Transportation Management Center
Information Technology Security
Final Report
September 2019

The Federal Highway Administration (FHWA) Office of Operations (HOP) is pleased to present
this guide on Transportation Management Center (TMC) Information Technology (IT) Security.
TMCs and Intelligent Transportation System (ITS) infrastructure are designed with technologies
such as Ethernet IP-enabled networks and wireless connectivity capabilities. While suchtechnologies are designed to provide needed communications to support transportation
management and operations, the advancements in communications technology result in TMCsand ITS devices no longer functioning as closed systems, thus increasing the e-enabled threats
and risks to these transportation facilities and infrastructure. This report serves as technicalguidelines for TMCs on improving IT security for their facilities, networks, workstations,servers, data storage, peripherals, and operations. The report will help agencies in mitigating therisks from cyber-attacks on the TMCs and associated servers, peripherals and communications
network infrastructure. The report offers recommended strategies and actions to address both
short term and long term issues.
This publication’s status is: final.

NoticeThis document is disseminated under the sponsorship of the U.S.
Department of Transportation in the interest of information exchange.
The U.S. Government assumes no liability for the use of the information
contained in this document.
The U.S. Government does not endorse products or manufacturers.
Trademarks or manufacturers’ names appear in this report only because
they are considered essential to the objective of the document.
Quality Assurance Statement
The Federal Highway Administration (FHWA) provides high-quality
information to serve Government, industry, and the public in a mannerthat promotes public understanding. Standards and policies are used toensure and maximize the quality, objectivity, utility, and integrity of its
information. The FHWA periodically reviews quality issues and adjusts
its programs and processes to ensure continuous quality improvement.

Technical Report Documentation Page
1. Report No.

2. Government Accession No.

3. Recipient’s Catalog No.

FHWA-HOP-19-059
4. Title and Subtitle

5. Report Date

Transportation Management Center Information Technology Security

September 2019
6. Performing Organization Code

7. Author(s)8. Performing Organization Report No.

Alan Toppen, Jon Chambers, Armand Ciccarelli, Laura Gomez-Martin,
Chris Daywalt, Kodi Berger
9. Performing Organization Name and Address

10. Work Unit No. (TRAIS)

Kimley-Horn, Reston, Virginia
Skyline Technology Solutions, Glen Burnie, Maryland
Under Contract to:

11. Contract or Grant No.
DTFH61-16-D-00051

Cambridge Systematics, Inc.
3 Bethesda Metro Center, Suite 1200
Bethesda, MD 20814
12. Sponsoring Agency Name and Address

13. Type of Report and Period Covered

U.S. Department of Transportation
Federal Highway Administration
Office of Operations (HOP)
1200 New Jersey Avenue SE
Washington, DC 20590

Final Report
14. Sponsoring Agency Code

HOP

15. Supplementary Notes

Task Order Contracting Officer’s Representative (TOCOR) – Jimmy Chu
16. Abstract

Cybersecurity is a growing concern worldwide. Over the past several years, much focus has been placed on
critical infrastructure providers and their ability to implement cybersecurity in order to continue providing criticalservices. Traffic Management Centers (TMCs) and Intelligent Transportation Systems (ITS) infrastructure
leverage modern communications systems to support transportation management and operations. As a result,
TMCs and ITS devices no longer function as closed systems, thus increasing the risk of cyber threats to thesetransportation facilities and infrastructure.
This report has been developed based on best practices within the industry to reflect the reality within TMCs,
while pushing for improvements where necessary with a primary focus on the NIST (National Institute ofStandards and Technology) Cybersecurity Framework and CIS (Center for Internet Security) Top 20 Controls.
Through this report, TMCs will gain insight into basic practices that serve as a starting point or baseline fororganizations with limited resources and cybersecurity expertise, as well as guidelines for TMCs looking toincrease their system maturity.
17. Key Words

18. Distribution Statement

Cybersecurity, internet, traffic management
centers, standards, technology

No restrictions

19. Security Classif. (of this report)

20. Security Classif. (of this page)

21. No. of Pages

22. Price

Unclassified

Unclassified

126

N/A

Form DOT F 1700.7 (8-72)

Reproduction of completed page authorizedSI* (MODERN METRIC) CONVERSION FACTORSAPPROXIMATE CONVERSIONS TO SI UNITSSYMBOL

WHEN YOU KNOW

in
ft
yd
mi

inches
feet
yards
miles

2

MULTIPLY BY
LENGTHSYMBOL

25.4
0.305
0.914
1.61

millimeters
metersmeterskilometers

mm
m
m
km

645.2
0.093
0.836
0.405
2.59

square millimeterssquare meterssquare metershectaressquare kilometers

mm
m2
m2
ha
2
km

AREA

in
2
ft
2
yd
ac
2
mi

square inches
square feetsquare yardacres
square miles

fl oz
gal
3
ft
3
yd

fluid ounces
gallons
cubic feetcubic yards

oz
lb
T

ouncespoundsshort tons (2000 lb)oFFahrenheitfc
flfoot-candles
foot-Lamberts

lbf
2
lbf/inpoundforce
poundforce per square inch

SYMBOL

WHEN YOU KNOW

mm
m
m
km

millimeters
metersmeterskilometers
2

TO FINDVOLUME

29.57
milliliters
3.785
liters0.028
cubic meters
0.765
cubic meters
3
NOTE: volumes greater than 1000 L shall be shown in m

MASS

28.35
0.454
0.907

g
kg
Mg (or "t")Celsius

o

10.76
3.426

lux
2
candela/m

lx
2
cd/m

4.45
6.89

newtons
kilopascals

NkPa

5 (F-32)/9or (F-32)/1.8

ILLUMINATIONFORCE and PRESSURE or STRESSAPPROXIMATE CONVERSIONS FROM SI UNITS
MULTIPLY BY
LENGTHmL
L
m3
m3

milliliters
literscubic meters
cubic metersgkg
Mg (or "t")grams
kilograms
megagrams (or "metric ton")oC

Celsius

lx
2
cd/m

lux
2
candela/mN
kPa

newtons
kilopascals

C

TO FINDSYMBOL

0.039
3.28
1.09
0.621

inches
feet
yards
miles

in
ft
yd
mi

0.001610.764
1.195
2.47
0.386

square inches
square feetsquare yards
acres
square miles

in
2
ft
2
yd
ac
2
mi

0.034
0.264
35.314
1.307

fluid ounces
gallons
cubic feetcubic yards

fl oz
gal
3
ft
3
yd

0.035
2.202
1.103

ouncespoundsshort tons (2000 lb)

oz
lb
T

1.8C+32

Fahrenheito0.09290.2919foot-candles
foot-Lamberts

fc
fl

0.225
0.145

poundforce
poundforce per square inch

lbf
2
lbf/inAREAsquare millimeterssquare meterssquare metershectaressquare kilometers

mL
L
m3
m3

grams
kilograms
megagrams (or "metric ton")

TEMPERATURE (exact degrees)

mm
m2
m2
ha
2
km

2

VOLUMEMASS

TEMPERATURE (exact degrees)
ILLUMINATIONFORCE and PRESSURE or STRESS

2

F*SI is the symbol for the International System of Units. Appropriate rounding should be made to comply with Section 4 of ASTM E380. (Revised March 2003)iii

Transportation Management Center Information Technology Security

TABLE OF CONTENTSEXECUTIVE SUMMARY ...........................................................................................................1
CHAPTER 1. INTRODUCTION .................................................................................................5
CHAPTER 2. CRITICAL TRAFFIC MANAGEMENT CENTERS ELEMENTS ................7
SIZE AND STAFFING ..........................................................................................................8RESPONSIBILITIES .............................................................................................................8
DEVICE AND NETWORK MANAGEMENT .....................................................................9CHAPTER 3. BEST PRACTICES FOR TRAFFIC MANAGEMENT CENTERS
INFORMATION TECHNOLOGY SECURITY..............................................................11
BEST PRACTICES DISCUSSION .....................................................................................11
The National Institute of Standards and Technology Risk Management
Framework ...................................................................................................................13
Best Practices Scan of Traffic Management Center Operators ...................................14
GAPS/AREAS OF IMPROVEMENT .................................................................................15
THE ROLE OF CONSTRUCTION/PROCUREMENT METHODS IN TRAFFICMANAGEMENT CENTER INFORMATION TECHNOLOGY SECURITY...................16
CHAPTER 4. TECHNICAL GUIDELINES AND RECOMMENDED PRACTICES .........19
CHAPTER 5. GUIDELINES FOR CONTROLLING HARDWARE WITH ACCESSTO THE NETWORK..........................................................................................................25
CHAPTER 6. GUIDELINES FOR CONTROLLING SOFTWARE USED WITHINTHE NETWORK ................................................................................................................27
CLOUD HOSTING..............................................................................................................28
CHAPTER 7. GUIDELINES FOR CONTROLLING NETWORK CONNECTIVITY ......33
CHAPTER 8. GUIDELINES FOR CONTROLLING STAFFING/TRAININGRELATED ATTRIBUTES (INSIDER VULNERABILITIES) ......................................37
ORGANIZATION-RELATED ATTRIBUTES ..................................................................37
TRAINING/EDUCATION ..................................................................................................38
Employee Exit Process ................................................................................................40v

Transportation Management Center Information Technology Security

CHAPTER 9. GUIDELINES FOR RESILIENCY/DATA PROTECTION ANDRECOVERY ........................................................................................................................41
INTERAGENCY INFORMATION SHARING AND COLLABORATION .....................41
Risk Management Plan ................................................................................................42
Incident Planning and Response ..................................................................................44
Resiliency Plan.............................................................................................................45
Malware Defenses........................................................................................................47
Data Loss Prevention ...................................................................................................47
Archival/Backup, Restoration, Recovery ....................................................................48
Personal Privacy Information Legislation ...................................................................49
CHAPTER 10. SHORT- AND LONG-TERM STRATEGIES FOR ADDRESSINGISSUES/GAPS......................................................................................................................51
CHAPTER 11. CONCLUSIONS AND NEXT STEPS.............................................................55
APPENDIX A. SAMPLE CYBERSECURITY RESILIENCE REVIEWSELF-ASSESSMENT .........................................................................................................57
MATURITY INDICATOR LEVELS DEFINED ................................................................57
MIL0 Incomplete .........................................................................................................57
MIL1 Performed ..........................................................................................................57
MIL2 Planned ..............................................................................................................57
MIL3 Managed ............................................................................................................57
MIL4 Measured ...........................................................................................................58
MIL5 Defined ..............................................................................................................58
ASSESSMENT ....................................................................................................................59
RESULTS.............................................................................................................................61
APPENDIX B. CENTER FOR INTERNET SECURITY CONTROLS TO THE
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY MAPPING .......63
INVENTORY AND CONTROL OF HARDWARE ASSETS ...........................................63
INVENTORY AND CONTROL OF SOFTWARE ASSETS .............................................65
CONTINUOUS VULNERABILITY MANAGEMENT .....................................................68
CONTROLLED USE OF ADMINISTRATIVE PRIVILEGES .........................................70
SECURE CONFIGURATION FOR HARDWARE AND SOFTWARE ON
MOBILE DEVICES, LAPTOPS, WORKSTATIONS, AND SERVERS...........................72
MAINTENANCE, MONITORING, AND ANALYSIS OF AUDIT LOGS ......................74vi

Transportation Management Center Information Technology Security

EMAIL AND WEB BROWSER PROTECTIONS .............................................................76
MALWARE DEFENSES ....................................................................................................79
LIMITATION AND CONTROL OF NETWORK PORTS, PROTOCOLS, ANDSERVICES ...........................................................................................................................81
DATA RECOVERY CAPABILITIES ................................................................................82
SECURE CONFIGURATION FOR NETWORK DEVICES, SUCH AS
FIREWALLS, ROUTERS, AND SWITCHES....................................................................83
BOUNDARY DEFENSE .....................................................................................................85
DATA PROTECTION .........................................................................................................88
CONTROLLED ACCESS BASED ON THE NEED TO KNOW ......................................90
WIRELESS ACCESS CONTROL ......................................................................................92
ACCOUNT MONITORING AND CONTROL ..................................................................94
IMPLEMENT A SECURITY AWARENESS AND TRAINING PROGRAM ..................97
APPLICATION SOFTWARE SECURITY.........................................................................99
INCIDENT RESPONSE AND MANAGEMENT ............................................................102
PENETRATION TESTS AND RED TEAM EXERCISES ..............................................105
APPENDIX C: REFERENCES ................................................................................................107vii

Transportation Management Center Information Technology Security

LIST OF FIGURES
Figure 1. Chart. Center for Internet Security top 20 critical security controls version 7.1..............2
Figure 2. Chart. Relationship between Center for Internet Security Controls and Traffic
Management Center roles. ...............................................................................................................3
Figure 3. Flowchart. National Intelligent Transportation System architecture physical view. .....10
Figure 4. Chart. Center for Internet Security top 20 critical security controls version 7.1............12
Figure 5. Flowchart. The National Institute of Standards and Technology risk management
framework. .....................................................................................................................................13
Figure 6. Chart. Relationship between Center for Internet Security Controls and Traffic
Management Center roles. .............................................................................................................20
Figure 7. Screenshot. Center for Internet Security controls mapping to the National
Institute of Standards and Technology security functions and the National Institute ofStandards and Technology cybersecurity framework. ...................................................................21
Figure 8. Infographic. Center for Internet Security implementation groups. ................................22
Figure 9. Flowchart. Cloud consumers’ view of the Risk Management Framework applied
to a cloud ecosystem. .....................................................................................................................29
Figure 10. Flowchart. The National Institute of Standards and Technology 800-37 risk
management approach. ..................................................................................................................42
Figure 11. Flowchart. Cyber resiliency engineering framework. ..................................................46ix

Transportation Management Center Information Technology Security

LIST OF TABLES
Table 1. List of industrial control systems-related training. ..........................................................39
Table 2. Center for Internet Security control 1. .............................................................................63
Table 3. Center for Internet Security control 2. .............................................................................65
Table 4. Center for Internet Security control 3. .............................................................................68
Table 5. Center for Internet Security control 4. .............................................................................70
Table 6. Center for Internet Security control 5. .............................................................................72
Table 7. Center for Internet Security control 6. .............................................................................74
Table 8. Center for Internet Security control 7. .............................................................................76
Table 9. Center for Internet Security control 8. .............................................................................79
Table 10. Center for Internet Security control 9. ...........................................................................81
Table 11. Center for Internet Security control 10. .........................................................................82
Table 12. Center for Internet Security control 11. .........................................................................83
Table 13. Center for Internet Security control 12. .........................................................................85
Table 14. Center for Internet Security control 13. .........................................................................88
Table 15. Center for Internet Security control 14. .........................................................................90
Table 16. Center for Internet Security control 15. .........................................................................92
Table 17. Center for Internet Security control 16. .........................................................................94
Table 18. Center for Internet Security control 17. .........................................................................97
Table 19. Center for Internet Security control 18. .........................................................................99
Table 20. Center for Internet Security control 19. .......................................................................102
Table 21. Center for Internet Security control 20. .......................................................................105xi

Transportation Management Center Information Technology Security

LIST OF ACRONYMS
ACL
ATO
ASLR
AVL
BIA
BYOD
CERT
CIS
CISA
CRR
CSC
CSF
DEP
DHCP
DHS
DLP
DMARC
DMS
DMZ
DNS
DOT
EU
FIPS
FOIA
FTP
GDPR
HAR
HTTP
IaaS
IANA
ICS
IFB
IoT
IPS
IRM
ISAC
ITS
LAN
LCS
LLC
LMS
MAC
MFA

Access Control List
Authority to Operate
Address Space Layout Randomization
Automatic Vehicle Location
Business Impact Analysis
bring-your-own-devices
Computer Emergency Response Teams
Center for Internet Security
Cybersecurity and Infrastructure Security Agency
Cybersecurity Resilience Reviews
Critical Security Controls
Cybersecurity Framework
Data Execution Prevention
Dynamic Host Configuration Protocol
Department of Homeland Security
data loss prevention
Domain-based Message Authentication, Reporting and Conformance
Dynamic Message Signs
Demilitarized Zone
Domain Name System
Department of Transportation
the European Union
Federal Information Processing Standards
Freedom of Information Act
File Transfer Protocol
General Data Protection Regulation
Highway Advisory Radio
Hypertext Transfer Protocol
Infrastructure as a Service
Internet Assigned Numbers Authority
Industrial Control Systems
Invitation for Bid
Internet of Things
Intrusion Prevention Systems
Information Rights Management
Information Sharing and Analysis CentersIntelligent Transportation System
Local Area Network
Lane Control Signs
Limited Liability Company
Learning Management System
Media Access Control
Multi-Factor Authenticationxiii

