TREASURY
INSPECTOR GENERAL FOR TAX ADMINISTRATION
A Complete Certification and Accreditation Is Needed to Ensure the Electronic Fraud Detection System Meets Federal Government Security Standards
September 29, 2006
Reference Number: 2006-20-178
This report has cleared the Treasury Inspector General for
Tax Administration disclosure review process and information determined to be
restricted from public release has been redacted from this document.
Redaction Legend:
2(d) = Law Enforcement
Technique(s)
2(e) = Law Enforcement Procedure(s)
Phone Number |
202-927-7037
Email Address | Bonnie.Heald@tigta.treas.gov
Web Site |
http://www.tigta.gov
September 29, 2006
MEMORANDUM
FOR
CHIEF INFORMATION OFFICER
CHIEF,
CHIEF, CRIMINAL INVESTIGATION
FROM: Michael R. Phillips /s/ Michael R. Phillips
Deputy Inspector General for Audit
SUBJECT: Final Audit Report – A Complete Certification and Accreditation Is Needed to Ensure the Electronic Fraud Detection System Meets Federal Government Security Standards (Audit # 200620040)
This report presents the results of our review to assess the effectiveness of security controls over the Electronic Fraud Detection System (EFDS) by evaluating its certification and accreditation (C&A) packages.
Impact on the Taxpayer
The EFDS, an automated compliance system, was designed to
maximize fraud detection at the time tax returns are filed to prevent the
issuance of questionable refunds. Security
certifications conducted for the EFDS have been incomplete since October 2001,
resulting in limited assurance that EFDS security controls are effective in
protecting taxpayer information from unauthorized disclosure. This is especially significant because the
EFDS contains the Internal Revenue Service’s (IRS) second largest repository of
taxpayer information.
Synopsis
The IRS uses its
enforcement authority to collect taxes due from individuals who do not fulfill
their tax obligations. The IRS Criminal
Investigation function is responsible for detecting and investigating criminal
violations of the Internal Revenue Code and financially related crimes. The EFDS is the primary system used by the Criminal
Investigation function to identify questionable tax return refunds.
Since its initial development in 1995, the EFDS has gone through significant changes. The EFDS began as a client server application, allowing users to access the application through the IRS network. In June 2001, the IRS approved the conversion to a web-based application, which would enable users to access the EFDS through the IRS Intranet. While the web-based application was under development, the client server application continued to operate. The web-based application was expected to be available to process tax returns in 2006, so the client server application was shut down in December 2005. However, the web-based application never became operational. In April 2006, the IRS decided to restore the client server application to process tax returns in 2007.
Because the EFDS contains and processes highly sensitive taxpayer information, the security over the system is paramount to ensure all data are protected from unauthorized access and misuse. To ensure systems are secure, Federal Government Security Standards[1] dictate that all systems and applications be certified and accredited every 3 years or when major changes are made to the system. The Mission Assurance and Security Services (MA&SS) organization has responsibility to certify IRS systems. Part of that role is to ensure security controls are adequately tested. The system owner uses the results of those tests to authorize the system’s operation and by doing so accepts the risks associated with that system.
Overall, the security controls for the EFDS have not been adequately tested since October 2001. As a result, system owners accredited the systems with only limited assurance that security controls were effective to protect taxpayer information from being inappropriately accessed or misused. Our review assessed three separate components of the EFDS: the client server application,[2] the web-based application,[3] and the computers supporting the EFDS application.
When the EFDS client
server application was certified and accredited in August 2004, the testing to
support the certification did not follow IRS policies and Federal Government Security
Standards. Key application security controls
were not tested. Instead, the C&A
was based solely on the security of the supporting Windows-based operating
system.
Tests were not adequate
because the MA&SS organization omitted steps in the certification process in
order to meet its goal of certifying and accrediting 100 percent of IRS systems
by the end of Fiscal Year 2004. Emphasis
was placed on ensuring system owners signed accreditation memoranda rather than
performing adequate tests. In the fourth
quarter of Fiscal Year 2004, the IRS certified and accredited 30 major
applications, which included the EFDS, representing over one-half of its inventory
of major applications at the time.
