Treasury: IRS’s Oversight of Active Directory Security Service Needs Improvement (IRC §7803)

In the IRS’s implementation of a Windows domain security service called Microsoft® Active Directory, its computer rooms containing Integrated Submission and Remittance Processing (ISRP) domain controllers lack physical security and environmental controls, the Treasury Inspector General for Tax Administration said in a report released February 10. TIGTA identified 15 physical security violations related to designated “Limited Areas” (housing certain information technology assets), multifactor authentication, fire safety and suppression, and emergency power shutoff. The ISRP Active Directory architecture lacks necessary logical security controls, TIGTA found, adding that the IRS improperly configured ISRP service and business role accounts, resulting in more than ...