DOT's Cloud-Based Systems' Security Weaknesses Hinder Its Transition to a Zero Trust Architecture

Submitting OIG:

Report Description:

What We Looked At Over the past 10 years, the Department of Transportation (DOT) and its Operating Administrations (OA) have increased their migration to and adoption of cloud computing based on Federal requirements. In May 2021, the President issued Executive Order 14028 to modernize Federal Government cybersecurity by accelerating the movement to secure cloud services, adopting security best practices, and advancing towards zero trust architecture (ZTA). Given the administration's increased emphasis on cloud services, we initiated this audit. Our audit objectives were to assess the effectiveness of the Department's (1) cloud systems' security and privacy controls and (2) strategy to secure cloud services in order to implement ZTA. What We Found DOT and its OAs do not consistently implement security and privacy controls to protect their cloud-based systems. First, the Department and several OAs did not effectively follow Federal requirements and best practices to protect their cloud systems from cyberattacks. Second, DOT does not always effectively manage and secure the computing resources for its cloud-based systems by using secure configuration baselines, implementing multifactor authentications, encrypting data, or updating software. Lastly, DOT does not consistently use the appropriate mechanisms to detect, mitigate, and report cyberattacks on the Department's and most of the OAs' cloud-based systems. As a result, DOT may not have visibility into cybersecurity incidents, exposing it to potential threats and security weaknesses. Furthermore, DOT lacks an effective strategy for securing its cloud services transition to ZTA because its current ZTA implementation plan does not include a proposed schedule or migration steps as required by Federal guidelines. This may cause DOT to miss key milestones for implementing ZTA by the end of fiscal year 2024. Therefore, the Department will not be well positioned to meet ZTA's intent to maximize security and minimize uncertainty of computing systems. Our Recommendations We made 21 recommendations to improve the Agency's cloud services program and transition its enterprise network to ZTA. DOT concurred with 19 of 21 recommendations, did not concur with 1 recommendation, and asked to close 1 recommendation. We consider 17 of 19 recommendations resolved but open pending completion of planned corrective actions and request DOT provide an updated response for the 2 other recommendations. We consider two recommendations unresolved and request the Agency reconsider its non-concurrence for the first recommendation and provide documentation to support closing the second recommendation. Note: This report has been marked Controlled Unclassified Information (CUI) in coordination with the U.S. Department of Transportation to protect sensitive information exempt from public disclosure under the Freedom of Information Act, 5 U.S.C. § 552. Relevant portions of this public version of the report have been redacted.

Date Issued:

Wednesday, August 30, 2023

Agency Reviewed / Investigated:

Department of Transportation

Submitting OIG-Specific Report Number:

IT2023043

Component, if applicable:

Office of the Special Trustee for American Indians

Office of the Secretary of Transportation

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

Additional Details Link:

https://www.oig.dot.gov/library-item/39602

Recommendation Number	Recommendation Status	Significant Recommendation	Additional Details
2	Open	Yes	https://www.oig.dot.gov/library-item/39602
Incorporate the required standard cloud security clauses in the Department’s enterprise cloud service contracts as well as other cloud services contracts for FAA, MARAD, and OST to ensure the cloud services are secure.
3	Open	Yes	https://www.oig.dot.gov/library-item/39602
Working with the appropriate DOT procurement officials for FAA, FMCSA, FHWA, MARAD, FRA, NHTSA, PHMSA, and OST, set up service level agreements as required, with each of their cloud service providers to define and set agency expectations and cloud service provider-specific responsibilities.
4	Open	Yes	https://www.oig.dot.gov/library-item/39602
Direct and require confirmation of completion from FMCSA's cloud-based system owners for the National Registry of Certified Medical Examiners—Software-as-a-Service to include in its Executive Summary Authorization to Operate Letter to the Authorizing Official proof of its review of cloud service provider's continuous monitoring activities to ensure its cloud system security posture remains sufficient for its own use and supports its ongoing authorization, as required by FedRAMP.
5	Open	Yes	https://www.oig.dot.gov/library-item/39602
Direct and require confirmation of completion from OST's cloud-based system owner for the Federal Human Resources Navigator—Software-as-a-Service to: a. Include in its executive summary/Authorization to Operate letter to the Authorizing Official proof of its review of cloud service provider's continuous monitoring activities to ensure its cloud system security posture remains sufficient for its own use and supports its ongoing authorization as required by FedRAMP. b. Use personal identity verification cards as the primary authentication mechanism to ensure secure system login. c. Develop a Privacy Impact Analysis to help identify and manage personally identifiable information and privacy risks. d. Identify a security official to review system audit log files. e. Develop and implement a process to remove extracted data containing sensitive information within 90 days of extraction in accordance with DOT requirements.
6	Open	Yes	https://www.oig.dot.gov/library-item/39602
Direct and require confirmation of completion from OST's cloud-based system owner for the Electronic Document Management System—Software-as-a-Service to: a. Include in its executive summary/Authorization to Operate letter to the Authorizing Official proof of its review of cloud service provider's continuous monitoring activities to ensure its cloud system security posture remains sufficient for its own use and supports its ongoing authorization, as required by FedRAMP. b. Require multifactor authentication for non-DOT system users. c. Develop and implement a process to automatically disable inactive system accounts after 60 days of inactivity.
7	Open	Yes	https://www.oig.dot.gov/library-item/39602
Direct and require confirmation of completion from OST's cloud-based system owner for the Data Analysis Visualization Environment—Software-as-a-Service to: a. Include in its executive summary/Authorization to Operate letter to the Authorizing Official proof of its review of cloud service provider's continuous monitoring activities to ensure its cloud system security posture remains sufficient for its own use and supports its ongoing authorization, as required by FedRAMP. b. Develop and implement a process to conduct monthly vulnerability scans as required by DOT.
8	Open	Yes	https://www.oig.dot.gov/library-item/39602
Direct and require confirmation of completion from MARAD's cloud-based system owner for US Merchant Marine Academy/Campus Labs—Software-as-a-Service to: a. Include in its executive summary/Authorization to Operate letter to the Authorizing Official proof of its review of cloud service provider's continuous monitoring activities to ensure its cloud system security posture remains sufficient for its own use and supports its ongoing authorization, as required by FedRAMP. b. Complete an annual security authorization process and obtain a full authorization to operate for its Software-as-a-Service cloud information system to ensure all system risks have been properly identified and accepted in accordance with departmental cybersecurity policies. c. Update its privacy threshold assessment and, if applicable, Privacy Impact Analysis to protect privacy, personally identifiable information, and other sensitive information stored in the cloud.
9	Open	Yes	https://www.oig.dot.gov/library-item/39602
Direct FAA's cloud-based system owner for the Emergency Notification System—Software-as-a-Service to provide evidence of the organizational administrator's quarterly reviews of Emergency Notification System application and documentation verifying they disable inactive accounts.
10	Open	Yes	https://www.oig.dot.gov/library-item/39602
Direct and require confirmation of completion from FRA's cloud-based system owner for its Cloud Application Services—Software-as-a-Service—to: a. Include in its executive summary/Authorization to Operate letter to the Authorizing Official proof of its review of cloud service provider's continuous monitoring activities to ensure its cloud system security posture remains sufficient for its own use and supports its ongoing authorization as, required by FedRAMP. b. Update the Privacy Impact Analysis for the Railroad Compliance System to ensure the proper privacy controls are in place to identify and protect personally identifiable information and other sensitive information.
12	Open	Yes	https://www.oig.dot.gov/library-item/39602
Direct and require confirmation of completion from NHTSA's cloud-based system owner for the Advanced Retrieval Tire, Equipment, Motor Vehicle, Information System—Platform-as-a-Service to: a. Include in its executive summary/Authorization to Operate letter to the Authorizing Official proof of its review of cloud service provider's continuous monitoring activities to ensure its cloud system security posture remains sufficient for its own use and supports its ongoing authorization as required by FedRAMP. b. Update the Privacy Impact Analysis to ensure the proper privacy controls are in place to identify and protect personally identifiable information and other sensitive information.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

Open

Yes

https://www.oig.dot.gov/library-item/39602

Incorporate the required standard cloud security clauses in the Department’s enterprise cloud service contracts as well as other cloud services contracts for FAA, MARAD, and OST to ensure the cloud services are secure.

Open

Yes

https://www.oig.dot.gov/library-item/39602

Working with the appropriate DOT procurement officials for FAA, FMCSA, FHWA, MARAD, FRA, NHTSA, PHMSA, and OST, set up service level agreements as required, with each of their cloud service providers to define and set agency expectations and cloud service provider-specific responsibilities.