Prior to the IRS’ decision to stop all development of the EFDS web-based application, we evaluated its January 2006 C&A to determine whether it met IRS security standards. We determined that required controls for data integrity, transmission confidentiality, and user authorization were not tested during the C&A process. As a result, the IRS had limited assurance that sensitive taxpayer information stored, processed, and transmitted by the EFDS web-based application would have been accurate, reliable, and protected from unauthorized access. The MA&SS organization again did not adequately follow the certification process in testing the EFDS because the implementation date for the system was imminent.
We also reviewed the August 2004 certification of computers
supporting the EFDS application at the
Recommendations
We recommended the Chief, MA&SS, coordinate with the
Chief, Criminal Investigation, to complete a full
security C&A package for the EFDS client server application and
supporting computers before the system is permitted to operate. In addition, if the EFDS web-based
application is redeployed, any tests of security controls that are omitted from
the C&A process should be fully disclosed and the associated risks
explained in the body of the security testing and security assessment
reports. Criteria should also be
included for identifying compensating tests and establishing follow-up testing
for omitted tests. Also, the Chief
Information Officer should develop a Business Impact Analysis for the
Response
The IRS agreed with our findings and recommendations. The Chief, MA&SS, has begun the process for completing a full security C&A of the EFDS client server application, which will be conducted prior to the EFDS being placed into operation for the next tax filing season. In addition, the Chief, MA&SS, will update its processes to ensure that all security testing reports and security assessment reports for EFDS and all other IRS systems explain any omitted tests and the associated risks. The process will ensure criteria will be included for identifying compensating tests and establishing plans for follow-up testing for omitted control tests.
The Chief Information Officer will develop a Business Impact
Analysis for the
Copies of this report are also being sent to the IRS managers affected
by the report recommendations. Please
contact me at (202) 622-6510 if you have questions or
Margaret E. Begg, Assistant Inspector
General for Audit (Information Systems Programs), at (202) 622-8510.
Appendices
Appendix
I – Detailed Objective, Scope, and Methodology
Appendix
II – Major Contributors to This Report
Appendix
III – Report Distribution List
Appendix
IV – Management’s Response to the Draft Report
Abbreviations
|
BIA |
Business Impact Analysis |
|
C&A |
Certification and Accreditation |
|
CI |
Criminal Investigation |
|
ECC-MEM |
|
|
EFDS |
Electronic Fraud Detection System |
|
FY |
Fiscal Year |
|
IRS |
Internal Revenue Service |
|
MA&SS |
Mission Assurance and Security Services |
|
NIST |
National Institute for Standards and
Technology |
|
POA&M |
Plan of Actions and Milestones |
|
PY |
Processing Year |
The Internal Revenue
Service (IRS) uses its enforcement authority to collect taxes due from
individuals who do not fulfill their tax obligations. Noncompliance may not be deliberate and can
stem from a wide range of causes, including lack of knowledge, confusion, poor
record keeping, differing legal interpretations, unexpected personal emergencies,
and temporary cash flow problems.
However, some noncompliance may be willful, even to the point of
criminal tax evasion. The IRS Criminal
Investigation (CI) function is responsible for detecting and investigating
criminal violations of the Internal Revenue Code and financially related
crimes.
The EFDS is used to maximize fraud detection at
the time that tax returns are filed to prevent the issuance of questionable
refunds.
The Electronic Fraud Detection System (EFDS), an automated compliance system, is the primary information system used to support the CI function’s Questionable Refund Program.[4] The EFDS was designed to maximize fraud detection at the time that tax returns are filed to prevent the issuance of questionable refunds. It is generally harder and more costly to recover fraudulent refunds once they have been issued.
Since its initial development in 1995, the EFDS has gone through significant changes. In June 2001, the IRS approved the conversion of the existing client server application[5] to a web-based application.[6] From Processing Years (PY)[7] 2001 through 2005, the client server application continued to operate as the web-based application was under development. The new application was initially expected to be available for PY 2005, but was subsequently delayed until PY 2006 due to system development problems. In December 2005, the client server application was shut down because of the impending release of the web-based application. However, the web-based application never became operational. In April 2006, the IRS decided to restore the client server application for PY 2007.