Transportation Management Center Information Technology Security

MIL
NAC
NCC-SWG
NCI
NERC
NICCS
NIPP
NIST
OMB
OPSEC
OS
OT
PaaS
PCI-DSS
RDP
RMF
RPO
RSS
RTO
SaaS
SCADA
SCAP
SIEM
SNMP
SP
SPF
SSL
TCP
TLS
TMC
UDP
URL
USB
V2I
VLAN
VM
VPN
WAF
WIDS
WLAN

Maturity Indicator Level
Network Access Control
NIST’s Cloud Computing Security Working Group
National Council of ISACs
North American Electric Reliability Corporation
National Initiative for Cybersecurity Careers and Studies
National Infrastructure Protection Plan
National Institute of Standards and Technology
Office of Management and Budget
Operational Security
Operating System
Operations Technology
Platform as a Service
Payment Card Industry Data Security Standards
Remote Desktop Protocol
Risk Management Framework
Recovery Point Objective
Really Simple Syndication
Recovery Time Objective
Software as a Service
Supervisory Control and Data Acquisition
Security Content Automation Protocol
Security Information and Event Management
Simple Network Management Protocol
Special Publication
Sender Policy Framework
Secure Sockets Layer
Transmission Control Protocol
Transport Layer Security
Traffic Management Center
User Datagram Protocol
Uniform Resource Locator
Universal Serial Bus
Vehicle-to-Infrastructure
Virtual Local Access Network
Virtual Machines
Virtual Private Network
Web Application Firewalls
Wireless Intrusion Detection System
Wireless Local Area Network

xiv

Transportation Management Center Information Technology Security

EXECUTIVE SUMMARY
Cybersecurity is a growing concern worldwide. Over the past several years, much focus has beenplaced on critical infrastructure providers and their ability to implement cybersecurity in order tocontinue providing critical services. The Department of Homeland Security considers theTransportation Systems Sector to be 1 of 16 critical infrastructure sectors whose “assets,systems, and networks, whether physical or virtual, are considered so vital to the United Statesthat their incapacitation or destruction would have a debilitating effect on security, national
economic security, national public health or safety, or any combination thereof.” Thecybersecurity threat landscape is constantly evolving, and new vulnerabilities are discovered
every day. Connectivity between different networks, organizations and devices, through theInternet of Things (IoT), further increase exposure to these vulnerabilities.
The material within this report has been developed based on best practices (chapter 3) within theindustry that correspond to what Traffic Management Centers (TMC) face on a routine basis,pushing for improvements where necessary, and with a primary focus on the National Institute ofStandards and Technology (NIST) Cybersecurity Framework and Center for Internet Security(CIS) Top 20 Controls version 7.1. Through this report, TMCs will gain insight into basic
practices that all TMCs should adopt as a starting point or baseline for organizations with limited
resources and cybersecurity expertise, as well as guidelines for TMCs looking to increase theirsystem maturity. This report also includes guidelines relevant to personnel controls and elements
associated with insider vulnerabilities, and covers controls associated with data protection andresiliency. In chapter 3, an assessment of best practices from TMC operators around the country
have been summarized and compared with relevant CIS Top 20 Controls. Additionally, areas ofneeded improvement have been noted based on controls and policies that are not as mature
within the TMC industry.
While synthesizing the available resources on Information Technology (IT) cybersecurity,sources from the Department of Homeland Security (DHS), CIS, and NIST were considered fortheir relevance to TMCs. The NIST Cybersecurity and Risk Management Frameworks weremore abstract and strategic in nature, while the CIS Top 20 Controls provide more technicaldetailed guidelines of immediate benefit to TMC operators. Therefore, using the CIS Top 20
Controls in baselining security measures provides an immediate impact on guiding control of
hardware, software and networks in the TMC, while the NIST frameworks can play a beneficial
role to supplement with strategic visioning of Risk Management Plans and Resiliency Plans. The
following figure depicts the control framework associated with the CIS Top 20 Controls, whichhave been identified to be the most relevant for TMCs among the reviewed frameworks.

1

Transportation Management Center Information Technology Security

Figure 1. Chart. Center for Internet Security top 20 critical security controls version 7.1.
(Source: CIS Controls Version 7.1.)
The CIS Top 20 Controls are the primary focus of the balance of these guidelines and are
discussed in context of applicability to TMC roles. A TMC environment, along with supporting
staff, is typically comprised of individuals with distinct roles focused on managing three areas:2

Transportation Management Center Information Technology Security•••

Information technology/systems (subdivided to address networking, devices, hardware,and software).
Personnel (i.e., human resources).
Administrative and contractual data management practices (e.g., Freedom of Information
Act (FOIA) requests, data archival and organizational resiliency, etc.).

The CIS Top 20 Critical Security Controls correspond to these three functional areas, and each
CIS sub-control is relevant to one of the three TMC roles, illustrated in the figure below. They
have been color-coded to match the Basic, Foundational, and Organizational control labeling in
the CIS document figures.
Guidelines for Controlling the
Hardware, Software, and Network

Guidelines for Controlling Staffing/Training-Related Attributes

CHAPTER 5

CHAPTER 8

Controlling hardware with access to the network, which isrelated to:• CIS Control 1: Inventory and Control of Hardware Assets

Controls/Policies for staff with access to the networkand systems/software, which is related to:• CIS Control 4: Controlled Use of Administrative
Privileges• CIS Control 6: Maintenance, Monitoring and Analysis
of Audit Logs
• CIS Control 14: Controlled Access Based on the Needto Know• CIS Control 16: Account Monitoring and Control• CIS Control 17: Implement a Security Awareness andTraining Program

CHAPTER 6
Controlling software used on the devices on the network,
which is related to:• CIS Control 2: Inventory and Control of Software
Assets• CIS Control 5: Secure Configuration for Hardware andSoftware on Mobile Devices, Laptops, Workstations andServers• CIS Control 7: Email and Web Browser Protections• CIS Control 18: Application Software Security

Guidelines for Resiliency/Data Protection
and Recovery
CHAPTER 9
Resiliency/Data Protection and Recovery , which isrelated to:• CIS Control 3: Continuous Vulnerability Management• CIS Control 4: Controlled Use of Administrative
Privileges• CIS Control 8: Malware Defenses• CIS Control 10: Data Recovery Capabilities• CIS Control 13: Data Protection• CIS Control 14: Controlled Access Based on the Needto Know• CIS Control 19: Incident Response and Management• CIS Control 20: Penetration Tests and Red Team
Exercises

CHAPTER 7
Controlling connectivity to the network, which is related to:• CIS Control 9: Limitation and Control of Network Ports,
Protocols, and Services• CIS Control 11: Secure Configuration for Network
Devices, such as Firewalls, Routers, and Switches• CIS Control 12: Boundary Defense• CIS Control 15: Wireless Access Controls

Figure 2. Chart. Relationship between Center for Internet Security Controls and Traffic
Management Center roles.
(Source: Federal Highway Administration.)3

Transportation Management Center Information Technology Security

The focus areas of each chapter of this document is depicted in the figure above. Chapter 5emphasizes elements of controlling hardware with access to the network, while chapters 6 and 7
focus on controlling software and network connectivity, respectively. Chapter 8 focuses
primarily on personnel and account privileges/controls, and chapter 9 covers the CIS Controlsthat address improving resiliency and data protection aspects of TMC IT and Operations.
Following the discussion of the Guidelines, chapter 10 presents recommended short- and longterm strategies for implementation such as conducting a self-assessment Cybersecurity
Resilience Reviews (CRR) using DHS’ CRR tools, conducting a risk analysis, andimplementation Basic and Foundational controls to address the immediate risks identified.
Chapter 11 identifies some key conclusions and next steps recognizing that TMCs around the
Nation will be at differing levels of maturity. Some agencies already will have a jumpstart on
cybersecurity issues, while others may be closer to starting from scratch when reading theseguidelines. If an agency is starting from scratch, a Risk Analysis is recommended as the first step
towards establishing a cybersecurity program for the TMC. In conjunction with addressing
immediate risks from the Risk Analysis, TMC agencies will benefit from developing a Risk
Management Plan, as noted in chapter 9, to determine courses of action to mitigate andsystematically manage those risks.
Part of increasing the cybersecurity maturity of an agency involves incrementally building amore robust process/program for resiliency by developing a Resiliency Plan to harden systems
and facilities to improve the ability to recover from an attack or breach.
Finally, TMC operations staff are encouraged to collaborate on the risk analysis with IT staff.
The cooperative panel of Operations Technology (OT) and IT staff should lead the charge on
routinely testing and improving the program to address existing and newly identified risks. The
panel is encouraged to participate in/with peer groups (i.e., Information Sharing and Analysis
Centers (ISAC) as noted in chapter 9) to share and learn from identified threats/risks within the
TMC community to allow all TMC operators to learn and benefit from the greater body ofknowledge.

4Transportation Management Center Information Technology Security

CHAPTER 1. INTRODUCTION
Cybersecurity is a growing concern worldwide. Over the past several years, much focus has beenplaced on critical infrastructure providers and their ability to implement cybersecurity in order tocontinue providing critical services. The Department of Homeland Security considers theTransportation Systems Sector to be 1 of 16 critical infrastructure sectors whose “assets,systems, and networks, whether physical or virtual, are considered so vital to the United Statesthat their incapacitation or destruction would have a debilitating effect on security, national
economic security, national public health or safety, or any combination thereof. 1” Thecybersecurity threat landscape is constantly evolving and new vulnerabilities are discovered
every day. Connectivity between different networks, organizations and devices, through theInternet of Things (IoT), further increase exposure to these vulnerabilities.
In particular, Traffic Management Centers (TMC) and Intelligent Transportation Systems (ITS)
infrastructure leverage modern communications systems to support transportation management
and operations. As a result, TMCs and ITS devices no longer function as closed systems, thusincreasing the risk of exposure to cyber threats to these transportation facilities andinfrastructure. Today’s TMCs are often not only automated but also highly integrated.
Information Technology (IT) security for TMCs is further complicated by a variety of
stakeholders with diverse skillsets and goals, including manufacturers and vendors of system
hardware, software and control units; contractors and integrators; and IT specialists with anincreasing variety of specialties (e.g., fiber optics, wireless communications, database experts,
software integrators, etc.). Thus, it is necessary to research potential IT security threats andsolutions for TMCs, and to develop technical guidelines with recommended strategies andactions that agencies should follow to protect those systems and properly respond to the threats.
TMCs can benefit from the practices, experience and lessons learned from IT and otherindustries that have a wealth of knowledge and experience in mitigating and responding to IT
security attacks.
The material within this report has been developed based on best practices within the industry
that correspond to what TMCs face on a routine basis, pushing for improvements where
necessary, and with a primary focus on the National Institute of Standards and Technology(NIST) Cybersecurity Framework and the Center for Internet Security (CIS) Top 20 Controls
version 7.1. Through this report, TMCs will gain insight into basic practices that all TMCs
should adopt as a starting point or baseline for organizations with limited resources andcybersecurity expertise, as well as guidelines for TMCs looking to increase their systemmaturity.

1

Department of Homeland Security (DHS), “Critical Infrastructure Sectors,” 2013. Retrieved
from: https://www.dhs.gov/cisa/critical-infrastructure-sectors
5Transportation Management Center Information Technology Security

CHAPTER 2. CRITICAL TRAFFIC MANAGEMENT CENTERS ELEMENTS
An important aspect of cybersecurity frameworks is that both devices and personnel must be
secured. Both the National Institute of Standards and Technology (NIST) Cybersecurity
Framework and the Center for Internet Security (CIS) Top 20 Controls underscore thisimportance. 2, 3 In the Traffic Management Center (TMC) context, this involves identifying fielddevices, central systems and staff composition. The complexity of the organization and thesystems being managed play a prominent role in determining TMC Information Technology (IT)Security Guidelines.
The NIST Cybersecurity Framework and the CIS Top 20 Controls ultimately are comprised ofrecommendations for controlling hardware with access to the network, controlling software usedon the devices on the network, controlling connectivity to the network, implementing controls
and policies for staff with access to the network, systems and software, and ensuring resiliency,
data protection and recovery.
This chapter will set a baseline for typical TMC composition as it relates to TMC IT security.
Beyond Knowing/Identifying the TMC Critical Elements, other aspects of the Cybersecurity
Framework functions will be discussed in subsequent chapters.
TMCs vary in size, responsibility, and complexity. As a result, there is no one-size-fits-all
approach to cybersecurity. To capture the differences among TMCs and to obtain a baseline forprevailing practice, a Cybersecurity Maturity Questionnaire was distributed to TMCs of diverse
types and sizes across multiple States to identify similarities and differences among various
agency IT models and settings. Seventeen (17) complete responses were received from thefollowing agencies:
1. Missouri Department of Transportation (DOT).
2. Minnesota DOT.
3. City of Sevierville, Tennessee.
4. Delaware DOT.
5. New Jersey Turnpike.
6. New York State DOT—Region 10.
7. New York State DOT—Region 4.
8. City of Austin, Texas.
9. City of Dallas, Texas.
10. City of Houston, Texas.
11. North Carolina DOT.
12. Georgia DOT.
2

NIST, “Risk Management Framework for Information Systems and Organizations,” October
2018. Retrieved from: https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/archive/201709-28.
3
Center for Internet Security (CIS), “CIS Controls Version 7.1,” 2019. Retrieved from:https://www.cisecurity.org/controls/.
7

Transportation Management Center Information Technology Security

13. Tennessee DOT.
14. Michigan DOT.
15. Illinois Tollway.
16. Regional Transportation Commission of Southern Nevada.
17. Arlington County, Virginia.
Due to the sample size, the discussion and analysis of responses is not intended to be astatistically significant representation of cybersecurity practices. Rather, the results are intended
to capture the diversity of TMC sizes and responsibilities around the United States, to reveal
areas of commonality and difference, to suggest areas in which the industry is doing well, and tosuggest opportunities for improvement. A summary of the ways in which TMCs arecharacterized and categorized is included in this chapter. Best practice recommendations for
TMC IT cybersecurity as they relate to these elements are included in subsequent chapters.
SIZE AND STAFFING
For classification purposes, the questionnaire asked respondents to self-assign their agency into
one of three size categories: small, medium, or large. Large TMCs were categorized as TMCswith more than 10 operators during peak hours who manage over 500 devices. Medium sized
TMCs had between 5 and 10 peak-hour operators who managed between 100 and 500 devices,and small TMCs had less than 5 peak-hour operators who managed less than 100 devices. Of the
respondent agencies, one (1) self-identified as small, seven (7) as medium, and nine (9) as large.
In addition to staff size, it is important to be aware of staff composition and the security impacts
associated with various staff types. Of the agencies surveyed, approximately half did not haveany IT staff dedicated to the TMC, some had shared IT between different agency departments,
some were dedicated but part of a separate centralized department serving the entire agency, andsome had dedicated staff within the department. Furthermore, approximately half of the agencies
surveyed reported that their IT was centrally managed, with the remaining half being managed
by contractors or a combination of central staff and contract staff. No direct correlations wereapparent between the staff mix versus the size or complexity of the TMC environment.
RESPONSIBILITIESA TMC may be responsible for managing freeway operations, arterial highway operations, heavy
rail operations, transit operations, or a combination of these. A TMC’s focus may be urban orrural, regional or statewide. It may be single or multi-jurisdictional. TMC staff also may partnerwith other agencies to cover these variety of transportation networks, including police andtransit.
TMCs employ any combination of the responsibilities below:•••

Tolling (Revenue) Management.
511 Data or Video Management.
Camera Monitoring.

8Transportation Management Center Information Technology Security

•
•
•
•
•
•
•
•
•
•
•
•
•

Dynamic Message Signs (DMS), Lane Control Signs (LCS), and Variable Speed Limit
Signs (VSL) Content Management—permanent and portable.
Ramp Metering.
Traffic Signals Control.
Microwave/Bluetooth/Wifi Readers Data Management.
Connected Vehicle-to-Infrastructure (V2I) Equipment/Data Management.
Environmental and/or Flood Sensor Management.
Weigh-in-motion Management and Enforcement.
Automatic Vehicle Location (AVL) System Management for Fleet Vehicles.
Rail Notification System Management.
Overheight Vehicle, Wrong Way, Truck Rollover, and Vehicle Speed Detection and
Notification System Management.
School Zone and Pedestrian Beacons and Information System Management.
Highway Advisory Radio (HAR) Information System Management.
Communications (cellular, hard-wire, wireless) Management.

DEVICE AND NETWORK MANAGEMENT
TMCs utilize a range of devices and equipment to collect data, disseminate information, andcontrol operations. These devices require initial programming, ongoing maintenance andsoftware updates, and in most cases, some means of data exchange with each other and/or the
TMC. To that end, a variety of communications methods are common in the industry. A
graphical depiction of these relationships developed by the United States Department ofTransportation (USDOT) is shown in the figure on the following page.

