise a tax liability, you had to submit a financial state

          • Trust me ,it was an audit, of the biggest kind, necessary to call in his accountant and lawyer in on this, so I am sure it was an audit, whether looking for any means to pull off a quick
            blindfold over the eyes is a different story though.

            I agree if a government has proof of wrong doing, they can come in and do what they want "for the good of the country". They had no proof, they were looking for it.

  • Now you can get a chance to audit the IRS for a change!

  • Further proof that the IRS is outdated and needs to be dissolved...

  • Nonsensical claim. (Score:3, Interesting)

    by Spazmania ( 174582 ) on Thursday December 18, 2008 @10:22AM (#26160145) Homepage

    Nobody with a brain audits the security logs. The worms pound away at a rate of dozens per minute and the unsuccessful hack attempts are not far behind. If you were going to be able to detect a successful breach via the logs, you'd have prevented it at the firewall in the first place. The ratio between taxpayer-paid manpower to improved security would be exceptionally low.

    Truth is, the logs are only valuable forensically. After detecting a breach or suspected breach, the logs can tell you more about what actually happened and how far it spread.

  • Why should only hedge funds and corporations get the benefit of lax or nonexistent regulation, no enforcement and robber baron capitalism? It's only reasonable and in strict GOP dogmatic compliance that we should get away with everything we can up to and including hacking the IRS to afford ourselves a lower tax bill. And since all taxes are teh evil, I'm sure the Grover Norquists of the world are cheering.

Slashdot Top Deals

Over the shoulder supervision is more a need of the manager than the programming task.

Close