Because the EFDS contains and processes highly sensitive taxpayer information, the security over the system is paramount to ensure all data are protected from unauthorized access and misuse. Federal Government Security Standards issued by the Office of Management and Budget[8] require that all systems and applications must be certified and accredited every 3 years or when major changes to systems occur. Guidelines issued by the National Institute for Standards and Technology (NIST)[9] further describe this certification and accreditation (C&A) process, which includes the following three phases:
· Initiation: A categorization of the sensitivity of the system as high, moderate, or low risk. During this phase, the system security plan should be updated. The system security plan provides an overview of the security requirements for the system and describes the security controls in place or planned for meeting those requirements.
· Certification: A comprehensive assessment of the management, operational, and technical security controls in a system. Security controls testing of a system is performed to support the assessment, which is documented in a security assessment report. Any weaknesses identified during the testing are listed in a plan of actions and milestones (POA&M), which is monitored and updated until the weaknesses are corrected.
· Accreditation: An official management decision made by a senior agency official to authorize operation of an information system and to explicitly accept the risk to agency operations, agency assets, or individuals based on the implementation of an agreed-upon set of security controls.
The Mission Assurance and Security Services (MA&SS) organization has responsibility to certify IRS systems. Part of that role is to ensure security controls are adequately tested. The system owner uses the results of those tests to authorize the system’s operation and, by doing so, accepts the risks associated with that system.
The IRS has a long-standing computer security material weakness,[10] which includes the C&A process. We have issued several reports critical of the IRS C&A process, with the most recent issued in August 2004.[11] We also commented in our Fiscal Year (FY) 2005 report for the Federal Information Security Management Act of 2002[12] on the IRS’ improvements and continuing struggles with its C&A process.
We initiated this audit to
review the EFDS security controls. Two other audits were initiated to
answer questions raised by the
PY 2006.[13] Another audit (Audit Number 200610003)
is being performed to determine the effectiveness of the IRS’ procedures for
detecting fraudulent and potentially fraudulent refund returns (including
inventory controls) and the timely and proper hold and release of refunds.
In
addition, in June 1999 we reported[14]
that the EFDS had numerous security weaknesses, including inadequate audit
trails[15]
and contingency plans. Our review of the
IRS’ corrective actions to recommendations in this report determined the
weaknesses identified in the report have been adequately addressed.
Our review was performed at the MA&SS organization in New Carrollton, Maryland, during the period March through June 2006. The audit was conducted in accordance with Government Auditing Standards. Detailed information on our audit objective, scope, and methodology is presented in Appendix I. Major contributors to the report are listed in Appendix II.
Security Controls for the Electronic Fraud
Detection System Client Server Application Have Not Been Adequately Tested Since
2001
IRS policies and Federal Government Security
Standards require security controls for all major applications[16] be independently assessed, certified, and
accredited at least every 3 years.
Regular testing of security controls is necessary to determine the
extent to which the controls are implemented correctly, operating as intended,
and meeting the security requirements for the system. Failure to regularly test security controls
can result in undetected security weaknesses that place taxpayer information at
risk of unauthorized disclosure, potentially resulting in identity theft or
other privacy violations. For the EFDS,
insufficient security controls could place millions of taxpayer records at risk
for unauthorized access or modification, as the EFDS is the IRS’ second largest
repository of taxpayer information.
Insufficient
security controls for the EFDS, the IRS’ second largest repository of taxpayer
information, could place millions of taxpayer records at risk of unauthorized
access or modification.
Security controls for applications are
generally provided through the operating system (e.g., Windows) on which they
reside and by the application itself. To
reduce the resources required for certification, operating system controls do
not have to be retested for each application.
However, the application’s security controls must be tested. These controls are often the last line of
defense for protecting the confidentiality, integrity, and availability of
sensitive information.
Application security controls for the EFDS
client server application were last tested in October 2001 as part of the
certification that was signed in April 2002. The October 2001 testing identified 10
high-risk weaknesses that have since been addressed.
In August 2004, the EFDS was again certified
and accredited. However, this C&A relied
on certification of the Windows-based computers supporting the system and did
not include testing of the client server application security controls. The application controls are critical for ensuring
the confidentiality, integrity, and availability of taxpayer information in the
EFDS. As such, this August 2004 EFDS
client server application C&A provided only limited assurance that the EFDS
security controls were adequate.[17]
Application security controls were not tested
because the MA&SS organization omitted steps in the certification process
in order to meet its goal of certifying and accrediting 100 percent of IRS systems
by the end of FY 2004. Specifically, instead
of performing a full certification on each system, the MA&SS organization
focused on obtaining signed accreditation memoranda from system owners. As a result, many systems were accredited
without adequate documentation and security testing. In the fourth quarter of FY 2004, the IRS
certified and accredited 30 major applications, including the EFDS, representing
57 percent of the IRS’ inventory of major applications at the time.