9

Transportation Management Center Information Technology Security

Figure 3. Flowchart. National Intelligent Transportation System architecture physical view.
(Source: National Intelligent Transportation Systems (ITS) Architecture.)
In the figure above, “wide area wireless” and “short range wireless” are two of the many
communications types that may be utilized by a TMC for Center-to-Center, Center-to-Field, andField-to-Field communications. Communications types commonly utilized by TMCs across theUnited States include twisted pair copper cable, fiber optic cable, licensed and unlicensed point
to point or point to multi-point wireless, leased wired (i.e., broadband), and leased wireless (i.e.,
cellular) communications. Each of these types of communications provides its own security
concerns, many of which will be discussed at a high level in future chapters.
It also should be noted that some of these devices have limitations in the way they operate thatmake protection at the device difficult. For example, a wireless point to point radio transmitter is
not housed in a locked enclosure and is exposed to potential tampering. In other cases, devices
may be housed in a locked enclosure, but a series of standard physical keys may be shared acrossmultiple agencies to access those enclosures. In most cases, devices or device groups access thecommunications network back to the TMC via network switches. It is important that these
network switches/access points have security measures and encryption in place to control accessto the system.
To protect the overall system further, some TMCs have deployed firewalls and other controls toprotect network boundaries and create network separation. This is especially important between
the field environment and the TMC environment. Some TMCs have multiple servers and/or offsite data storage or backup to provide an additional layer of separation and redundancy.
10Transportation Management Center Information Technology Security

CHAPTER 3. BEST PRACTICES FOR TRAFFIC MANAGEMENT CENTERS
INFORMATION TECHNOLOGY SECURITY
BEST PRACTICES DISCUSSION
While synthesizing the available resources on Information Technology (IT) cybersecurity,sources from the Department of Homeland Security (DHS), the Center for Internet Security(CIS), and the National Institute of Standards and Technology (NIST) were considered for theirrelevance to Traffic Management Centers (TMC). Several agencies acknowledged andreferenced the use of the NIST Cybersecurity Framework, while others used other agency
directives to guide their control strategies. As a result of evaluating these different standards,
some common themes were identified, including:•Risk-management approaches should be applied to control center cybersecurity.

•

Network segmentation should be maintained between “business” infrastructure (i.e.,
payroll/accounting systems, human resources, email, and other systems used to manage
the business environment of the agency) and industrial control infrastructure. While there
are different ways to achieve segmentation using logical (e.g., Virtual Local AccessNetworks (VLAN)) and physical separation (e.g., firewalled or even air-gapped), it
should be noted that logical is not as secure as physical separation.

•

Established partnerships with other TMCs, transportation departments and Federal
support organizations can serve as a critical support network.

•

The deployment of Internet-connected technologies and standard communication
protocols within industrial control environments is increasing risk exposure for TMCs.

•

The need for increased collaboration between IT and Operations Technology (OT) staff.

From the analysis, it was determined that the NIST Cybersecurity and Risk Management
Frameworks were more abstract and strategic in nature, while the CIS Top 20 Controls provide
more technical detailed guidelines of immediate benefit to TMC operators. Thus, using the CIS
Top 20 Controls in baselining security measures provides an immediate impact on guiding
control of hardware, software and networks in the TMC, while the NIST frameworks can play abeneficial role to supplement with strategic visioning of Risk Management Plans and Resiliency
Plans. The purpose of this report is not to replicate the guidelines in these frameworks, but rather
to highlight the guidelines most relevant to TMC IT cybersecurity.
Risk management begins with the awareness of what vulnerabilities the TMC is exposed to,based on the characteristics of the staffing (employees and contract staff), the types of devices
and how they are connected to the network, and the software used throughout to control andmanagement operations. Cybersecurity self-assessments for the organization also are discussed
as a prioritization strategy in chapter 5.

11Transportation Management Center Information Technology Security

Implementing CIS Top 20 building blocks for Internet security provides a layered approach toaddressing all areas of risk exposure. The CIS Controls are separated into Basic, Foundational,
and Organizational levels of IT security management. A complete list of the controls for IT
security is provided in figure 4 below. Controls that can be applied to TMC IT/OT security will
be discussed in further detail in subsequent chapters.

Figure 4. Chart. Center for Internet Security top 20 critical security controls version 7.1.
(Source: CIS Controls Version 7.1.)
12

Transportation Management Center Information Technology Security

The National Institute of Standards and Technology Risk Management Framework
As a primer to establishing the TMC IT Security guidelines in this report, it is worth a quick
review of the NIST Risk Management Framework for conducting cybersecurity risk
management. This framework provides a set of six (6) steps for managing risk, which are shownwithin the inner-circle of the figure below. The figure from NIST SP 800-37 illustrates the risk
management process in context with other Federal Information Processing Standards (FIPS) andother Special Publication (SP) references. 4

Figure 5. Flowchart. The National Institute of Standards and Technology risk management
framework.
(Source: NIST SP 800-37 Risk Management Framework.)
As this is the most well documented risk management methodology proposed by the Federal
Government, it is directly applicable to any TMCs that choose to pursue a risk managementbased cybersecurity strategy.
Some agencies, particularly those with connections to the Federal sector also will need to stayapprised of NIST 800-53 (for Federal information systems/organizations) and FedRAMP (for
4

NIST, “SP 800-37 Rev. 2 Guide for Applying the Risk Management Framework to Federal
Information Systems: a Security Life Cycle Approach,” 2018. Retrieved from:https://csrc.nist.gov/publications/detail/sp/800-37/rev-1/final.
13

Transportation Management Center Information Technology Security

cloud hosting). 5 While this document focuses on broader guidelines for TMCs, someorganizations may find the NIST documentation helpful in evaluating, selecting and specifying
information systems or controls for subsystems within the TMC environment. Two relevant
NIST documents will be useful for supplementing CIS Top 20 for chapters 8 and 9 foradministrative policies and resiliency plan development:••

NIST 800-53 Security and Privacy Controls for Federal Information Systems andOrganizations.
NIST 800-82 Guide to Industrial Control Systems (ICS) Security. 6

Additionally, while most TMCs do not process billing information for credit cards associatedwith tolling or fare collection systems, it should be noted that agencies having this responsibility
also are obligated to comply with Payment Card Industry Data Security Standards (PCI-DSS) forprocessing back-office toll payments and other credit card financial transactions. The goals of
PCI-DSS are compatible with NIST Cybersecurity Framework and CIS Top 20, and are built tomaintain a secure network, protect cardholder data, maintain a vulnerability management
program, implement strong access control measures, regularly monitor and test networks, andmaintain an information security policy.
Best Practices Scan of Traffic Management Center Operators
This section will summarize noteworthy practices identified by agencies responding to thequestionnaire and existing reference literature and correlating them to the CIS Top 20 controls.
During a scan of several TMC operators across the country of varying sizes, the following
cybersecurity practices currently are being employed by one or more organizations:
1. Using active and/or passive scanning tools to identify all devices attached to the
network on a routine basis (relevant to CIS Control 1). Manually documenting deviceson the network can quickly become outdated. Using industry available tools to expedite
the initial process, as well as allowing for continued monitoring and updates isworthwhile in a dynamic environment such as TMCs.
2. Vendor-supported software residing on a demilitarized zone (DMZ) section of the
network, so that remote support by Secure Sockets Layer (SSL) Virtual Private Network(VPN) access is only granted to the DMZ and not to the enterprise/business network(relevant to CIS Control 2). Some applications often require communications with fielddevices and other subsystems, but generally do not require direct access to the enterpriseenvironment. Restricting access by remote vendors limits risk exposure and the potential
attack surface on the most critical infrastructure/systems.

5

NIST, “SP 800-53 Rev. 4 Security and Privacy Controls for Federal Information Systems andOrganizations,” 2015. Retrieved from: https://csrc.nist.gov/publications/detail/sp/800-53/rev4/final.
6
NIST, “SP 800-82 Rev. 2 Guide to Industrial Control Systems (ICS) Security,” 2015.
Retrieved from: https://csrc.nist.gov/publications/detail/sp/800-82/rev-2/final.
14

Transportation Management Center Information Technology Security

3. Using Access Control Lists (ACL) or equivalent network access techniques to limit
outside access to specific machines or services, so that access is granted only to thedevices/networks that need them (relevant to CIS Control 14), or essentially managing
the users/devices with a “need to know.” This also is a relevant method for managing
insider vulnerabilities, particularly for limiting the range of systems available throughremote access configurations.
4. Requiring background checks for personnel that require access to control rooms,
particularly with direct administrative/privileged access to software, systems, and data
centers (relevant to CIS Control 14). When coupled with enforcing detailed logging ofchanges to configurations and data, this practice provides a solid basis for data protection
and assistance for managing insider vulnerabilities (relevant to CIS Control 13).
5. Leveraging existing security policies governing the entire agency, not just the TMC.
In the past, many TMCs operated as an island from all other enterprise network
platforms. However, today it is critical to be interconnected with the multitude of datasystems internal and external to an agency. Some larger TMCs are nearly selfautonomous from a policy-making standpoint, but a number of those surveyed indicatedsome level of existing IT policy governing the entire agency, not just the TMC. This is anorganizational arrangement that broadly relates to CIS Controls 17 through 20. TMCs
may be independently in control of their respective subsystems but should recognize theimportance of embracing/incorporating existing policy frameworks for the broader
organization while addressing the gaps that are specific/unique to the TMC environment.
6. Updating cybersecurity policies at least once a year to fix anomalies in the procedures
based on current trends (relevant to CIS Control 17 and 19). Policies should be
evaluated annually or when an incident occurs and should be reviewed against updates to
NIST guidelines and relevant policies that the agency is using. During these timeframes,
agencies also should assess their achievements with respect to all CIS Controls identified
in their respective Risk Management Plan.
GAPS/AREAS OF IMPROVEMENT
More so than trends, the review of several TMC operators during the survey process gave
indication of notable areas in need of improvement within the industry. The following areas ofconcern have been identified, along with the importance of each, though they are not necessarily
widespread issues for all organizations:
1. Network port security solutions, and the use of certificates to authenticate devices is
not widely adopted (relevant to CIS Control 1).
2. There does not appear to be widespread adoption of software/application whitelisting
among TMC operators (relevant to CIS Control 2). This is a technique used to only
allow software applications that are acknowledged/approved to be run on the network.

15

Transportation Management Center Information Technology Security

3. The majority of TMC organizations have not performed a skills gap analysis tounderstanding the skills and behaviors of their workforce (relevant to CIS
Control 17).
4. The importance of patch management is not widely acknowledged (relevant to CIS
Control 3).
5. Multi-factor authentication is still lacking across many TMC systems (relevant to CIS
Control 4 and 16). Weak password practices are a key factor in unauthorized user access,much of which can be mitigated through secondary authentication methods.
6. TMCs need to implement routine incident response exercises (relevant to CIS
Control 19). Without going through an example breach, it is difficult to appreciate what
will happen when one is encountered, and whether the existing policies are there toaddress it.
7. There is an identified shortage of dedicated versus consolidated IT staff for TMCs
(relevant to CIS Control 17). Partnering with the broader organization to resolve hiring
and/or training needs is a critical piece to overcoming this gap. Partnering between OT
and IT should be encouraged to increase awareness of the challenges that both ends facewith respect to balancing security with ease of operational functionality.
THE ROLE OF CONSTRUCTION/PROCUREMENT METHODS IN TRAFFICMANAGEMENT CENTER INFORMATION TECHNOLOGY SECURITY
Transportation agencies are subject to public procurement guidelines and are accustomed todesigning projects and putting them out to bid. However, the TMC environment and the IT
portion of that environment have increasingly become classified as sensitive or criticalinfrastructure information to be guarded from the public domain. Agencies should have policies
and guidelines in place for determining what aspects of their construction plans qualify as
sensitive information and manage the procurement accordingly. For instance, some agencies
establish on-call contracts with vetted contractors that also have executed non-disclosureagreements, and only issue work orders for upgrades to the network or the facility to prevent
sensitive information entering the public domain. Others will issue a two-step Invitation for Bid(IFB) to pre-qualify potential contractors before releasing copies of the plans to them. These areexamples of the use of procurement methods to mitigate the risks associated with exposing a
TMC’s critical infrastructure information in the public domain.
Relegating the configuration settings for network devices to installation contractors also shouldbe verified to ensure adherence to TMC network configuration policies identified with CIS
Controls. When possible, TMC IT staff should provide configuration files and prevent alterationsof those configurations instead of leaving it to the contractors to maintain control of the
hardware, software, and network assets in the TMC.
Supply chain attacks against hardware and software vendors are becoming more common.
Procurement through reputable sources are a minimum best practice but establishing pre-16

Transportation Management Center Information Technology Security

negotiated periods for responding to security issues with upgrades/patches is an importantconsideration for procurement of software and hardware contracts, particularly for specialized
equipment related to ICS vendors. Additionally, this and other examples of cybersecurity
procurement language for control systems has been provided for various subsystems by U.S.
Computer Emergency Response Teams (US CERT). 7 Many medium-to-large TMCs use adedicated/isolated test environment to validate upgrades and patches before loading into the
production environment to minimize risks from supply chain.

7

Department of Homeland Security (DHS), “Cyber Security Procurement Language forControl Systems,” 2009. Retrieved from: https://ics-cert.us-cert.gov/sites/default/files/
documents/Procurement_Language_Rev4_100809_S508C.pdf.
17

Transportation Management Center Information Technology Security

CHAPTER 4. TECHNICAL GUIDELINES AND RECOMMENDED PRACTICESThis section provides the introduction to the technical guidelines and recommended practices inchapters 5 through 9, which build a culture of Operations Technology (OT)/Information
Technology (IT) security for Traffic Management Centers (TMC); keeping it at theprocess/organizational structure level and related to the National Institute of Standards andTechnology (NIST) Cybersecurity Framework (CSF) and Center for Internet Security (CIS) Top
20 Controls.
The NIST Cybersecurity Framework provides guidelines for how organizations can assess andimprove the ability to secure their environments, manage risk, and respond to threats. The fiveareas for NIST Cybersecurity Framework core functions are as follows:•

Know (Identify): Activities to identify what systems need to be protected, assess priority
considering organizational mission, and manage processes to achieve cost-effective risk
management goals.

•

Protect: Categories of management, technical, and operational activities that enable theorganization to decide on the appropriate outcome-based actions to ensure adequate
protection against threats to business systems that support critical infrastructurecomponents.

•

Detect: Activities that identify (through ongoing monitoring or other means ofobservation) the presence of undesirable cyber risk events, and the processes to assess thepotential impact of those events.

•

Respond: Specific risk management decisions and activities enacted based uponpreviously implemented planning (from the Protect function) relative to estimatedimpact.

•Recover: Categories of management, technical, and operational activities that restore
services that have previously been impaired through an undesirable cybersecurity risk
event.

The CIS Top 20 were developed to provide organizations with a smaller, prioritized number ofactionable controls that should be implemented first. The CIS Top 20 outline Critical Security
Controls (CSC) that organizations can use to establish a baseline for protection of theirenvironment.
A TMC environment, along with supporting staff, is typically comprised of individuals with
distinct roles focused on managing three areas:••

Information technology/systems (subdivided to address networking, devices, hardware,and software).
Personnel (i.e., human resources).
19

Transportation Management Center Information Technology Security

Administrative and contractual data management practices (e.g., Freedom of Information
Act (FOIA) requests, data archival and organizational resiliency, etc.).
The CIS Top 20 Critical Security Controls correspond to these three functional areas, and each
CIS sub-control is relevant to one of the three TMC roles.
•

The first TMC role, which is subdivided to address hardware, software, and networking within
the overall information technology management area, will be covered in chapters 5, 6, and 7,
respectively. Chapter 8 highlights guidelines relevant to personnel controls and elements
associated with insider vulnerabilities. Chapter 9 covers controls associated with data protection
and resiliency. The figure below shows the CIS controls that are relevant to each of these TMC
roles. They have been color-coded to match the Basic, Foundational, and Organizational
control labeling in the CIS document figures shown in chapter 3.
Guidelines for Controlling the
Hardware, Software, and Network

Guidelines for Controlling Staffing/Training-Related Attributes

CHAPTER 5

CHAPTER 8

Controlling hardware with access to the network, which isrelated to:• CIS Control 1: Inventory and Control of Hardware Assets

Controls/Policies for staff with access to the networkand systems/software, which is related to:• CIS Control 4: Controlled Use of Administrative
Privileges• CIS Control 6: Maintenance, Monitoring and Analysis
of Audit Logs
• CIS Control 14: Controlled Access Based on the Needto Know• CIS Control 16: Account Monitoring and Control• CIS Control 17: Implement a Security Awareness andTraining Program

CHAPTER 6
Controlling software used on the devices on the network,
which is related to:• CIS Control 2: Inventory and Control of Software
Assets• CIS Control 5: Secure Configuration for Hardware andSoftware on Mobile Devices, Laptops, Workstations andServers• CIS Control 7: Email and Web Browser Protections• CIS Control 18: Application Software Security

Guidelines for Resiliency/Data Protection
and Recovery
CHAPTER 9
Resiliency/Data Protection and Recovery , which isrelated to:• CIS Control 3: Continuous Vulnerability Management• CIS Control 4: Controlled Use of Administrative
Privileges• CIS Control 8: Malware Defenses• CIS Control 10: Data Recovery Capabilities• CIS Control 13: Data Protection• CIS Control 14: Controlled Access Based on the Needto Know• CIS Control 19: Incident Response and Management• CIS Control 20: Penetration Tests and Red Team
Exercises

CHAPTER 7
Controlling connectivity to the network, which is related to:• CIS Control 9: Limitation and Control of Network Ports,
Protocols, and Services• CIS Control 11: Secure Configuration for Network
Devices, such as Firewalls, Routers, and Switches• CIS Control 12: Boundary Defense• CIS Control 15: Wireless Access Controls

Figure 6. Chart. Relationship between Center for Internet Security Controls and Traffic
Management Center roles.(Source: Federal Highway Administration.)

