"While the IRS has conducted awareness presentations and distributed communications to encourage employees to comply with its personal use policy, it does not effectively monitor the email of its employees to ensure compliance with the policy," the report said.
Also included in the report were the results of a random sampling of 28 of the agency's 228 email servers. Inspectors found that these servers had more than 700 security vulnerabilities that could disrupt IRS operations. The majority of these were a result of poor patch management.
"The majority of the security vulnerabilities on the email servers cited above occurred because system administrators had not installed current security patches to the email servers," the report said.
In addition, the inspection of IRS email systems found thousands of IP-addressable devices serving as unofficial email servers—approximately 4,913 in all.
Inspectors warned that such flagrant disregard of agency policies combined with vulnerabilities in IRS email systems and an overabundance of ad-hoc servers put the entire IRS IT infrastructure at risk. According to the report, the Treasury Inspector General is working with IRS technical staff to fix these problems.
