Case Study Review: U.S. DOT ARRA Website Vulnerabilities

Executive Summary The United States experienced an economic shock, commonly referred to as the “Great Recession”, in 2008 that resulted in the most job losses in any year since WWII. Payrolls plummeted, home values dove, and slumps were experienced in almost every sector of the economy. The administration of President Bush had agreed to provide federal loans to prop up the automobile industry and President-elect Obama inherited an economy in collapse. In 2009, the newly elected President Obama signed the American Recovery and Reinvestment Act (ARRA) into law. The Act provided stimulus spending in infrastructure, health, energy, education, unemployment insurance, social welfare programs, and many other areas of government interest. To address concerns from political opposition to that Act, ARRA included strong provisions governing transparency of the spending of taxpayer money. ARRA funds would be dispensed with strong requirements that taxpayers be able to monitor how their tax money is being spent. A major beneficiary of the stimulus funds was the Department of Transportation. To address the transparency issue, the department established a number of websites supported by servers and databases that the public could access to monitor the spending of their tax dollars. The DOT’s expanded web interface inherently exposed it to greater risk. This case study reviews an audit of that risk, the department’s shortfalls in mitigating the risk, its systems that may have contributed to those failures, and this reviewer’s recommended solutions.

Case Study Review
Situation
That legislation required unprecedented levels of transparency and accountability for the billions of tax dollars that would be spent on various programs including infrastructure, research, education, arts, and sciences.
For infrastructure spending, the U.S. Department of Transportation (USDOT) was to receive a substantial amount of ARRA funds. Over 48 billion dollars were earmarked for 7 operating administrations (OAs) within the department. To meet the transparency requirements of ARRA, the USDOT and its OAs set up various websites to provide taxpayers and other stakeholders with ARRA-related spending information. Given the inherent nature of risk in the Web, the launching of these websites increased the USDOT’s potential or security risks. The Office of Inspector General of the USDOT conducted an audit to determine if the department and its OAs websites were developed with best practices for risk mitigation. Of particular concern was the nature of these websites. USDOT’s public information websites are developed for the public to access the site to get information about how the USDOT is spending ARRA funds. If hackers are able to gain access to these sites, there is a risk that the hackers could use the site to gain access to user’s computers; that is, the U.S. taxpayer user’s computer. Failure to adequately protect this information would erode the public’s confidence in this important U.S. government agency. Yet worse, failure to protect this information could undermine the Act’s purpose and the U.S. government’s initiatives in general.
Key Findings The USDOT OA’s websites and databases contained 1,822 high-risk vulnerabilities. The Inspector General described high-risk vulnerabilities as those in which a hacker may be able access a public user’s computer and personal information and may be able to take control of servers to attack other computers on the USDOT’s networks. The vulnerabilities exist because the USDOT’s websites, servers, and database systems do not comply with the department’s security configuration standards.
The high-risk vulnerabilities also extended to the department’s databases. The department deployed a database system named the Recovery Act Data System (RADS) to collect information from the department’s grantees for external public reporting. The audit found that it was possible to gain access to this system and compromise the information stored for the purpose of that public reporting.
In addition to these high-risk vulnerabilities, the audit found 3,550 medium-risk problems and 3,759 low-risk issues involving servers, websites, and databases.
Key Recommendations This reviewer notes a key finding in the Office of Inspector General’s audit. As stated in that report on ARRA Websites Vulnerable to Hackers and Carry Security Risks (2009), the “vulnerabilities exist because the Websites, servers, and database systems are not configured in compliance with DOT’s configuration security standards” (p. 4). The COBIT model is a concept of organizational enterprise objectives being connected to underlying IT infrastructure through “cascading” goals. When the enterprise objectives are not being met by the underlying IT systems, it would imply a disconnection in the enterprise framework. In the case of the USDOT’s websites, servers, and databases, it appears that the USDOT’s enterprise objectives are not being well served by IT infrastructure. The USDOT should communicate and monitor the department’s enterprise business objectives to assure that IT security processes are serving those objectives. More effective internal controls and monitoring activities should be put in place to assure compliance and connection to the overall organization security framework to reduce risk.