20

Transportation Management Center Information Technology Security

While the predominant focus of these guidelines is on the CIS Controls, mapping between CIS
and NIST has been developed by CIS and can be used by organizations focusing in one set ofcontrols or the other. 8
In the appendices, a full copy of the CIS to NIST mapping is printed based on the current date ofthis report. However, users of these guidelines are encouraged to go to the CIS Controls website
for the most current version. A subset of CIS Control 1 is provided below as a reference for the
associated cross-mapping. A summary table of the controls associated with each topic area inchapters 5 through 9 has been provided at the end of each topic, focusing on the relevant CIS
controls. Agencies that already are involved with the use of NIST are advised to reference theappendices for the complete list of associated NIST CSF activities associated with therecommended CIS Controls documented herein.
CIS
Control

CIS SubControl

Asset Type

Security
Function

1

Title

NIST CSF

Inventory and Control of Hardware Assets

1

1.1

Devices

Identify

Utilize an Active Discovery Tool

DE.CM-71

1.2

Devices

Identify

Use a Passive Asset Discovery Tool

DE.CM-71

1.3

Devices

Identify

Use DHCP Logging to Update Asset
Inventory

DE.CM-7
ID.AM-11

1.4

Devices

Identify

Maintain Detailed Asset Inventory
PR.DS-3

1

1.5

Devices

Identify

Maintain Asset Inventory Information

PR.DS-3

1

1.6

Devices

RespondAddress Unauthorized Assets

PR.DS-3

1

1.7

DevicesProtect

Deploy Port Level Access Control

PR.AC-11

1.8

DevicesProtect

Utilize Client Certificates to Authenticate
Hardware Assets

PR.AC-6

Figure 7. Screenshot. Center for Internet Security controls mapping to the National Institute ofStandards and Technology security functions and the National Institute of Standards andTechnology cybersecurity framework. (Source: CIS Controls Version 7.1.)

8

Center for Internet Security (CIS), “CIS Controls V7.1 Mapping to NIST CSF.” Retrieved
from: https://www.cisecurity.org/white-papers/cis-controls-v7-1-mapping-to-nist-csf/.
21

Transportation Management Center Information Technology Security

Additionally, DHS has developed a similar mapping document to map NIST controls to Cyber
Resilience Review (CRR) controls. 9 The emphasis on CIS Controls provides a central approachthat can be used throughout these guidelines, and readily accommodates cross-referencing
between the other frameworks for additional supporting information.
While it will not eliminate all risks, using the following guidelines can provide ways to manage
and control those risks. Relevant CIS Top 20 Controls are incorporated into each subsection as
noted above.
CIS Controls version 7.1 has been structured in layers based on an organization’s size andsophistication. The following diagrams from v7.1 shows three levels of organizational
capabilities.

Figure 8. Infographic. Center for Internet Security implementation groups.
(Source: CIS Controls version 7.1.)
Within the CIS Controls document, as the organization reviews recommendations for protecting
the TMC, priority should be given to those that are recommended for all three implementationgroups, followed by those recommended for groups 2 and 3, and finally those applicable to justgroup 3. It is anticipated that the majority of TMCs will fall into group 2. Some smaller

9

Department of Homeland Security (DHS), “Cyber Resilience Review (CRR): NIST
Cybersecurity Framework Crosswalks,” 2016. Retrieved from: https://www.uscert.gov/sites/default/files/c3vp/csc-crr-nist-framework-crosswalk.pdf.
22

Transportation Management Center Information Technology Security

organizations will fall into group 1. Larger organizations, or those abiding within regulatory
scrutiny, will fall into group 3.
For TMCs, since the primary recommendation is to follow CIS Controls for initial guidelines,
this section will focus heavily on each of those CIS Top 20 Controls. Within each CIS Control,
the sub-controls focus on a type of asset (e.g., Users, Networks, Applications, Devices, andData), and the security function (e.g., Identify, Protect, Detect, Respond), which correlate to
NIST Cybersecurity Framework elements.

23

Transportation Management Center Information Technology Security

CHAPTER 5. GUIDELINES FOR CONTROLLING HARDWARE WITH ACCESS TO
THE NETWORKTo determine if something is out of the ordinary, it is necessary to know/identify what “ordinary”
is. That is the premise of Center for Internet Security (CIS) Control #1: Inventory and Control
of Hardware Assets. Whether an organization decides to use an active or a passive discovery tool
to start or maintain tracking the network-attached devices, maintaining a detailed asset inventory
is at the top of the list for Control #1. Without knowing what devices are supposed to be on the
network, it is difficult to maintain control of the network.
A detailed inventory of devices connected to the network begins with identifying each device’s
location, respective IP address, Media Access Control (MAC) address, and manufacturer name.
At a minimum, this should consist of anything connected to the Traffic Management Center(TMC) network in the building: servers, workstations, wireless access points, video wall
controllers, network video recorders, security/surveillance systems, access control systems,
firewalls, switches, routers, printers, copiers, wireless thermostats, any other network appliancesor devices.
After identifying the elements of the TMC network environment, the next step is to implement
device controls to protect the network and related systems. Port-level access controls (i.e., port
management), like IEEE 802.1x and network access control (NAC), are highly recommended forthe enforcement of device access policies and to prevent unauthorized devices from connecting
to the network through open network ports on the TMC floor or Wireless local area network(LAN) access points.
For further control and protection, devices that do not
Given the wide range of
support port-level access controls can be isolated by Virtual
vendors and network appliances
Local Access Network (VLAN), but firewalls arein use within a TMC
preferable for more critical systems. This also is true forenvironment, another common
printers, copiers, and other devices (including leased
best practice is to Establish a
devices from service companies) that contain data storage
Test Environment apart fromdevices. Mobile devices (phones, tablets, etc.) that are not
the production environment.
controlled by an administrative operating system (i.e.,bring-your-own-devices (BYOD) or computers withtemporary guest access) or port controls noted above should be considered a risk withappropriate connection protection to the enterprise network (e.g., network authentication
appliances, firewalls, multi-factor authentication, or equivalent) to prevent rogue devices fromdirectly accessing the enterprise network. Given the wide range of vendors and network
appliances in use within a TMC environment, another common best practice is to establish a test
environment apart from the production environment. Network appliance vendors and field device
vendors for Operations equipment routinely roll out software/firmware updates, which are best to
test in the isolated Test environment before putting the Production environment at risk if thevendor’s updates have been compromised.

25

Transportation Management Center Information Technology Security

Some TMCs manage tunnels at water crossings or
RELEVANT CONTROLS FOR
through mountains. As such, ventilation systems,
HARDWARE/DEVICES
fire suppression systems, flood gates, and/or other
Supervisory Control and Data Acquisition• CIS Control 1: Inventory and(SCADA)-type systems are more likely to beControl of Hardware Assets.
encountered in these environments. For TMCs withSCADA industrial control system (ICS) exposure, limit access to Internet-based devices to thespecific protocols/ports necessary, ensure that default username and passwords have been erased
or replaced, and evaluate the applicability of National Institute of Standards and Technology(NIST) SP 800-82 for those ICS/SCADA components. Section 4.1.2 of NIST SP 800-82
recommends evaluating the risks on SCADA systems for their physical, economic, and/or social
impacts to help the agency decide about isolating these systems from the rest of the network.
Going forward, continually monitor what devices are connected to the network, and quarantine
and/or remove unauthorized assets in a timely manner. Larger organizations should employ
active asset management tools (e.g., OpenNMS, SolarWinds, Nagios, PRTG, and other industry
examples) to scan the network, add/monitor for new devices, and flag them before granting
immediate access.

26

Transportation Management Center Information Technology Security

CHAPTER 6. GUIDELINES FOR CONTROLLING SOFTWARE USED WITHINTHE NETWORK
Traffic Management Centers have a wide range of software applications ranging from vendorprovided software that is specific to managing a single type of Intelligent Transportation Systems(ITS) field device/subsystem, to a custom-developed software platform that integrates all fielddevices into one system. These may reside on individual server hardware platforms or within one
or more Virtual Machines (VM) on servers(s). Advanced adversaries are continuously
conducting research and development to identify new vulnerabilities in the applications used bytheir targets and the infrastructure on which those applications run. Similar to hardware control,
software control begins with an inventory to identify what is present on the Traffic Management
Center (TMC) network. Center for Internet Security (CIS) Control 2: Inventory and Control ofSoftware Assets provides guidelines on managing software deployed within the TMC andunderscores the importance of the removal of unnecessary software, which poses a risk due topotential security flaws or lack of vendor support, as well as determining appropriate separationof high-risk applications from the most critical systems. As an example, if a traffic management
software vendor ceases to support upgrades to use the newest Windows operating system, andMicrosoft also stops supporting patches for the older operating system, both will becompromised from a security standpoint, which should be addressed before a problem arises.
Additionally, TMCs with custom software tend to deploy a test environment and a liveproduction environment segmented on different parts of the network. In those cases, devices thatare moved back and forth between the two networks and should be tracked and regularly
checked for accuracy.
Once a baseline is established, maintaining control is equally important. Going forward,
continually monitor what software applications are on each computer, and quarantine and/or
remove unauthorized applications in a timely manner to maintain control. Quarantining anapplication may result in administrative rights being altered to restrict users from using thesoftware until further evaluation and approval by TMC Information Technology (IT) staff.
Preventing unauthorized applications from being installed in the first place is a combination of
CIS Control 2 (e.g., whitelisting authorized applications) and CIS Control 5: Secure
Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations andServers (e.g., maintain secure configuration settings for computer operating systems to minimize
administrative privileges on what can be added/deleted/changed). These two CIS Controls are
considered basic elements to all agencies that should be the starting point of security initiatives.
The next two relevant CIS Controls are considered foundational and organizational, respectively.
As such, they have more value once basic elements have been covered first. The next control
element for software components is CIS Control 7: Email and Web Browser Protections, begins
to address attack elements focused on end users’ interactions with Internet-connected
applications, which can expose the network and systems to malicious code and/or provide
unauthorized access to the network by pilfering passwords through a variety of exploitation
methods including social engineering. Two of the most relevant sub-controls of CIS Control 7
for all organizations involves ensuring that only fully supported browsers and email clients areallowed on the network, as well as using domain name system (DNS) filters to block access to27

Transportation Management Center Information Technology Security

known malicious domains. For example, if the agency is not doing business in a capacity that
requires access to foreign country web domains, then restricting access to those domains canhelp prevent unnecessary exposure by reducing the attack surface on the network.
For larger organizations with a mixture of applications developed in-house along with vendorsupported applications, CIS Control 18: Application Software Security provides guidelines forprocedural measures to be incorporated to routinely evaluate, monitor and correct exposure risks
associated with application development and maintenance; because this is intended for moresophisticated TMC environments, the associated sub-controls are pertinent to group 2 andgroup 3 organizations. If the organization has sensitive applications or data sources that are
passing across or outside the network, and it is desired to encrypt the entire data flow, the use ofstandardized encryption algorithms is highly recommended (sub-control 18.5).
CLOUD HOSTING
As a sub-variation of controlling software in the
RELEVANT CONTROLS FOR
TMC environment, while cloud computing is
SOFTWARE
increasingly being used for either data storage
and/or hosting applications (e.g., Software as a
• CIS Control 2: Inventory andService (SaaS) or Platform as a Service (PaaS)),
Control of Software Assets NISTCIS Controls do not specifically discuss application
RMF Identify.
hosting in this regard, though it is recommended to• CIS Control 5: Secure
use caution regarding storing data in the cloud.
Configuration for Hardware andWhen evaluating the option for a cloud computing
Software on Mobile Devices,
solution, agencies need to consider the associatedLaptops, Workstations and Servers.
risks and challenges that the specific solution may• CIS Control 7: Email and Web
encounter. The National Institute of Standards andBrowser Protections.
Technology’s (NIST) Cloud Computing Security• CIS Control 18: Application
Working Group (NCC-SWG) developed a Risk
Software Security.
Management Framework (RMF) in a Cloud
Ecosystem, which shows a 6-step process with theitems specific to cloud-computing highlighted in blue. A wiki page is available online for further
information regarding the NCC-SWG. 10
Three primary cloud service models are the most prevalent:
1. Software as a Service (SaaS).
2. Platform as a Service (PaaS).
3. Infrastructure as a Service (IaaS).
In the first, the end-user agency only gets access to the software (e.g., webmail client,maintenance management software, etc.) without regard for the computing hardware required to
run it in the cloud. SaaS typically offers limited capabilities for integration with other data,
10

TWiki, “NIST Cloud Computing Collaboration Site.” Retrieved from:https://collaborate.nist.gov/twiki-cloud-computing/bin/view/CloudComputing/CloudSecurity.
28

Transportation Management Center Information Technology Security

systems, and platforms, and tends to lead toward vendor lock-in, and little flexibility tocustomize the application for the TMC. Subscribing to travel-time and crowd-source data
streams is a common use of SaaS for TMCs, where the agency is able to receive the data streams
and store the data locally to mitigate vendor lock-in, integration, or the need for customizations.
For a PaaS environment, the agency begins to take a more active role in picking the hosting
environment with control of the applications that are deployed but very little control of theunderlying servers, processors, and storage equipment. For an IaaS, an agency gains more
control of the operating system, the selection of the hardware, and limited control of the networkthat connects their selected applications and devices together. The TMC’s traffic management
software generally requires a great deal of customization to integrate legacy field devices,
protocols, and TMC-specific elements (video walls, video distribution systems, access controls)
and a wide array of telecommunication connection options, not to mention agencies that sharedata and controls with other public agencies. Picking a cloud service model is a balance between
control/integration flexibility and how much the agency can maintain/administer safely andsecurely on their own.

Figure 9. Flowchart. Cloud consumers’ view of the Risk Management Framework applied to a
cloud ecosystem.
(Source: Managing Risk in a Cloud Ecosystem, NIST.)
Beyond choosing a cloud service model, there are several other elements that agencies need toconsider when implementing a cloud-hosted environment. For instance, if the systems will be
subject to the Federal guidance of FedRAMP due to the content being stored/shared, then thefollowing guidelines need to be adopted by the organization:

29

Transportation Management Center Information Technology Security•

FedRAMP:o Per an Office of Management and Budget (OMB) memorandum dated December 8,
2011, any cloud services that hold Federal data must be FedRAMP authorized. 11 This
memorandum also references NIST Special Publication 800-53 Recommended
Security Controls for Federal Information Systems and Organizations and 800-53A
regarding building effective security assessment plans. 12
o An agency official is responsible for making risk-based decisions to grant a cloudservice provider with the Authority to Operate (ATO) along with the determinedcategorical NIST Federal Information Processing Standards (FIPS) 199 impact levelof the applications/services. 13
o It also references NIST SP 800-144 Guidelines on Security and Privacy in Public
Cloud Computing. 14 One key aspect involves maintaining accountability over theprivacy and security of data and applications implemented in public cloud computing
environments.
o While these are the most applicable to TMCs, Federal agencies will need to abide by
the broader list of referenced requirements to ensure compliance.

•

Public cloud or GovCloud:o GovCloud platforms are operated by employees who are U.S. citizens on U.S. soil,
and intended for hosting sensitive controlled unclassified information.
o GovCloud U.S. regions are only accessible to U.S. entities, and these systems are
restricted to root account holders who pass a screening process; agencies must
confirm that they will only use a U.S. Person (green card holder or citizen as definedby the U.S. Department of State) to manage and access root account keys to the U.S.
regions.

