Office of the Legislative Auditor - Financial Audit Division

Key Conclusion:

Serious security weaknesses have exposed the Web-based Motor Vehicle Registration Renewal System and citizens’ private data to an unacceptable risk of tampering, disruption, and misuse. Until significant security enhancements are made, the system should not be used to conduct business.

Findings:

• The department did not implement an effective security program.
• Computer programs developed by the Driver and Vehicle Services Division contained security flaws.
• Poorly configured wireless access devices provided a way to bypass the department’s firewall.
• Sensitive customer data and critical system components were not properly protected.
• The department did not promptly perform important system maintenance procedures.
• The department did not adequately monitor its systems.

Audit Scope:

Audit Period:
We assessed security controls as of March 2005

Selected Audit Areas:
The Web-based Motor Vehicle Registration Renewal System

Background:

The Department of Public Safety developed and implemented the Web-based Motor Vehicle Registration Renewal System in 2000. The system gives citizens the ability to renew their motor vehicle license tabs and plates over the Internet. Using a standard web browser, such as Microsoft’s Internet Explorer, citizens can pay their registration renewal taxes from the convenience of their home. Revenue from the web-based system increased from $6.6 million in fiscal year 2001 to $30.5 million in fiscal year 2004.