IRS Exempt from Security?

It’s TAX TIME! or is it HACK TIME?

It comes as no surprise an organization as large as the IRS is lacking some security controls, but from the material provided in several news articles it appears the IRS is lacking some fundamental elements or the application of Security Policies and standard IT Management processes is spotty at best. This is a major issue given recent news that sensitive information for the Democratic and Republican Presidential candidates was leaked by contractors.

The report findings about the IRS are items that most other organization are apparently already required to meet, according to various sources: the Sarbanes-Oxley legislation, the Payment Card Industry’s Digital Secrity Standards, and even the Health Information Portability and Administration Act. 

Overall security for an organization is made up of the sum total of all the piece, parts, polices, and process surrounding the organization. For the IRS, security seems less than what it should be. Specifically of concern are the following passages in the article, which were likely quoted directly from a report provided to the AP:

• [MSNBC] … system administrations circumvented authentication controls by setting up 34 unauthorized accounts that appeared to be shared-use accounts, the report found
• [CNN.com] more than 84 percent of the 5.2 million occasions that employees accessed a system to administer and configure routers, they used “accounts” that were not properly authorized
• [MSNBC] A review found that the IRS had authorized 374 accounts for employees and contractors that could be used to perform system administration duties. But of those, 141 either had expired authorizations or had never been properly authorized.
• [CNN.com] … there was no record that 55 employee and contractor accounts had ever been authorized.
• [CNN.com] In addition, nine accounts were still active, even though the employees and contractors had not accessed the system for more than 90 days, the report says.
• [CNN.com] The report does not say whether taxpayer information was misused, but says it is continuing to review security to see whether changes made to the computer system were appropriate or warranted.

Unauthorized accounts made unknown, untracked, and potentially unauthorized changes to systems and networks at the IRS? Multiple users share the same administrative account for making changes to multiple systems? Accounts were unused and still active after 90 days of inactivity? Log reviews are not conducted?
We are talking about the Internal Revenue Service, right??

For any organization reading this thinking, we have those same issues - what’s the big deal?

1. Unauthorized accounts making potentially unauthorized changes = a potential security breach
2. Multiple users sharing administrative account access = inability to determine who made what change
3. Unused accounts still active after 90 days = even Microsoft gets this one right!
4. No Log Reviews = no proof that a breach happened, no notice that a breach is in progress, and no idea how wide spread an attack is/was

A popular statistic among security professionals is that most security incidents are caused by insiders violating security protocols, policies, or processes; percentage is over 70% of all security incidents are caused by insiders. Given the IRS’ report findings, this is again a serious issue.

The underlying problem at the IRS is likely the same problem that other businesses face, how to be secure without security getting in the way? The simple answer: Security is a mindset. Either management gets it and supports it or they don’t and authorize exceptions to policy under the guise of “Just get it done.” This “get it done” approach completes projects on-time, often avoids cost-overruns due to last minute security bolt-ons, and usually leaves system or process gaps that can be taken advantage of by disgruntled or otherwise motivated employees.

What’s the solution?

A realistic hard look at how an organization views security, how management feels about the impacts of security, and ultimatley what costs an organization is willing to pay for security. In the case of the IRS, ”The IRS issued a statement Monday saying it had “taken a number of steps to improve the control and monitoring of routers and switches.” — [MSNBC]

Security sells too!

Security has become sexy and it has become widely accepted. TV shows sport trendy security speak and security gadgets. Forensics is so popular that all the major networks have shows based in some part on forensics. Indiana Jones (Harrison Ford) starred in a movie named, oddly enough, Firewall. I thought Firewall was a much better movie than Swordfish with John Travolta and Halle Berry, even though Berry is much cuter than Ford. I would be remiss if I didn’t mention 24 or CSI:Everywhere.

For all the marketing, awareness, and research being poured into Security one might think we would be able to solve the rampant Security problems of the current era: Data Loss, Fraud, and Identity Theft. Unfortunately, there are two competing dichotomies undermining or taking advantage of security visible in the following observation: businesses often fail to embrace security, because of perceived costs or rigidness, until after it is too late, because criminals find security, or rather the lack of security, a very profitable proposition.

Looking at one aspect of why things are where they are:

Business: The Flaw with Consensus
In a perfect world, businesses map out their business model, identify their assets, determine their risks, and implement policies and measures to mitigate or accept those risks. Most businesses pick and choose security models inside their company based on their access needs and use of the data in these electronic storehouses. Security is always a balancing act because it gets in the way of a business’s bottom line and exceptions to newly implemented policy are often needed in order to continue business operations. As long as security is ruled by consensus, these compromises will leave lasting effects that can be leveraged by the bad guys.

The Security Landscape ends up being the sum of compromises instead of the artifact of Security Policies and Practices.

Enter The Bad Guys:
Unfortunately, the bad guys often have more interest, resources, and desire to exploit security than their would-be targets have to protect themselves. In fact, Organized Crime has more money to spend on and to be made from gaining access to electronic record storehouses than the businesses that own these electronic record storehouses typically invest in securing these storehouses. Sadly, the bad guys don’t care if their target is a Fortune 500 company or not.

Small businesses make as good a target as any major brand or corporation and because of the dependence on the Internet, more and more companies are exposing their information to more and more of the world. This exposure is universal and provides a virtual play ground for the bad guys to take advantage of these businesses through network probes, phishing, pharming, and botnet attacks.

If this weren’t enough, for a given business that manages to place adequate security in place, to thwart electronic trespassing, there is always the human factor.  Disgruntled, under-paid employees litter the landscape of every organization on this planet who would welcome an unexpected payday for sharing their password or other sensitive information. its more efficient to probe the network defenses of a company than identify these disgruntled employees.

What can we do?
Know your business, identify the risks associated with how the business works, and carefully consider how to mitigate these risks. Take the time to understand the technology, people, and processes used in your business. Map out a security strategy that compliments the business.

It isn’t necessary to spend a fortune on security or have the latest and greatest widget from Cisco, IBM, or Microsoft. A good technology or security consultant can be worth their weight in gold. If your business is going to rely on technology, it would be wise to retain and listen to staff that fully understand said technology versus relying on product vendors who are notorious for over-promising ad under-delivering.

 The saying is very true: an ounce of prevention is worth a pound of cure.