11

Steven VanRoekel, Executive Office of the President “Security Authorization of Information
Systems in Cloud Computing Environments Memorandum,” 2011. Retrieved from:https://www.fedramp.gov/assets/resources/documents/FedRAMP_Policy_Memo.pdf.
12
NIST, “SP 800-53A Rev. 4 Assessing Security and Privacy Controls in Federal Information
Systems and Organizations: Building Effective Assessment Plans,” 2014. Retrieved from:https://csrc.nist.gov/publications/detail/sp/800-53a/rev-4/final.
13
NIST, “FIPS 199 Standards for Security Categorization of Federal Information andInformation Systems,” 2004. Retrieved from:https://csrc.nist.gov/publications/detail/fips/199/final.
14
NIST, “SP 800-144 Guidelines on Security and Privacy in Public Cloud Computing,” 2011.
Retrieved from: https://csrc.nist.gov/publications/detail/sp/800-144/final.
30

Transportation Management Center Information Technology Securityo GovCloud is not an automatic requirement for TMCs looking to deploy systems in
the cloud but is worth considering the value when an agency places more emphasis on
trusting a third-party to maintain a key platform for them.
o Evaluate geographic diversity/availability for data storage in primary and secondary
sites, and whether the organization can maintain control of where the data resides (incountry or abroad for Public cloud providers).
o Evaluate the cloud providers support for protection against Internet attacks (e.g.,Distributed Denial of Service (DDoS)) and other threats that the organization alreadyprotects against on the physical network.
o Evaluate cloud administrators access to the system data and whether an appropriate
level of staff vetting is in place based on the level of access and/or risk.

31

Transportation Management Center Information Technology Security

CHAPTER 7. GUIDELINES FOR CONTROLLING NETWORK CONNECTIVITY
Tying back to the ability to prevent, alert, and respond to attacks on an agency’s systems, thissection of the report focuses on aspects pertaining to network connectivity and ways to manage
connections with various subsystems (internally and externally) as well as recommendations formonitoring the network for unusual activity along with the ability to strategically respond in sucha situation. The following are considered Foundational controls, as they build upon the basics
identified above for establishing control of hardware and software components residing on the
network. Once an organization has baselined its normal “ordinary” network, the next step is tostrategically isolate critical infrastructure devices/systems, to limit risk exposure. Center forInternet Security (CIS) Control 9: Limitation and Control of Network Ports, Protocols, andServices, discusses separate ways in which agencies can limit and control access to certain
devices and network segments. Devices that do not support these standards should be isolated tominimize risks of outside entities leveraging devices with weaker security features, which can beused to gain access to other parts of the network. Examples of ways to limit access are:•Utilize port-filtering 15 (sub-control 9.4) to manage the type of network traffic allowed on
the network. Some vendors have even registered their preferred ports with the Internet
Assigned Numbers Authority (IANA) such as Schneider Electric using port 5481, andGE using port 10212 for their respective Supervisory Control and Data Acquisition(SCADA) applications. The important consideration here is that when opening a portwith access to the Internet, it is a recommended practice to limit the associated protocols
that can use that port to prevent adversaries from using those ports as an attack vector.
Also, this type of attack vector, and ways to circumvent it during an incident (e.g.,
configuring systems to use an alternate port number if possible), should be covered in an
agency’s risk management plan.

•

Utilize a next-generation application firewall (sub-control 9.5) to provide application
awareness, user identification, and content filtering. Allows administrators to define
policy for users that are authorized to access specific applications and to ensure thecontent being passed is clear of exploits. While this is listed for implementation group 3,
it is strongly recommended for group 2 as well since Traffic Management Centers (TMC)
have a higher tendency to import/export data and applications with other entities.

•

Client Certificates to authenticate computer assets connecting with the trusted network.

15

In addition to an IP address for a device, the IANA manages the registration of commonly used
port numbers used in conjunction to signify the kind of traffic that is being sent across the
network. (Wiki, “List of TCP and UDP port numbers.” Retrieved from: https://en.wikipedia.org/
wiki/List_of_TCP_and_UDP_port_numbers.) Common examples include:•••

Port 21 for File Transfer Protocol (FTP) traffic.
Port 80 for hypertext transfer protocol (HTTP) web traffic.
Port 161 for Simple Network Management Protocol (SNMP).
33

Transportation Management Center Information Technology Security•

Monitor/Address unauthorized assets for removal, quarantine, or not allowing access to
begin with.

•Manage network devices using multi-factor authentication (MFA) and encrypted
sessions.

It is important to not only consider restricting traffic from certain domain names, and certain
ranges of IP addresses, but also disabling the ports that are not needed to support the mission(i.e., port-filtering). However, it is important to note that in some cases, even ports that anorganization believes are necessary for operation may be too dangerous. For example, password
attacks against exposed remote desktop protocol (RDP) services (e.g., Port 3389) are now
extremely common. If an organization needs remote desktop services, another solution should beconsidered first, such as requiring Virtual Private Network (VPN) to reduce risk withconnections outside of the network.
Understanding the network baseline is fundamental to the security plan, and managing
configuration changes over time is covered by CIS Control 11: Secure Configuration for
Network Devices, such as Firewalls, Routers, and Switches. Attackers look for vulnerabilities,
particularly in default settings, to gain access to the network and related systems. Control 11
outlines the Identifying, Detecting, and Protecting of the TMC network. For instance, sub-control
11.2 calls for identifying/documenting the reasons why a configuration rule is in place to allow
certain traffic to flow through the network. As business needs change, the documentation will be
incredibly helpful to purge configuration rules that are no longer needed and prevent unnecessary
impacts on those that are needed (when documentation does not exist). It is common for TMCs
to share information with other TMCs as well as to gather information from others. Documenting
how this data gets into or leaves from the network is particularly important for TMCs that use
Internet-based gateway portals to other systems such as:•••

Remote access to a signal system or an adjacent agency’s systems (e.g., 511).
Dashboarding of public information used in transit/transportation systems.
Digital video sharing access/controls.

Data categorization, loss prevention, and privacy considerations are discussed in more detail atthe end of this chapter and should also be considered.
Further, sub-control 11.3 focuses on detection and the use of automated tools to compare
network device configurations with known/approved configuration settings and to alert when
deviations are found. As a final example, sub-control 11.4, which is crucial to all 3
implementation groups, is focused on protection by ensuring that stable security updates arerolled out on all network devices. Further, network separation (sub-control 11.7) is a key strategy
for isolating at-risk systems from core/enterprise systems.
Much of what TMCs previously managed consisted of low-speed field devices with a variety ofproprietary communication protocols. Field equipment today now includes mostly standardsbased networkable appliances/devices. While there are separate initiatives focused on securing
the field cabinet/network environment, the TMC Information Technology (IT) environment
34

Transportation Management Center Information Technology Security

needs to consider these as a risk/threat vector and apply controls mentioned above to limit thetypes of ports and protocols traversing into the “enterprise” network from the field. As such, theTMC IT environment needs to take into consideration these basic informational components ofthe field networks and their impact on configuration rules at boundaries (i.e., firewalls, routers,
VPN devices, etc.):
•
•

•

•

Inventory tracking to include operating
system (OS) and patch level plus firmware.
Password management practices fortechnicians and devices (as appropriate);
length, multi-character, and multi-factor
authentication usage.
Allocation of network segmentation via
Virtual Local Access Network (VLAN) in
the field and the associated impact on
firewall/network configuration rules, as wellas the isolation of copiers/printers andsecurity system cameras/components.
Securing and encrypting wirelesstechnologies with access to the field andenterprise network.

RELEVANT CONTROLS FORCONNECTIVITY
•
•

•
•

CIS Control 9: Limitation andControl of Network Ports,
Protocols, and Services.
CIS Control 11: Secure
Configuration for Network Devices,such as Firewalls, Routers, andSwitches.
CIS Control 12: Boundary Defense.
CIS Control 15: Wireless AccessControls.

Additionally, if the TMC is subject to controls associated with credit card processing back-end
systems, beyond CIS Control 11, network separation guidelines from Payment Card Industry
Data Security Standards (PCI-DSS) also should be referenced: Information Supplement:
Guidance for PCI-DSS Scoping and Network Segmentation. December 2016. 16 PCI-DSS is only
required for handling credit card transactions.
Building upon configuration and policy controls associated with traffic passing through network
devices is next supplemented by incorporating elements of CIS Control 12: Boundary Defense,
to manage the trust levels and information flowing between networks. Similar to CIS Control 11,
Control 12 covers a wide range of strategies for identifying, detecting, and protecting the
network. Two of the most relevant to all organizations are sub-controls 12.3 and 12.4, which callfor denying communications with known malicious Internet Protocol (IP) addresses (i.e., ranges,
domain names, and/or foreign countries) as well as unauthorized Transmission Control Protocol(TCP) or User Datagram Protocol (UDP) ports at each network boundary point. It should be
noted, however, that when rolled too aggressively IP address range filtering can cause some
applications to break, particularly in a “poll” and “response” system that requires openings bothgoing out and coming back in to the network from the field.

16

PCI Security Standards Council, “PCI Data Security Standard (PCI-DSS) Information
Supplement: Guidance for PCI-DSS Scoping and Network Segmentation,” 2017. Retrieved
from: https://www.pcisecuritystandards.org/documents/Guidance-PCI-DSS-Scoping-andSegmentation_v1_1.pdf.
35

Transportation Management Center Information Technology Security

At this point within the CIS Top 20 controls, more advanced/sophisticated strategies are more
apparent, such as intrusion detection systems (sub-control 12.6) and scanning enterprise devices
remotely logged in for adherence to security policies (sub-control 12.12). More sophisticatedstrategies will need to be prioritized for the organization based on self-assessment of areas of thegreatest risks/threats. Many of these strategies will require more data collection and analysis
using industry available protocols like NetFlow to collect and log data, and tools to quickly filter
the data and alert on deviations from accepted standards.
Controlling physical access to wiring closets, network switches, and unused ports is primarily
addressed by the aforementioned CIS Controls, but wireless access presents its own challenges
warranting CIS Control 15: Wireless Access Controls. Control 15 covers securing use ofwireless LANs, access points, and end-user client systems. Additionally, it covers elements suchas scanning for unauthorized wireless access points connected to the network (sub-control 15.2).
These are devices that are not setup according to the agency’s security guidelines and represent
an elevated risk for unauthorized access that bypasses back-end network authentication systems.
Enforcing encryption of wireless data transmissions is a foundational control (sub-control 15.7)
that applies to all implementation groups to further protect data even if the wireless signal isintercepted. Similarly, in the age of bring-your-own-device (BYOD) into the TMC environment,
sub-control 15.10 is highly recommended to create a separate wireless network for untrusted
devices that are primarily granted access to the Internet, but not the enterprise network.

36Transportation Management Center Information Technology Security

CHAPTER 8. GUIDELINES FOR CONTROLLING STAFFING/TRAINING-RELATEDATTRIBUTES (INSIDER VULNERABILITIES)The next two sections of this chapter pertain to the personnel component of controlling andmitigating risk through methods such as limiting the use of administrative privileges, training
staff regarding security awareness initiatives, and account monitoring.
ORGANIZATION-RELATED ATTRIBUTES
With a smaller organization, it is more likely to have a small number of staff to coordinate withand track activities on a personal level when system configuration changes are noticed. In alarger Traffic Management Center (TMC), where multiple personnel, and potentially multiple
shifts are available, isolating who has access and authorization to make changes to systems andthe network is important for troubleshooting and follow-up after an event occurs.
Controlling the use of Administrative Privileges and the use of automated logging andmonitoring (Center for Internet Security (CIS) Controls 4, 6, and CIS Control 16) is critical for
TMCs. This not only pertains to administrative privileges for operating systems, but logging
TMC application configuration settings, logging network device configuration changes, andcontrolling access to network infrastructure (e.g., server data centers, network wiring closets).
TMCs commonly have an array of databases gathering and storing information about traffic
sensors, incident management, lane/road closures, work zones, and in some cases video
recordings. Manipulation of these databases and/or the deletion of this data can have a major
impact on the organization. As such, protected logging of operating systems, network device
configurations, databases, and data center equipment plays an important role in data loss
prevention discussed at the end of this chapter. Limiting administrative privileges to only thosewith a legitimate business need reduces the attack surface and the potential for inadvertentchanges to these systems.
Many TMCs have contract employees
RELEVANT CONTROLS FOR
supplementing their own staff. To maintain control
STAFFING
of the TMCs in this scenario will restrict what
portions of the network and applications these• CIS Control 4: Controlled Use ofindividuals can access, particularly restricting from
Administrative Privileges.
accessing the enterprise portions of the network.
• CIS Control 6: Maintenance,
TMCs should not solely rely on contract employees
Monitoring and Analysis of Audit
for administrative privilege control of hardware andLogs.
software and network devices. Contract employees• CIS Control 16: Accountwith a higher level of responsibility within the
Monitoring and Control.
TMC should be vetted and put through appropriate
background checks (Relevant to CIS Control 14: Controlled Access Based on the Need toKnow). Restrictions on changing automated logging should be managed by TMC organization
staff, or at the very least limiting those with the capability to make those changes.

37

Transportation Management Center Information Technology Security

Agencies also should consider incorporating policies and practices to routinely scan ports for useof disabled and outdated credentials. All these policies and practices are found to be the mostreliable when they are incorporated into the workflow between groups (e.g., human resources
and information technology).
TRAINING/EDUCATION
It is important for organizations to raise awareness
RELEVANT CONTROLS FOR
of cybersecurity and potential threats and offer
TRAINING
training to reinforce how to protect users, systems,
and data. Most organizations have multiple teams• CIS Control 17: Implement aleveraging internal training programs and lack the
Security Awareness and Training
ability for consolidated reporting at an
Program CIS.
organizational level. To provide a holistic view into
employee training it is recommended that a Learning Management System (LMS) be leveraged
to provide organizations with a single console easily accessed anywhere, and a reporting tool fororganizations and employees to participate in training, track progress, and report on overall
organizational requirements. After identifying skills gaps, and threat vectors that require anawareness among employees, the LMS can be used to roll out training initiatives in a timely
fashion and monitor compliance. (Relevant to CIS Control 17: Implement a Security Awarenessand Training Program.) TMCs that manage Industrial Control Systems, such as SCADA
networks for tunnels, are encouraged to further supplement the CIS Controls with section 6.2.2
of National Institute of Standards and Technology (NIST) 800-82r2, and NIST 800-50. 17
For TMCs with limited training staff or funding available to provide training, third-party training
services and programs are available and should be explored. The following table contains a listof common or popular training sources that may be applicable to security staff withresponsibilities in TMC environments that include aspects of industrial control system (ICS)/SCADA infrastructure.

17

NIST, “SP 800-50 Building an Information Technology Security Awareness and Training
Program,” 2003. Retrieved from: https://csrc.nist.gov/publications/detail/sp/800-50/final.
38

Transportation Management Center Information Technology Security

Table 1. List of industrial control systems-related training.
SourceType
Free?
TopicsICSWebYes • Operational Security (OPSEC) for Control Systems
CERTa
based
(100W)—1 hour.
• Differences in Deployments of ICS (210W-1)—
1.5 hours.
• Influence of Common Information Technology (IT)Components on ICS (210W-2)—1.5 hours.
• Common ICS Components (210W-3)—1.5 hours.
• Cybersecurity within IT and ICS Domains (210W-4)—
1.5 hours.
• Cybersecurity Risk (210W-5)—1.5 hours.
• Current Trends (Threat) (210W-6)—1.5 hours.
• Current Trends (Vulnerabilities) (210W-7)—1.5 hours• Determining the Impacts of a Cybersecurity Incident(210W-8)—1.5 hours.
• Attack Methodologies in IT and ICS (210W-9)—
1.5 hours.
• Mapping IT Defense-in-Depth Security Solutions to
ICS (210W-10)—1.5 hours.
ICS-CERT Instructor- Yes • Introduction to Control Systems Cybersecurity (101)—led
8 hours.
• Intermediate Cybersecurity for Industrial Control
Systems (201)—8 hours.
• Intermediate Cybersecurity for Industrial Control
Systems (202)—8 hours.
• ICS Cybersecurity (301)—5 days.
SANSb
MultipleNo• ICS410: ICS/SCADA Security Essentials.
• ICS456: Essentials for North American Electric
Reliability Corporation (NERC) Critical Infrastructure
Protection.
• ICS515: ICS Active Defense and Incident Response.
FedVTEc, d
WebYes Federal Virtual Training Environment (FedVTE):
based• 101 Critical Infrastructure Protection—2 hours.
a
NCCIC/ICS-CERT, “Training Available Through ICS-CERT.” Retrieved from: https://icscert.us-cert.gov/Training-Available-Through-ICS-CERT.
b
SANS, “Cyber Security Courses.” Retrieved from: https://www.sans.org/courses/.
c
FedVTE, “FedVTE Course Catalog.” Retrieved from:https://fedvte.usalearning.gov/coursecat_external.php?group=ALLdAppears to be limited to Federal employees only.
(Source: Federal Highway Administration.)