The Chief, MA&SS, provided us with his
perspective on the FY 2004 C&A activities.
The Chief informed us that, upon assuming his new position in FY 2004,
he quickly discovered the IRS processes for C&A were incomplete and not in
accordance with Office of Management and Budget Circular A-130 guidance. Of greatest concern was the fact that very
few applications or systems had been accredited by the system owners or the
Chief Information Officer. Because the
systems were already in operation, the Chief, MA&SS, indicated his intent
was to have system owners sign accreditation memoranda for all major systems so
they would recognize their responsibilities for accepting the risks associated
with their systems.
At the end of FY 2004, the IRS initiated a
major effort to at least get a signed accreditation memorandum in place for
every major application and general support system. The MA&SS organization’s review of the
security documentation of many systems at that time, including the EFDS,
revealed that Security Plans and other security documentation were incomplete
and did not contain the level of detail necessary to accurately capture all
security considerations.
While accreditation is an important and a required step in the C&A process, NIST guidelines[18] state, “it is essential that agency officials have the most complete, accurate, and trustworthy information possible on the security status of their information systems in order to make timely, credible, risk-based decisions on whether to authorize operation of those systems.” Because the EFDS client server application was tested inadequately, we believe the system owner signed the accreditation without a full understanding of the status of EFDS security controls.
Recommendation
Recommendation 1: The Chief,
MA&SS, should coordinate with the Chief, CI, to complete a full security C&A package for the EFDS client server
application and supporting computers before the system is permitted to operate.
Management’s
Response:
The Chief, MA&SS, has already begun coordination with the Chief, CI,
to complete a full security C&A of the EFDS which will be conducted prior
to the EFDS being placed into operation for the next tax filing season. This C&A will be based on currently
available draft and final versions of Federal Government security process
guidance. The EFDS application security
controls will be tested based on NIST guidance as well as any other available
security controls testing process guidance from other Government organizations
and industry best practices.
If the Web-Based Electronic Fraud Detection System Had Become Operational, It May Have Allowed Unauthorized Access to Taxpayer Information
Required security controls for the EFDS web-based application were not tested as part of its C&A.
Prior to the IRS decision in April 2006 to stop all system development activities for the EFDS web-based application, we evaluated the effectiveness of its January 2006 C&A to determine whether it would have met IRS security standards. Our review identified problems with the completeness of security controls testing and the IRS process for reporting omitted security control tests. Specifically, key security controls in the following areas were not tested as part of the C&A process:
Controls in these areas are required by IRS policies and the EFDS security plan. In addition, they are included in the required set of controls for high-risk Federal Government systems specified by the NIST. This is not the first time IRS management has omitted tests in C&A packages for the EFDS. Our review of the 2002 C&A for the client server application also identified omitted security tests. Specifically, two configuration management tests were omitted because the tools needed to execute the tests were not available. No alternative tests were performed to ensure the controls were adequate.
By not testing these controls, the IRS had limited assurance that sensitive taxpayer information stored, processed, and transmitted by the EFDS web-based application would have been accurate and reliable. In addition, there are limited assurances this sensitive information would have been protected from unauthorized access, modification, or deletion.
The MA&SS organization did not adequately follow the certification process in testing the EFDS due to the imminent implementation date of the System. Testing was conducted in 1 day only a few weeks prior to implementation. In addition, testing was performed on the EFDS training system and not the actual EFDS production system. IRS management informed us that the 2005 version of the System was unusable for testing since it was undergoing significant changes and the EFDS training system was the best system available to use at that time. However, they also informed us that, due to the volume of changes being made to the production web-based application, they were unable to mirror those changes on the training system. Because the training system did not have actual EFDS data or follow IRS user authorization processes, tests for data integrity, user authorization, and transmission confidentiality controls were not performed.
In addition, the MA&SS organization did not prominently disclose the omitted tests in the C&A report. While the omitted tests were i