Our Objective(s)To determine whether DOT has established and implemented effective controls to secure and manage its mobile devices. As part of our review of DOT's mobile device management, we also assessed DOT's processes for maintaining an inventory of mobile devices and monitoring the costs of their use.
Why This AuditMany Federal employees use mobile devices, including smart phones to access their agencies' networks and systems, including those that process sensitive information. However, these devices can leave sensitive data vulnerable to cybersecurity threats and malicious software. Given increased use of mobile devices by DOT personnel and the cybersecurity risks associated with this use, we initiated this audit.
What We FoundDOT is taking steps to secure its mobile devices but has not yet implemented sufficient controls to effectively secure and manage all devices.
DOT's Office of the Chief Information Officer (OCIO), the Federal Aviation Administration (FAA), the U.S. Merchant Marine Academy (USMMA), and the Office of Inspector General (OIG) have begun implementing user and device authentication and data protection controls for their use of mobile devices. However, FAA and USMMA have not rapidly adopted software updates to ensure mobile operating systems are configured securely.
FAA and USMMA do not always restrict the use of mobile applications and do not have effective policies and procedures to manage and secure their mobile devices. In addition, OCIO and USMMA have not addressed security control weaknesses for their mobile device management solutions.
FAA has not maintained accurate inventories, and DOT OCIO and FAA have not ensured efficient spending for mobile devices.
Maintaining accurate inventories and monitoring spending are keys to efficient mobile device management. However, FAA did not maintain accurate inventories of its mobile devices. We found 157 personally owned mobile devices that had been granted access to FAA's network resources that FAA did not report to OIG when we took inventory.
DOT OCIO and FAA did not have effective controls in place to ensure efficient spending on mobile devices and services. We identified that FAA and OCIO were spending money on many mobile devices with zero usage, resulting in our identification of up to $422,838.45 for FAA and up to $203,884.19 for OCIO in funds that could be put to better use.
RecommendationsWe made 6 recommendations to improve DOT's process for managing and securing mobile devices within DOT's enterprise.