39

Transportation Management Center Information Technology Security

The National Initiative for Cybersecurity Careers and Studies (NICCS) Catalog provides a list of
cybersecurity courses of all topics from a wide variety of sources. 18 It can be used to findrelevant courses, and vendors that are local with respect to a given organization.
Employee Exit Process
An essential/basic element of asset control is the removal of account credentials from an
employee at the time of departure. Based on the risk management plan for an organization and/or
the sensitivity of certain applications and data, a TMC agency might exercise restricted access tosome systems before departure. At a minimum, when given notice of an individual’s impending
departure, lowering their access privileges down to an appropriate “need-to-know” level andrevoking full administrative privileges is consistent with guidelines in CIS Control 14:
Controlled Access Based on the Need to Know and CIS Control 4: Controlled Use of
Administrative Privileges, respectively.
All agency-owned assets loaned to the employee for use should be asset-tagged and returned tothe agency as part of the Exit Process. Any software that requires special dongles or keys toaccess also should be covered by asset management tracking tools and incorporated into thechecklist of items to be returned during the Exit Process. Field cabinet access keys/devices alsoneed to be returned.
After considerations for Federal (36 CFR 1220.14), State, or local recordkeeping requirements,
agencies should incorporate policies for sanitizing and/or disposing of electronics (e-disposal),
personal information/folders. 19 It is recommended that any electronics sent out for e-disposal besanitized beforehand or contracted through a reputable service provider who will be destroying
the media altogether. While this is a critical time to deal with e-disposal upon employee exit, thisis a broader organizational issue that is worth incorporating into routine e-sanitization policies
for risk management practices, and data protection that is discussed below.

18

National Initiative for Cybersecurity Careers and Studies (NICCS), “NICCS Education andTraining Catalog.” Retrieved from: https://niccs.us-cert.gov/training/search.
19
National Archives and Records Administration (NARA), “NARA Code of Federal
Regulations.” Retrieved from: https://www.archives.gov/about/regulations/regulations.html.
40

Transportation Management Center Information Technology Security

CHAPTER 9. GUIDELINES FOR RESILIENCY/DATA PROTECTION ANDRECOVERYINTERAGENCY INFORMATION SHARING AND COLLABORATION
When developing cybersecurity guidelines, it is important for agencies to work together to share
past experiences and best practices. These partnerships can be between organizations within thesame agency (e.g., a localities Information Technology (IT) department and Public Works) andamong agencies within the same industry (e.g., local and State Traffic Management Centers(TMC)). This will help build an awareness of industry risks and standards and ensures that themost innovative approaches are being utilized and expanded upon industry-wide. These
partnerships also can serve as a platform for discovering and applying for Federal resources andincentives.
In 2013, the Department of Homeland Security (DHS) in collaboration with the criticalinfrastructure community developed the National Infrastructure Protection Plan (NIPP) titled
NIPP 2013: Partnering for Critical Infrastructure Security and Resilience which serves as a
guide for the national effort to manage risk to critical infrastructure as a collaborative effort. This
document presents shared national vision, mission, and goals with respect to managing risk andserves as a guideline for organizations or groups of organizations to develop a collaborative
partnership. 20
Another platform for developing partnerships that TMCs should consider is any of various
applicable Information Sharing and Analysis Centers (ISAC), which are sector-based, non-profit
limited liability companies (LLC) developed to help companies across industries collaborate andcoordinate via the National Council of ISACs (NCI). 21 Some examples that may be of interest to
TMCs include:•••

Surface Transportation, Public
Transportation and Over-The-Road Bus
ISACs.
Emergency Management and Response
ISAC.
Information Technology ISAC. 22

RELEVANT CONTROLS FORCOLLABORATION••20CIS Control 4: Controlled Use of
Administrative Privileges.
CIS Control 14: Controlled Access
Based on the Need to Know.

Department of Homeland Security (DHS), “NIPP 2013: Partnering for Critical Infrastructure
Security and Resilience,” 2013. Retrieved from:https://www.dhs.gov/sites/default/files/publications/national-infrastructure-protection-plan2013-508.pdf.
21
National Council of ISACs (NCI). Retrieved from: https://www.nationalisacs.org/memberisacs.
22
The Information Technology—Information Sharing and Analysis Center (IT-ISAC).
Retrieved from: https://www.it-isac.org/.
41

Transportation Management Center Information Technology Security

Additionally, IT-ISAC has developed industry Special Interest Groups to combine peer member
companies within similar industries, such as the Food and Agriculture industry. A TMC would
benefit by being an active member of the ISAC where indicators of compromise or events ofinterest could be shared within their sector and could lead the development of a TMC orTransportation Industry special interest group. When agencies/parent organizations belong tomultiple ISACS, communications should be coordinated within the parent organization toestablish a protocol for managing communications with the various ISACS to prevent duplicate
or conflicting communications.
Each of these sample ISACs was developed to help companies across each associated sector
manage risks through information sharing and analysis.
Risk Management Plan
Building upon the individual predecessor efforts above for TMCs that are lacking a risk
management plan, the figure from NIPP Supplemental Tool: Executing A Critical Infrastructure
Risk Management Approach provides a concise path to support those that are beginning to
implement a risk management approach to cybersecurity to incorporate aspects of the National
Institute of Standards and Technology (NIST) 800-37 Guide for Applying the Risk Management
Framework. It is unrealistic to expect complete prevention of all vulnerabilities. Risk analysis isused to identify where the greatest risks/weaknesses exist, and a risk management plan is used todetermine courses of action to mitigate and manage those risks.

Figure 10. Flowchart. The National Institute of Standards and Technology 800-37 risk
management approach.
(Source: NIST 800-37 Guide for Applying the Risk Management Framework.)
Related to the figure above, within the previous sections of this report, inventory andidentification of hardware, software and network elements in the TMC has been reviewed tosatisfy the Identify Infrastructure component of this process. For TMC/organizations that are
unfamiliar with performing risk assessments, NIST 800-30 is a Guide for Conducting Risk
Assessments. 23 For the TMC environment, organizations should directly assess the risk andimpact of a field equipment breach, an operator workstation breach, a server breach, a network

23

NIST, “SP 800-30 Rev. 1 Guide for Conducting Risk Assessments,” 2012. Retrieved from:https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final.
42

Transportation Management Center Information Technology Security

access breach, and the categorization of the data systems that are the most critical to daily
operations.
The outcome of the risk analysis will allow the TMC management the ability to develop riskbased security governance for the risk management plan, setting goals/objectives, andimplementing risk management activities. Throughout the process, information would be fed
back to support follow-up activities and engaging collaboration with IT and Operations
Technology (OT) staff.
While Center for Internet Security (CIS) Controls noted up to this point all play a part in an
agency’s overall risk management strategy, the following activities relate specifically to the
Measure portion of the risk management approach process flow by evaluating the performanceof organizational plans/strategies. The intent is to establish a program that is fundamentally partof the agency’s routine processes.
•

As the TMC environment’s skillset matures
RELEVANT CONTROLS FOR RISK
and the level of sophistication warrants it,
MANAGEMENTCIS Control 20: Penetration Tests and Red
Team Exercises are recommended to be• CIS Control 3: Continuous
incorporated for TMCs in implementation
Vulnerability Management.
groups 2 and 3. Factoring these tests into the • CIS Control 20: Penetration Tests
overall risk management plan will improveand Red Team Exercises.
the overall resiliency of the TMC byproactively identifying and mitigating vulnerabilities. The most common areas of concern
in a TMC environment involve wireless access networks, Internet connectivity, andconnections to field network devices. Penetration and Red Team exercises are conductedless frequently than other CIS Controls, typically annually.

•

Payment Card Industry (PCI) compliance testing should be incorporated if applicable to
the TMC. Typically, testing is performed annually.

•

Cybersecurity is not a once and done
Cybersecurity is not a once and done
situation. It must be continually monitored,
situation. It must be continually
managed and refined as the threats continue
monitoring, managed and refined as theto evolve. CIS Control 3: Continuous
threats continue to evolve.
Vulnerability Management provides key
ways to incorporate vulnerability assessment, protection, and responsiveness into routine
processes. This ranges from deploying automated software patch management tools (subcontrol 3.5) to automated vulnerability scanning tools (sub-control 3.1).

All guidelines suggest every agency should complete a formal risk assessment and develop theirown resiliency plan. However, low levels of resources can make this challenging, especially inthe preliminary stages of plan development. As many of the best practices identified above
should be implemented at a minimum using CIS Top 20 and NIST Framework as a baseline.

43Transportation Management Center Information Technology Security

Incident Planning and Response
It is not a matter of whether systems will
RELEVANT CONTROLS FOR
encounter a threat, but when. In preparation for
INCIDENT PLANNING AND
this occurrence, CIS Control 19: Incident
RESPONSE
Response and Management recommends thedevelopment of an Incident Response Plan. The• CIS Control 19: Incident Response
Incident Response Plan describes an approach for
and Management.
responding to information security incidents. It
defines the roles and responsibilities of personnel, characterization of incidents, communicationplans, and reporting requirements. The goal of the Incident Response Plan is to provide
guidelines to manage the response process in an effective and consistent manner.
The document also should reference the organization’s Business Continuity Plan to appropriately
categorize critical assets which assist in assigning severity levels to incidents. This also will helporganizations work toward the development of organization-wide incident reporting standards
with respect to time allowances, means and methods, and reporting requirements (e.g., whether
the incident should be reported to an individual within the organization or third-party
authorities).
The document should be written down for ease of access and should be used to train incoming
staff. It is intended that this will be a living document to be modified to incorporate industry risks
and best practices as they change. As part of this ongoing revision, an industry best practice is to
execute periodic table top exercises to test the Incident Response Plan. The results of these
exercises will help organizations identify gaps and outlying vulnerabilities and fine-tune their
response procedures. The CIS Controls identify the actions that are recommended for aneffective Incident Response and Management control, but specific examples are not provided.
This is where NIST documentation is a useful supplement to implementing the CIS Controls
since reference samples are available to be modified and tailored to an organization’s uniqueneeds and requirements.
Sample Incident Response Process: The National Institute of Standards and Technology
Incident Lifecycle
The Computer Security Incident Handling Guide (NIST SP 800-61r2) identifies the Incident
Response Life Cycle by expressing it in four phases: 24••••

Preparation.
Detection and Analysis.
Containment, Eradication, and Recovery.
Post-Incident Activity.

24

NIST, “SP 800-61 Rev. 2 Computer Security Incident Handling Guide,” 2012. Retrieved
from: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf.
44Transportation Management Center Information Technology Security

Preparation: Preparation involves preparing to
respond to potential incidents, by assembling
personnel, developing training, and gathering thenecessary hardware and software to accommodate theincident responses. During the Preparation phasesystems, networks, and applications also are kept
secure through the continuous monitoring for
anomalous traffic and the tracking and patching ofsystem and application vulnerabilities.

The CIS Controls identify theactions that are recommended but
specific examples are not provided.
This is where NIST documentation
is a useful supplement toimplementing the CIS Controls sincereference samples are available to bemodified and tailored to anorganization’s unique needs andrequirements.

Detection: The Detection and Analysis phase is thediscovery of an event with security tools or
notification by an employee, inside party or outside party about a suspected incident. During thisphase the team seeks to determines the priority, scope, risk and root cause of the incident. This
phase includes the creation of a ticket with appropriate classification to begin identifying thedetails of the event. It is important to identify the initial vector, and what data, systems,
employees, or regions were affected. A crucial step in this phase is the evidence gathering andhandling to help document and preserve a chain of custody for legal proceedings.
The Containment, Eradication, and Recovery: The Containment, Eradication, and Recovery
phase is the triage phase where the Incident Response Team’s primary objective involves
preventing further damage to the victim organization and eliminating remnant of theunauthorized activity from the affected systems. Strategies will vary depending on the incident
so it is important to have these strategies pre-determined to help facilitate decision-making.
Post-Incident: Post-Incident Activity is critical to improving response sharing lessons learned
with all teams involved. It is important to hold these meetings within a few days of the end of anincident. Refer to NIST SP 800-61r2 section 3.4.1 Lessons Learned for more information onwhat the meeting discussion should include.
Resiliency Plan
Incrementally building a more robust process/program for resiliency is the purpose fordeveloping a resiliency plan to harden systems and facilities to improve the ability to recoverfrom an attack or breach. The technical publication by MITRE titled Cyber Resiliency Design
Principles/Selective Use Throughout the Lifecycle and in Conjunction with Related Disciplines
dated January 2017 is a resource for aiding in the development of a resiliency plan and design for
TMC IT environments. 25
The following figure from the MITRE publication shows the relationships and building blocks
related to resiliency goals evolving into objectives and ultimately techniques to improve the25

MITRE, “Cyber Resiliency Design Principles: Selective Use Throughout the Lifecycle andin Conjunction with Related Disciplines,” 2017. Retrieved from:http://www.mitre.org/sites/default/files/publications/PR%20170103%20Cyber%20Resiliency%20Design%20Principles%20MTR17001.pdf.
45

Transportation Management Center Information Technology Security

resiliency of the TMC systems and network environment. Establishing layered defenses is a
widely used resiliency strategy relevant to TMCs, particularly when coupled with segmentation/
isolation strategies already discussed in this report. The technique most often used by TMCs
involves Redundancy (of software, hardware, network equipment, configuration backup files,
off-site recovery equipment/locations). Many of the remaining techniques are more sophisticatedand thus more applicable to implementation groups 2 and 3. A Resiliency Plan is intended tolook at how each of these techniques could be used to address the agency’s ability to withstandand mitigate a given threat to the continuity of their operations.

Figure 11. Flowchart. Cyber resiliency engineering framework.
(Source: Cyber Resiliency Design Principles/Selective Use Throughout the Lifecycle and in
Conjunction with Related Disciplines, MITRE.)
When responding and recovering from a breach or widespread application failure, the TMC’sresiliency plan should contain a prioritization plan for restoring applications in order of greatest
criticality. Recovery times and frequency of backups (discussed below) will impact storage
capacity and techniques, which should in turn be folded into system upgrade plans for future
upgrades.
Resiliency plans for TMCs should contain strategies for central device authentication, malware
protection strategies for standard devices, and network segmentation of devices that cannot be
controlled at an acceptable level to achieve agency cybersecurity goals. For example, a resiliency
plan could account for devices that do not support central authentication and are segmented in
the network from others such that just one segment can be temporarily shut off/disconnected in
the event of a breach. This type of strategy is an example of how to improve the response timeand continuity of operations for an organization’s resiliency to an incident.
Any opportunity to reduce the TMC’s potential attack surface by reducing open ports andprotocols passing between networks should be employed and actively incorporated into the
TMC’s Resiliency Plan. Finally, as a general guide for developing the Plan, evaluate the leastlevel of privileged access that can be used to satisfy each objective to prevent unnecessarily
high-level access to devices or systems.
46

Transportation Management Center Information Technology Security

Malware Defenses
One specific form of system and data protection that should be included in an agency’s
Resiliency Plan is malware protection. Part of that Plan should include monitoring known
sources of credible information about known threats and vulnerabilities. The Cybersecurity andInfrastructure Security Agency (CISA) incorporates an industrial control system (ICS) element
into their Computer Emergency Response Teams (CERT) and posts routine alerts and advisories
on their website, which also can be subscribed to via a Really Simple Syndication (RSS) feed. 26
Malicious software is a widespread threat across the cyber world that can enter through any
number of points such as end-user devices, email attachments, webpages, cloud services, user
actions, and removable media. For the TMC world, these entrances can include not only staff
daily operations but field devices as well. This agility paired with the speed at which attacks
occur and spread make malware a priority risk to protect against with a dedication to keeping theprotection current.
CIS Control 8: Malware Defenses provides
RELEVANT CONTROLS FOR
guidelines on controls to implement and manage
DATA PROTECTION
malware protection including monitoring andremoval. With respect to document control, anti• CIS Control 13: Data Protection.
malware software with anti-exploitation features
should be a fundamental consideration to protecting TMCs from malware infiltration as well as
data loss from malware infiltration. In addition to scanning emails at the server level, or network
traffic passing through the firewall, at the very least implementation groups 2 and 3 also should
utilize centrally managed anti-malware software to continuously monitor and defend each of theorganization’s workstations and servers (sub-control 8.1). All organizations also are strongly
recommended to set operating system policies that prevent auto-running applications(sub-control 8.5) held on removeable media devices (e.g., flash drives, camera memory cards,
CDs, etc.).
Data Loss Prevention
TMCs manage copious amounts of data from incident management logs to the massive amountsof traffic sensor data and crowd-sourced data that has both real-time and historical value for
operations managers. TMC operators may have experienced the loss of that data from storage
device failures, accidental deletion (by users with system privileges set too high), malware thatblocks access to servers/data, and/or a corrupt field device that overwrites the central database.
However, data theft is the primary focus of CIS Control 13, which is described below.
Understanding the importance and value of the TMCs datasets is the first step in data loss
prevention.
Data loss prevention (DLP) refers to a procedure or policy for monitoring and detecting
unauthorized data breach and exfiltration attempts by monitoring, detecting, and blocking
26

