IR-2018-241, December 4, 2018
WASHINGTON — To help protect against cybercriminals stealing identities, the IRS, state tax agencies and the nation’s tax industry urged people to review new, stronger standards to protect the passwords of their online accounts.
Every individual or tax practitioner who maintains any type of online accounts should use strong passwords to protect against savvy cybercriminals taking over their identities and accessing sensitive tax and financial data.
But there’s been some new thinking as to what a strong password is. The latest guidance suggests using a passphrase such as a favorite line from a movie or a series of associated words rather than using a password. The idea is to create a passphrase that can be remembered easily and protect the account. This means passwords like – “uE*s3P%8V)” – are out. Longer, personal phrases people can remember – for example, SunWalkRainDrive – are now preferred.
The Internal Revenue Service, state tax agencies and the tax community, partners in the Security Summit, are marking “National Tax Security Awareness Week,” Dec. 3-7, with a series of reminders to taxpayers and tax professionals. In part three, the topic is creating a strong password.
This is especially important for taxpayers and tax professionals who use online accounts involving financial data or even their online account with the IRS or a tax software provider.
“The IRS and the Security Summit partners have strengthened our systems to help protect against tax-related identity theft,” said IRS Commissioner Chuck Rettig. “To make these defenses even stronger, we need taxpayers and tax professionals to take common-sense steps to protect their data and make it harder for identity thieves. By using better passwords, people can help themselves and the tax community against identity theft.”
The IRS, like all federal agencies, follows the cybersecurity framework set by the National Institute of Standards and Technology or NIST, which is a branch of the Department of Commerce. NIST last year rethought its guidance on passwords.
NIST suggested these three steps to build a better password:
- Step 1 – Leverage your powers of association. Identify associated items that have meaning to you.
- Step 2 – Make the associations unique to you. Passphrases should be words that can go together in your head, but no one else would ever suspect. Good example: Items in your living room such as BlueCouchFlowerBamboo. Bad example: Names of your children.
- Step 3 – Picture this. Create a passphrase that you can picture in your head. In our example, picture items in your living room. The key is to create a passphrase that is hard for a cybercriminal to guess but easy for you to remember.
In addition to creating strong passwords, the Security Summit urges taxpayers and tax practitioners to take these additional steps:
- Use a different password or passphrase for each account; use a password manager if necessary for multiple accounts.
- Use multi-factor authentication whenever possible. Don’t rely on the passphrase alone to protect sensitive data. Multi-factor authentication means returning account holders need more than just their credentials (username and password) to access an account. They also need, for example, a security code sent as text to a mobile phone. Email providers and social media outlets, such as Facebook, offer multi-factor authentication options. For tax professionals, some tax software providers will offer multi-factor authentication as an option, and practitioners should use it if it’s available.
- Change all factory-set passwords for wireless devices such as printers and routers. Again, use strong passphrases to protect access to these devices, which further safeguards sensitive data.
The IRS, state tax agencies and the tax industry are committed to working together to fight against tax-related identity theft and to protect taxpayers. But the Security Summit needs help. People can take steps to protect themselves online.
Taxpayers can visit the “Taxes. Security. Together.” awareness campaign or review IRS Publication 4524, Security Awareness for Taxpayers, for additional steps to protect themselves and their data from identity theft. Tax professionals can get more information through the Protect Your Clients; Protect Yourself campaign as well as the Tax Security 101 series. https://www.irs.gov/newsroom/security-summit-partners-highlight-new-password-guidance-urge-taxpayers-and-practitioners-to-protect-all-accounts
