Report No. 2009-04
January 2009
Complete Audit Report

Important Security Controls Are in Place, but Work Remains to Ensure the Confidentiality and Integrity of System Data and Information

This audit reviewed the Missouri Department of Transportation (MoDOT) Carrier Express System. Auditors found MoDOT management established many of the security controls necessary to protect the confidentiality, integrity and availability of data and information in the Carrier Express System. However, MoDOT management needs to establish additional controls to better ensure the confidentiality and integrity of data.

System has been operating as designed
The Carrier Express System had been operating as MoDOT management designed. The critical functions of collecting, processing, storing and reporting motor carrier data have been reliably performed. Except as noted in the following two sections, data confidentiality and integrity have been ensured through controls over the input, processing, storage and output of system data. (See page 5)

Review of user account access rights needed
MoDOT Motor Carrier Services management had not ensured user access rights remained commensurate with job responsibilities by performing regular reviews of user accounts and related access rights or privileges. Requiring a review of all user accounts ensures the right type and level of access has been provided. Without reviewing user access rights, management cannot ensure access rights are appropriate for the user's responsibilities resulting in an increased risk of unauthorized access, modification, use or disclosure of data. (See page 5)

Insurance agents' access should be restricted
Insurance agents had access to change insurance policy information in the Carrier Express System for all motor carriers, including carriers not insured with the agent. Accepted standards require information systems to enforce the most restrictive set of rights, privileges or accesses needed by users. Without a control to restrict access, insurance agents had the ability to make unauthorized changes and motor carriers could have been granted the authority to operate without having the required insurance. (See page 6)

Complete Audit Report
Missouri State Auditor's Office
moaudit@auditor.mo.gov