Cybersecurity and Infrastructure Security Agency Industrial Control Systems Alerts andAdvisories. Retrieved from: https://ics-cert.us-cert.gov/.
47

Transportation Management Center Information Technology Security

sensitive data. CIS Control 13: Data Protection provides guidelines for DLP techniques. As afirst step, it is important for organizations to identify and classify their data. Best practice is tocreate at least 3 and optimally no more than 5 basic data labels: Create a “General” label that isdefault (applied to everything) allowing the user to upgrade to a higher classification (e.g.,
Operations, Supervisory Control and Data Acquisition (SCADA), Sensitive/PCI), or downgrade
to a lower classification with explanation.
DLP is a best practice to implement on specific use cases, however sifting through alerts canconsume considerable man hours. As an alternative to manually filtering and processing data,
commercial DLP solutions are available for purchase and deployment by organizations withlimited staff availability. Use-cases for DLP include monitoring for specific data/file types andtags in files or unauthorized use of encryption of files located on the network that have been
identified as threats/vulnerabilities by ICS-CERT or others, along with monitoring significant
data transmissions outside of the network. Organizations should still plan at a minimum todedicate staff to reviewing the event logs regularly and following up on events related toattempts to transmit sensitive information without authorization, as well as to tune the tools tomanage the volume and types of alerts that are of no consequence or value to reduce
considerable person hours required to implement DLP.
Information Rights Management (IRM) are features for document creation that can enforce
encryption on all newly created documents and protect files from unauthorized copying, viewing,
printing, forwarding, deleting, and editing as an added layer of protection. This allows the
document owner to place the correct label (data classification) plus security attributes that could
set a timeframe on a document to limit viewing, provide the ability to revoke the document, andprevent the ability to print or forward on to another user. To achieve further data tracking andcontrol, organizations should implement a management system capable of tracking client/user
data as well.
Archival/Backup, Restoration, Recovery
If the organization had to start from scratch to recreate the network and digital files tomorrow,does the organization have what it takes? Nightly backups may not be frequent enough for realtime data gathering in a TMC environment. Many TMCs and business IT enterprises haverecognized that the loss of certain data sets is too critical to rely solely on nightly backups. For
some organizations, device configuration settings and maintenance/repair history changes
frequently enough that backing up the files every hour is an appropriate frequency, while forothers a nightly backup is sufficient. TMC incident logs, traffic sensor data, and dynamic
message sign logs/schedules are elements of operations that would suggest real-time replication
to a secondary database server, preferably in a separate physical location. TMCs also should
consider external users that rely on information published or transmitted by the TMC. Road
closure and incident status information are both real-time indicators that motorists and thirdparty mapping applications now routinely rely on, and that should have an appropriate level ofredundancy and frequency of backups.
Whether part of risk analysis, or a separate enterprise business impact analysis, TMCs should
determine the acceptable frequency of backup recovery points and recovery times to maintain48

Transportation Management Center Information Technology Security

continuity of operations based on organizational objectives. As previously discussed under
Incident Planning and Response, data restoration and recovery are key components of theincident response process. Doing so without continuing to compromise the network by restoringcorrupt or infected data, while also maintaining as much of the data as possible and limiting data
loss, is an equally important aspect of data recovery. Part of the response plan should include a
procedure to test the backups for existence of malware or other corruption before restoring
infected files and causing further issues. Maintaining at least one backup offsite is a techniqueused to isolate both the primary and the backup from being infected.
Step one in preparing for data restoration and recovery is data backup. Backup types include
mirror, full, incremental, and differential. Organizations should analyze the pros and cons ofeach type of backup to determine the best or most realistic backup schedule by type.
Organizations should strive for automated, routine data backup. Once a data backup schedule has
been determined, it is important to remember that backup data can quickly take up space on anorganization’s server and should be accounted for. An organization’s policies should include
requirements with respect to data backup retention and disposal. Much of this will stem from
regulation, legal requirements, or contractual obligations, such as PCI.
For the sake of organization efficiency, it is important that data recovery is also completed in atimely manner. As briefly indicated under Incident Planning and Response, organizations
should perform a Business Impact Analysis (BIA) prior to creating a Recovery Point Objective(RPO) and Recovery Time Objective (RTO)—the time it takes to restore data prior to thedisruption and the functional restoration of a business service post disruption—to ensure thathigher recovery priority is given to data with a higher impact on the organization’s functionality.
To verify backup system integrity without risking data loss, organizations should regularly test
the system’s backup and restoration process on a sample of data in a test bed environment. CIS
Control 10: Data Recovery Capabilities recommends performing such tests once per quarter, or
whenever new backup equipment is purchased, whichever comes first.
Bacula Systems provides additional information about data backup best practices, along with
examples with respect to labeling, schedules and retentions, partitioning, and recovery plans. 27
Personal Privacy Information Legislation
Personal information privacy continues to gain more widespread attention. The European Union(EU) established a law pertaining to general data protection regulation (GDPR) to govern thecontrol that individuals have over their personal data. Additionally, similar legislation passed in
the State of California called the California Consumer Privacy Act, which takes effect inJanuary 2020. There are groups lobbying/advocating for taking privacy legislation/initiatives to theFederal level. TMCs subject to these requirements should monitor the impacts of this legislation on
their own systems that contain personal information from dashboard users, 511 users, or othertraveler information systems at a minimum. Data from these users should be scrubbed from
27

Bacula Systems, “Enterprise Data Backup Best Practices (Prior to installation).” Retrieved
from: https://www.baculasystems.com/enterprise-data-backup-best-practices.
49

Transportation Management Center Information Technology Security

backups and protected from the Federal Information Processing Standards (FOIA) requests at aminimum. Many TMCs now get incident alerts/data from State and local police agencies. If thatdata has not been pre-sanitized to remove personal information before use in the TMC incident
management databases, then it should be sanitized by the TMC and scrubbed from archives/
backups as well. As noted above with respect to DLP, agencies should consider a category of data
related to personal privacy data that be screened or quickly isolated within the broader context of
the agency’s wide array of data.

50

Transportation Management Center Information Technology Security

CHAPTER 10. SHORT- AND LONG-TERM STRATEGIES FOR ADDRESSINGISSUES/GAPSThe Traffic Management Center (TMC) operators manage a large volume of data, which islargely real-time, whereby data losses have significant consequences for their organization as
well as others that rely on them. As part of the country’s critical infrastructure, TMCs need toassess and classify the criticality of the different datasets that are collected or generated within
the TMC as noted previously as a key step for determining steps for data loss prevention.
Additionally, TMC’s Operations Technology (OT) staff manage the configurations of networked
field appliances, which presents a challenge similar to those directly in the industrial controls(i.e., Supervisory Control and Data Acquisition (SCADA)) industry. Handling networked OT
equipment (e.g., sensors, signal controllers, message sign controllers, etc.) that does not follow
upgrade cycles at the same frequency as the Information Technology (IT) industry requires adifferent level of care than a traditional business data center to mitigate potential risks in a TMC.
TMCs also have exposure to insider vulnerabilities with respect to operators that are subject tosocial engineering attacks, poor cyber-hygiene, or simply no limitations on what data andcontrols that operators have access to. This is one of the reasons that approved message libraries
for dynamic message signs were established by many organizations to prevent rogue messages
being deployed by disgruntled operators and/or hackers that gainfully access the system.
When facing a large obstacle/challenge it can be daunting to know what part to tackle first.
Fortunately, the Center for Internet Security (CIS) Controls has been segmented into Basic,
Foundational, and Organizational controls of increasing complexity and sophistication. Equally,
the sub-controls are organized into implementation groups (1, 2, and 3) for prioritization fororganizations of increasing size and sophistication. Based on observations from industry data andresults from the questionnaires, in the short-term TMC operators should focus on implementing
all the Basic CIS Controls, along with Foundational Controls that address the greatest
vulnerabilities to the respective organization based on risk analysis.
It is recommended that agencies conduct a self-assessment, if one already has not been
performed, that can provide guidelines on which Foundational and Organizational controls are
the most critical to the organization. With that information in hand, the organization can use thepriorities within the CIS sub-controls to focus on the outcomes for the associated Implementation
Group for the areas of highest risk.
The Department of Homeland Security (DHS) has developed a self-assessment Cybersecurity
Resilience Review (CRR) tool based on the National Institute of Standards and Technology(NIST) for State, Local, and Tribal governments, and provides a performance measurement for
the individual completing the evaluation with respect to 10 categories based on responses to aseries of questions within each category. 28 A list of these categories is provided below,
connected to the associated CIS Controls for context. This assessment may be conducted as aself-assessment, or as an on-site assessment facilitated by DHS if preferred.
28

Department of Homeland Security (DHS), “Cyber Resilience Review (CRR): SelfAssessment Package,” 2016. Retrieved from: https://www.us-cert.gov/ccubedvp/assessments.
51

Transportation Management Center Information Technology Security

1. Asset Management:o CIS Control 1: Inventory and Control of Hardware Assets.
o CIS Control 2: Inventory and Control of Software Assets.
o CIS Control 4: Controlled Use of Administrative Privileges.
o CIS Control 9: Limitation and Control of Network Ports, Protocols and Services.
o CIS Control 12: Boundary Defense.
o CIS Control 13: Data Protection.
2. Controls Management:o CIS Control 4: Controlled Use of Administrative Privileges.
o CIS Control 9: Limitations and Control of Network Ports, Protocols and Services.
o CIS Control 14: Controlled Access Based on the Need to Know.
o CIS Control 15: Wireless Access Control.
o CIS Control 16: Account Monitoring and Control.
3. Configuration and Change Management:o CIS Control 4: Controlled Use of Administrative Privileges.
o CIS Control 5: Secure Configuration for Hardware and Software on Mobile Devices,
Laptops, Workstations and Servers.
o CIS Control 6: Maintenance, Monitoring and Analysis of Audit Logs.
o CIS Control 10: Data Recovery Capabilities.
o CIS Control 13: Data Protection.
o CIS Control 14: Controlled Access Based on the Need to Know.
4. Vulnerability Management:o CIS Control 3: Continuous Vulnerability Management.
o CIS Control 20: Penetration Tests and Red Team Exercises.
5. Incident Management:o CIS Control 6: Maintenance, Monitoring and Analysis of Audit Logs.
o CIS Control 19: Incident Response and Management.
6. Service Continuity Managemento CIS Control 19: Incident Response and Management.
7. Risk Management:o CIS Control 3: Continuous Vulnerability Management.
o CIS Control 6: Maintenance, Monitoring and Analysis of Audit Logs.
o CIS Control 7: Email and Web Browser Protections.
o CIS Control 8: Malware Defenses.
o CIS Control 9: Limitation and Control of Network Ports, Protocols and Services.
o CIS Control 11: Secure Configuration for Network Devices, such as Firewalls,
Routers and Switches.
o CIS Control 12: Boundary Defense.
o CIS Control 14: Controlled Access Based on the Need to Know.
52Transportation Management Center Information Technology Securityo CIS Control 16: Account Monitoring and Control.
o CIS Control 18: Application Software Security.
o CIS Control 20: Penetration Tests and Red Team Exercises.
8. External Dependencies Management:o CIS Control 3: Continuous Vulnerability Management.
o CIS Control 4: Controlled Use of Administrative Privileges.
o CIS Control 14: Controlled Access Based on the Need to Know.
o CIS Control 16: Account Monitoring and Control.
9. Training and Awareness:o CIS Control 17: Implementing a Security Awareness and Training Program.
10. Situational Awareness:o CIS Control 6: Maintenance, Monitoring and Analysis of Audit Logs.
o CIS Control 17: Implementing a Security Awareness and Training Program.
Within the Self-Assessment, agencies indicate whether recommended practices within each of
the above categories are not performed, incompletely performed, or performed.
Upon completion of the assessment, a report is generated summarizing the responses given.
Based on the responses to each question, scores are provided for individual Practices, Goals, andDomains.
•••

A Practice is associated with each question.
Goals are comprised of multiple associated Practices.
Each category listed above is associated with a Domain, which is comprised of multiple
associated Goals.

If all Practices within a Goal are indicated as performed, that Goal is achieved. If all Goals
within a Domain are performed, that Domain is achieved, and the agency is assigned a Maturity
Indicator Level (MIL1-MIL5 corresponding to 1-Performed, 2-Planned, 3-Managed, 4Measured, and 5-Defined, further defined in the appendix) for the Domain based on answers toquestions associated with Practices. For example, if all MIL1 Goals are achieved, the agency willachieve a Domain maturity level of MIL1. If additional maturity Goals are achieved, that agency
will achieve a higher maturing rating indicating a higher level of performance for that Domain. If
the agency does not achieve every Goal within a Domain and therefore achieve a Domain, they
are assigned a maturity score of MIL0 (incomplete). A sample response and associated reportresults for Domain 9 Training and Awareness can be found in the appendix.
Every organization should at the very least achieve MIL1 in the short-term. Ultimately, agencies
should strive to increase their maturity to MIL5 for the respective areas in their risk management
plan. The self-assessment can be considered both a report card of where the agency stands, and ameans to develop an action plan to address the areas having less management/maturity.

53

Transportation Management Center Information Technology Security

The report then provides information on how the assessment results connect to the NIST
Framework, along with options to consider helping agencies achieve goals they currently are not
performing along with references to the associated section within NIST to find additionalguidelines. Additionally, TMCs can then focus on the CIS Controls associated with each of these
Domain categories identified above. Implementation groups 2 and 3, will inherently have moreareas to focus on than implementation group 1.
In the long-term, TMCs are encouraged to embrace the remaining Foundational controls andincorporate Organizational Controls to document and memorialize procedures as the agency’s
capability matures toward a MIL5 level. Furthermore, to provide continuous vulnerability
assessment and protection, process improvement and refinement will need to continue and adapt
as the industry evolves.

54

Transportation Management Center Information Technology Security

CHAPTER 11. CONCLUSIONS AND NEXT STEPS
Throughout these guidelines, cybersecurity issues that are unique to the Traffic Management
Centers (TMC) Information Technology (IT) environment have been discussed, along withresources to assist with establishing a programmatic system to mitigate identified risks particular
to an agency’s TMC IT environment. The Center for Internet Security (CIS) Top 20 Controls
have been covered as the most relevant framework for the operations environment in TMCs.
Cybersecurity is not a one and done issue; it requires programmatic involvement on a recurring
basis.
Some agencies already will have a jumpstart on cybersecurity issues, while others may be closer
to starting from scratch when reading these guidelines. If an agency is starting from scratch, aRisk Analysis is recommended as the first step towards establishing a cybersecurity program for
the TMC. As noted in chapter 10, there are resources available online such as Department ofHomeland Security’s (DHS) self-assessment Cybersecurity Resilience Review (CRR) tool.
With an understanding of the risks that the TMC environment is exposed to, agencies can thenfocus on implementing CIS Controls to establish and maintain a program for continuing to
improve the resiliency of the TMC IT environment. The initial focus of the CIS Controls should
be to address the risks that pose the most immediate concerns based on the risk analysis. For
organizations that already have started embracing the National Institute of Standards andTechnology (NIST) Framework and are comfortable using that guidance, the CIS Controls
documented in these guidelines along with the cross-mapping tools by CIS can be helpful togauge how mature the organization is with respect to cybersecurity risk management for basic,
foundational, and organizational aspects.
In conjunction with addressing immediate risks from the Risk Analysis, TMC agencies will
benefit from developing a Risk Management Plan, as noted in chapter 9, to determine courses ofaction to mitigate and systematically manage those risks.
Part of increasing the cybersecurity maturity of an agency involves incrementally building amore robust process/program for resiliency by developing a Resiliency Plan to harden systems
and facilities to improve the ability to recover from an attack or breach.
TMC operations staff are encouraged to collaborate on the risk analysis with IT staff to establish
a program that addressed both perspectives for operations functionality while mitigating risks.
Developing a cooperative panel comprised of both perspectives has been noted to be beneficial
for organizations, especially in advance of incident response when power struggles have been
identified as more likely to occur, which then slows the recovery process. The cooperative panelof Operations Technology (OT) and IT staff should lead the charge on routinely testing andimproving the program to address existing and newly identified risks. The panel is encouraged toparticipate in/with peer groups (i.e., Information Sharing and Analysis Centers (ISAC) as notedin chapter 9) to share and learn from identified threats/risks within the TMC community to allow
all TMC operators to learn and benefit from the greater body of knowledge.

