For the sixth year in a row the agency failed to resolve known cybersecurity issues: installing critical software fixes, letting unauthorized people access accounting programs, not performing background checks on new hires and failing to make sure contractors had received proper security training. If you thought you couldn’t like the Internal Revenue Service (IRS) any less, think again. For the past six years straight the IRS failed to install critical software fixes, let unauthorized people access accounting programs and didn’t make sure contractors had received proper security training. According to a report from the Government Accountability Office (GAO), last year the IRS corrected just 29 of 105 previously reported weaknesses, or less than one third of the issues. And 13 of those 29 fixes had been done improperly or incompletely, the GAO reports. Specific failures include: Lack of controls for identifying and authenticating users, including requirements for strong passwords Access to certain servers not appropriately restricted Sensitive data transmitted without encryption Lax physical access controls So it’s no surprise that last October the Treasury Inspector General for Tax Administration (TIGTA) said the top priority in its list of management challenges for the IRS this year was security of taxpayer data, including securing computer systems. That’s not to say no action was taken to address the problem; the action just wasn’t very thorough or effective. In addition to a partially-implemented IT security program, the IRS is also at risk due to known vulnerabilities from outdated and unsupported software, and shortcomings in system backups are placing data availability at risk, according to the GAO. By the way, TIGTA put out a report Monday that said it was unable to confirm that 77 percent of the agency’s new hires had been subjected to required background checks. Yikes. The IRS is currently five years overdue for complaince with a federal cybersecurity law that says agencies must have department-wide programs that, among other things, train personnel to comply with security policies and test technical protections. I wonder if there’s any sort of late fee or other penalty on that… Don’t worry too much, though. In response to the report, the IRS agreed to develop a detailed corrective action plan to address the problems. Related content opinion Why Bitcoins are Just as Viable as Any Other Currency The true value of any currency is a reflection of how much people believe it's worth, according to CIO blogger Constantine von Hoffman. But it's wise to remember just how fast beliefs can change. By Constantine von Hoffman Apr 15, 2013 4 mins Government Technology Industry opinion No Surprise: Docs Show Obama Administration Lying About Drones President Obama has repeatedly said drones would only be used against members of al Qaida and allied groups. However, leaked intelligence documents show the administration has been using them to settle political and tribal feuds for at least four yea By Constantine von Hoffman Apr 10, 2013 3 mins Regulation Government opinion How Big Data Can Quickly Become Big Garbage The bigger the data the bigger the chance of mistakes or inaccuracies. In that vein, a large database used by retailers to screen people accused of stealing from employers is identifying innocent people and could result in major lawsuits, according t By Constantine von Hoffman Apr 04, 2013 2 mins Big Data opinion Why Crazy Trumps Logic on the Internet The earth is flat. Vaccines cause autism. 9/11 was a government conspiracy. These are just a few of the many ideas that continue to find adherents online despite overwhelming proof that they're not based on fact. CIO.com blogger Constantine von By Constantine von Hoffman Apr 02, 2013 3 mins Government Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe