Financial-Related Audit Report
Conclusions:
The Department of Public Safety did not develop or implement an effective security infrastructure for the Web-based Motor Vehicle Registration Renewal System. The department did not formally identify and assess risks or document specific policies, procedures, and standards to appropriately secure the system. The security infrastructure that resulted was a collection of automated tools that lacked a cohesive policy foundation.
The 10 findings and 17 recommendations in this report address a broad array of security weaknesses. These findings highlight deficiencies in the department's:
Collectively, these security weaknesses leave the system and its data vulnerable to tampering, disruption, and misuse from both internal and external sources.
Background:
On October 18, 2000, the Department of Public Safety unveiled a new system that gave citizens the ability to renew their motor vehicle license tabs over the Internet. Using a standard web browser, such as Netscape's Navigator or Microsoft's Internet Explorer, citizens now can pay their registration renewal fees from the convenience of their home.
Financial-Related Audit Reports address internal control weaknesses and noncompliance issues found during our audits of state departments and agencies. The scope of our work at the Department of Public Safety was limited to a review of controls that protect the integrity and confidentiality of data on the Web-based Motor Vehicle Registration Renewal System.
