IRS may be able to count beans, but it can't count its own PCs
Treasury crawls up taxmen's ass with microscope
Customer Success Testimonial: Recovery is Everything
Auditors have criticised US taxmen for failing to keep on top of its IT and the installation of software security patches.
A report [PDF] by the US Treasury credits the IRS with upping its game in patching insecure products faster than it has done previously - but faults the agency for failing to apply a more coherent approach to vulnerability remediation, a shortcoming that means sensitive data is at increased risk of exposure through hacking attack.
"The IRS has taken some actions to address patch management weaknesses, but an enterprise approach is needed to fully implement and enforce patch management policy," the reports concludes. "Any significant delays in patching software with critical vulnerabilities provides ample opportunity for persistent attackers to gain control over the vulnerable computers and get access to the sensitive data they may contain, including taxpayer data."
The 38-page dossier by the Treasury Inspector General for Tax Administration (TIGTA) on the audit was compiled at the end of September, but only published last week, following the redaction of security shortcomings that hackers could have exploited.
Implementing effective patch management processes has been an ongoing problem for the IRS. Updating Windows has been improved this time, but the IRS has yet to draw up a full inventory of its IT assets, which is vital for developing a decent patch management strategy for its gear. The report stated:
The IRS has not completed implementation of an accurate and complete inventory of its information technology assets, which is critical for ensuring that patches are identified and applied timely for all types of operating systems and software used within its environment.
There must be systems in place to ensure patches are applied in a timely fashion, too.
TIGTA warns that the IRS needs to come up with procedures to stop workers bringing their smartphones and other devices into work or risk a data security leak.
"The IRS also has not implemented controls to ensure that unsupported operating systems are not putting the IRS at risk," TIGTA warns. "The IRS needs enterprise-level oversight and leadership to complete the implementation of its standardized patch management program and to achieve the benefits of implementing enterprise-wide patching solutions."
The Treasury said the IRS uses an automated asset discovery tool to build an accurate and complete inventory of its stuff before formulating a revised policy to make sure all these assets are patched. It adds that it would be more cost efficient to purchase enterprise-wide patching and vulnerability management tools, to avoid the overlap and extra costs that a piecemeal approach may bring.
IRS managers agreed with all but one of TIGTA’s eight recommendations, taking issue only the suggestion that managers should be hauled over the coals for missing patching deadlines.
"Although the IRS agreed with the intent of the recommendation to hold system owners accountable for patching computers within prescribed time frames, it stated that its existing procedures addressed this recommendation and planned no corrective actions," the TIGTA report explains. ®
COMMENTS
Older operating systems such as XP might be the better route. XP has been out so long that most of it's vulnerabilities have been stitched up. W7 is not too bad. Win8 needs "a bit" of work! So much for having a newer OS.
Not allow workers to bring their "smart phones" with them to work? Good luck.
Canada Revenue Agency
We have 55,000 PCs and 20,000 laptops deployed. We use WSUS with in-building cache appliances to distribute patches, and Tivoli to pull reports. For PCs that are more than a few patches behind we get a monthly report and visit those devices to fix corrupted/broken Windows updates (a rebuild is often the best way to fix it.) Java/Flash/etc are updated automatically with Tivoli.
We don't link Tivoli's automated asset discovery and Active Directory to BMC Remedy Servicedesk yet. That means it is not completely accurate (high nineties.)
We don't permit old operating systems (Windows XP) to be connected to the network.
All pending patches are installed at bootup.
Our patch compliance rate is perhaps 99%.
AC for obv. reasons
Good luck with this!
Seriously, I'm not sure if the average US citizen understand exactly how much IT property the IRS has. When you add up all of it, from the 12 man job tucked away in a corner off in BFE to the service centers, there is more IT property there than any 1 American company (possibly 2 companies). And that is just what they have accounted for so far! And the users, well they have them ALL! If you can think of a type of user, yep they have it, good and bad.
This might just be a pull to lift funding freezes or what not because this is serious spending. Otherwise, it will be the most difficult patch job any system admin can think of. Think you've seen a IT nightmare? Well step it up, and step into the world of IRS.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Enabling efficient data center monitoring
Agentless Backup is Not a Myth
Customer Success Testimonial: Recovery is Everything