55

Transportation Management Center Information Technology Security

APPENDIX A. SAMPLE CYBERSECURITY RESILIENCE REVIEWSELF-ASSESSMENT
MATURITY INDICATOR LEVELS DEFINED
Maturity Indicator Levels (MIL) 29 are assigned by Domain and represent a consolidated view of
performance. CERT-RMM MILs describe attributes that would be indicative of maturecapabilities as represented in the model's capability levels. However, they do not fully represent
capability levels as defined because a capability level can only be assigned through a formal
appraisal process, not as the result of using an assessment-based instrument.
MIL0 Incomplete
Indicates that Practices in the Domain are not being performed as measured by responses to therelevant Cyber Resilience Review (CRR) questions. If MIL0 is assigned, no further assessmentof maturity indicator is performed.
MIL1 Performed
Indicates that all Practices in a Domain are being performed as measured by responses to therelevant CRR questions. MIL1 means that there is sufficient and substantial support for the
existence of the practices.
MIL2 Planned
Indicates that all Practices in Domain are not only performed, but are supported by sufficientplanning, stakeholders, and relevant standards and guidelines. A planned process/practice is:••••

Established by the organization (Is the practice documented and communicable to all who
need to know?).
Planned (Is the practice performed according to a documented plan?).
Supported by stakeholders (Are the stakeholders of the practice known and are theyaware of the practice and their role in the practice?).
Supported by relevant standards and guidelines (Have the standards and guidelines that
support the practice been identified and implemented?).

MIL3 Managed
Indicates that all Practices in a Domain are performed, planned, and have the basic infrastructure
in place to support the process. A managed process/practice:29

Department of Homeland Security (DHS), “Cyber Resilience Review (CRR): Self-Assessment
Package,” 2016. Retrieved from: https://www.us-cert.gov/ccubedvp/assessments.
57

Transportation Management Center Information Technology Security•

Is governed by the organization (Is the practice supported by policy and is there
appropriate oversight over the performance of the practice?).

•

Is appropriately staffed and funded (Are the staff and funds necessary to perform thepractice as intended available?).

•Is assigned to staff who are responsible and accountable for the performance of thepractice (Have staff been assigned to perform the practice and are they responsible andaccountable for the performance of the practice?).

•

Is performed by staff who are adequately trained to perform the practice (Are the staff
who perform the practice adequately skilled and trained to perform the practice?).

•

Produces work products that are expected from performance of the practice and areplaced under appropriate levels of configuration control (Does the practice produce
artifacts and work products that are expected from performing the practice, and if so, arethe configurations of these artifacts/work products managed?).

•Is managed for risk (Are risks related to the performance of the practice identified,analyzed, disposed of, monitored, and controlled?).

MIL4 Measured
Indicates that all Practices in a Domain are performed, planned, managed, monitored, andcontrolled. A measured process/practice is:•

Periodically evaluated for effectiveness (Is the practice periodically reviewed to ensurethat it is effective and producing intended results?).

•

Monitored and controlled (Are appropriate implementation and performance measures
identified, applied, and analyzed?).

•Objectively evaluated against its practice description and plan (Is the practiceperiodically evaluated to ensure that it adheres to the practice description and the plan forthe practice?).

•

Periodically reviewed with higher-level management (Is higher-level management awareof any issues related to the performance of the practice?).

MIL5 Defined
Indicates that all Practices in a Domain are performed, planned, managed, monitored, controlled,
and consistent across all internal constituencies who have a vested interest in the performance ofthe practice. A defined process/practice ensures that the organization reaps the benefits ofconsistent performance of the practice across organizational units and that all organizational

58

Transportation Management Center Information Technology Security

units can benefit from improvements realized in any organizational unit. At MIL5, aprocess/practice:•

Is defined by the organization and tailored by organizational units for their use (Is there
an organization-sponsored definition of the practice from which organizational units canderive practices that fit their unique operating circumstances?).

•Is supported by improvement information that is collected by and shared amongorganizational units for the overall benefit of the organization (Are practice
improvements documented and shared across internal constituencies so that the wholeorganization reaps benefits from these improvements?).

ASSESSMENT

59

Transportation Management Center Information Technology Security

60

Transportation Management Center Information Technology Security

RESULTS

61

Transportation Management Center Information Technology Security

APPENDIX B. CENTER FOR INTERNET SECURITY CONTROLS TO THE NATIONAL INSTITUTE OF STANDARDSAND TECHNOLOGY MAPPINGINVENTORY AND CONTROL OF HARDWARE ASSETS
Actively manage (inventory, track, and correct) all hardware devices on the network so that only authorized devices are given access,and unauthorized and unmanaged devices are found and prevented from gaining access.
CIS
Control
1

CIS SubControl
1.1

1

1.2

1

1.3

1

1.4

Table 2. Center for Internet Security control 1.
Security
Asset Type
Title
Description
NIST CSF
Subcategory Name
Function
Devices
Identify Utilize an Utilize an active discovery tool to
DE.CM-7 Monitoring for
Active identify devices connected to theunauthorized personnel,
connections, devices, andDiscovery organization's network and update theToolhardware asset inventory.
software is performed.
Devices
Identify
Use a Utilize a passive discovery tool to
DE.CM-7 Monitoring for
Passive identify devices connected to theunauthorized personnel,
Asset organization's network andconnections, devices, andDiscovery automatically update the organization's
software is performed.
Toolhardware asset inventory.
Devices
Identify
Use
Use Dynamic Host Configuration
DE.CM-7 Monitoring for
DHCP Protocol (DHCP) logging on all
unauthorized personnel,
Logging DHCP servers or IP addressconnections, devices, andto Update management tools to update thesoftware is performed.
Asset organization's hardware asset
Inventory inventory.
Devices
Identify Maintain Maintain an accurate and up-to-date
ID.AM-1 Physical devices andDetailed inventory of all technology assets withsystems within the
Asset the potential to store or processorganization are inventoried
Inventory information. This inventory shall
PR.DS-3 Assets are formally
include all hardware assets, whether
managed throughout
connected to the organization's
removal, transfers, andnetwork or not.
disposition.
63

Transportation Management Center Information Technology Security

CIS
Control
1

CIS SubControl
1.5

Asset
Type
Devices1

1.6

Devices1

1.7

Devices1

1.8

Devices

Table 2. Center for Internet Security control 1 (continuation).
Security
Title
Description
NIST CSF
Subcategory Name
Function
Identify
Maintain
Ensure that the hardware asset
PR.DS-3 Assets are formallyAssetinventory records the network
managed throughout
Inventory address, hardware address,
removal, transfers, andInformation machine name, data asset owner,
disposition.
and department for each asset andwhether the hardware asset has
been approved to connect to the
network.
RespondAddress
Ensure that unauthorized assets are PR.DS-3 Assets are formally
Unauthorized either removed from the network,
managed throughout
Assetsquarantined or the inventory isremoval, transfers, andupdated in a timely manner.
disposition.
Protect
Deploy Port Utilize port level access control,
PR.AC-1 Identities and credentials
Level Access following 802.1x standards, toare issued, managed,
Control
control which devices canverified, revoked, andauthenticate to the network. The
audited for authorized
authentication system shall be tied
devices, users andinto the hardware asset inventory
processes.
data to ensure only authorized
devices can connect to the
network.
Protect
Utilize Client Use client certificates to
PR.AC-6 Identities are proofed andCertificates to authenticate hardware assets
bound to credentials andAuthenticate connecting to the organization's
asserted in interactions.
Hardware trusted network.
Assets64

Transportation Management Center Information Technology Security

INVENTORY AND CONTROL OF SOFTWARE ASSETS
Actively manage (inventory, track, and correct) all software on the network so that only authorized software is installed and can
execute, and that unauthorized and unmanaged software is found and prevented from installation or execution.
CIS
Control
2

CIS SubAsset Type
Control
2.1
Applications

2

2.2

Applications

2

2.3

Applications

2

2.4

Applications

Table 3. Center for Internet Security control 2.
Security
NIST
Title
Description
Subcategory Name
Function
CSF
Identify
Maintain Maintain an up-to-date list of all
ID.AM-2 Software platforms andInventory of authorized software that is required inapplications within the
Authorized the enterprise for any businessorganization are
Software purpose on any business system.
inventoried.
Identify
EnsureEnsure that only software applications ID.AM-2 Software platforms andSoftware is or operating systems currently
applications within the
Supported supported by the software's vendor areorganization are
by Vendor added to the organization's authorized
inventoried.
software inventory. Unsupported
software should be tagged as
unsupported in the inventory system.
Identify
Utilize
Utilize software inventory tools
DE.CM-7 Monitoring for
Software throughout the organization tounauthorized personnel,
Inventory automate the documentation of allconnections, devices,
Tools
software on business systems.
and software is
performed.
Identify
Track
The software inventory system should ID.AM-2 Software platforms andSoftware track the name, version, publisher, andapplications within theInventory install date for all software, includingorganization are
Information operating systems authorized by theinventoried.
organization.

65

Transportation Management Center Information Technology Security

CIS
Control22

2

2

Table 3. Center for Internet Security control 2 (continuation).
CIS SubSecurity
NIST
Asset Type
Title
Description
Subcategory NameControl
Function
CSF
2.5
Applications
Identify
Integrate The software inventory system
ID.AM-1 Physical devices andSoftware should be tied into the hardware
systems within theandasset inventory so all devices andorganization are
inventoried.
Hardware associated software are tracked froma single location.
Asset
ID.AM-2 Software platforms andInventories
applications within theorganization are
inventoried.
2.6
Applications Respond
Address Ensure that unauthorized software is DE.CM-7 Monitoring forunapproved either removed or the inventory is
unauthorized personnel,
software updated in a timely mannerconnections, devices, andsoftware is performed.
2.7
Applications
Protect
Utilize
Utilize application whitelisting
PR.DS-6 Integrity checking
Application technology on all assets to ensure
mechanisms are used toverify software, firmware,Whitelisting that only authorized softwareand information integrity.
executes and all unauthorizedsoftware is blocked from executing DE.CM-7 Monitoring foron assets.
unauthorized personnel,
connections, devices, andsoftware is performed.
2.8
Applications
Protect
Implement The organization's application
PR.DS-6 Integrity checking
Application whitelisting software must ensure
mechanisms are used to
Whitelisting that only authorized software
verify software, firmware,of Libraries libraries (such as *.dll, *.ocx, *.so,and information integrity.
etc.) are allowed to load into aDE.CM-7 Monitoring forsystem process.
unauthorized personnel,
connections, devices, andsoftware is performed.

66

Transportation Management Center Information Technology Security

CIS
Control
2

2

Table 3. Center for Internet Security control 2 (continuation).
CIS SubSecurity
NIST
Asset Type
Title
Description
Subcategory NameControl
Function
CSF
2.9
Applications
Protect
Implement The organization's application
PR.DS-6 Integrity checking
Application whitelisting software must ensure
mechanisms are used toverify software, firmware,Whitelisting that only authorized, digitallyand information integrity.
of Scripts signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to DE.CM-7 Monitoring forrun on a system.
unauthorized personnel,
connections, devices, andsoftware is performed.
2.10
Applications
Protect Physically or Physically or logically segregated
Logically systems should be used to isolate
Segregate and run software that is requiredHigh Risk for business operations but incur
Applications higher risk for the organization.

67

Transportation Management Center Information Technology Security

CONTINUOUS VULNERABILITY MANAGEMENT
Continuously acquire, assess, and take action on new information in order to identify vulnerabilities, remediate, and minimize thewindow of opportunity for attackers.
CIS
Control
3

3

3

3

Table 4. Center for Internet Security control 3.
CIS SubSecurity
NIST
Asset Type
Title
Description
Subcategory NameControl
Function
CSF
3.1
Applications
DetectRun
Utilize an up-to-date Security Content
ID.RA-1 Asset vulnerabilities
Automated Automation Protocol (SCAP)-compliant
are identified anddocumented.
Vulnerability vulnerability scanning tool to
Scanning automatically scan all systems on the DE.CM-8 Vulnerability scans
network on a weekly or more frequentTools
are performed.
basis to identify all potential
vulnerabilities on the organization's
systems.
3.2
Applications
DetectPerform
Perform authenticated vulnerability
DE.CM-8 Vulnerability scans
Authenticated scanning with agents running locallyare performed.
Vulnerability on each system or with remote
Scanning scanners that are configured withelevated rights on the system being
tested.
3.3
Users
Protect
Protect
Use a dedicated account for
Dedicated authenticated vulnerability scans,
Assessment which should not be used for any otherAccounts administrative activities and should betied to specific machines at specific IP
addresses.
3.4
Applications Protect
DeployDeploy automated software update
Automated tools in order to ensure that the
Operating operating systems are running the
System Patch most recent security updates provided
Management by the software vendor.
Tools

68

Transportation Management Center Information Technology Security

CIS
Control
3

3

3

Table 4. Center for Internet Security control 3 (continuation).
CIS SubSecurity
NIST
Asset Type
Title
Description
Subcategory NameControl
Function
CSF
3.5
Applications Protect
DeployDeploy automated software update
Automated tools in order to ensure that third-party
Software software on all systems is running themost recent security updates provided
PatchManagement by the software vendor.
Tools
3.6
Applications RespondCompare Regularly compare the results from
Back-to-back back-to-back vulnerability scans toVulnerability verify that vulnerabilities have beenScans
remediated in a timely manner.
3.7
Applications Respond
Utilize a Utilize a risk-rating process to
RS.MI-3 Newly identified
Risk-rating prioritize the remediation ofvulnerabilities are
Process
discovered vulnerabilities.
mitigated or
documented as
accepted risks.
ID.RA-5 Threats,vulnerabilities,
likelihoods, andimpacts are used todetermine risk.
PR.IP-12 A vulnerability
management plan isdeveloped andimplemented.

69

Transportation Management Center Information Technology Security

CONTROLLED USE OF ADMINISTRATIVE PRIVILEGESThe processes and tools used to track/control/prevent/correct the use, assignment, and configuration of administrative privileges on
computers, networks, and applications.
CIS CIS SubControl Control
4
4.1

Asset
Type
Users

Security
Function
Detect

4

4.2

Users

Protect

4

4.3

Users

Protect

4

4.4

Users

Protect

Table 5. Center for Internet Security control 4.

NIST
Subcategory Name
CSF
Maintain
Use automated tools to inventory all
PR.AC-1 Identities and credentials are
Inventory of administrative accounts, including domain
issued, managed, verified,
Administrative and local accounts, to ensure that only
revoked, and audited for
Accounts authorized individuals have elevatedauthorized devices, users andprivileges.
processes.
ChangeBefore deploying any new asset, change all PR.AC-1 Identities and credentials are
Default
default passwords to have values consistentissued, managed, verified,
Passwords with administrative level accounts.
revoked, and audited forauthorized devices, users andprocesses.
Ensure the Use Ensure that all users with administrative
PR.AC-4 Access permissions andof Dedicated account access use a dedicated or
authorizations are managed,
incorporating the principles
Administrative secondary account for elevated activities.
Accounts This account should only be used forof least privilege andadministrative activities and not internet
separation of duties.
browsing, email, or similar activities.
Use Unique Where multi-factor authentication is not
Passwords supported (such as local administrator, root,or service accounts), accounts will use
passwords that are unique to that system.
Title

Description70Transportation Management Center Information Technology Security

CIS CIS Sub- Asset
Control Control Type
4
4.5
Users

4

4.6

Users

4

4.7

Users

4

4.8

Users

4

4.9

Users

Table 5. Center for Internet Security control 4 (continuation).
Security
NIST
Title
Description
Subcategory Name
Function
CSF
Protect
Use Multifactor Use multi-factor authentication and
PR.AC-7 Users, devices, and other
Authentication encrypted channels for all administrative
assets are authenticated (e.g.,single-factor, multi-factor)
for Allaccount access.
commensurate with the risk
Administrativeof the transaction (e.g.,
Accessindividuals’ security andprivacy risks and otherorganizational risks).
Protect Use of Dedicated Ensure administrators use a dedicatedMachines for All machine for all administrative tasks or tasks
Administrative requiring administrative access. This
Tasks
machine will be segmented from theorganization's primary network and not beallowed Internet access. This machine will
not be used for reading e-mail, composing
documents, or browsing the Internet.
Protect
Limit Access to Limit access to scripting tools (such as
PR.PT-3 The principle of least
Script Tools Microsoft PowerShell and Python) to only
functionality is incorporated
administrative or development users withby configuring systems to
the need to access those capabilities.
provide only essential
capabilities.
DetectLog and Alert on Configure systems to issue a log entry and DE.CM-7 Monitoring for unauthorized
Changes toalert when an account is added to or
personnel, connections,
Administrative removed from any group assigned
devices, and software isGroupadministrative privileges.
performed.
Membership
DetectLog and Alert on Configure systems to issue a log entry and DE.CM-7 Monitoring for unauthorized
Unsuccessful alert on unsuccessful logins to an
personnel, connections,
Administrative administrative account.
devices, and software is
Account Loginperformed.

71

Transportation Management Center Information Technology Security

SECURE CONFIGURATION FOR HARDWARE AND SOFTWARE ON MOBILE DEVICES, LAPTOPS,WORKSTATIONS, AND SERVERS
Establish, implement, and actively manage (track, report on, correct) the security configuration of mobile devices, laptops, servers,
and workstations using a rigorous configuration management and change control process in order to prevent attackers from
exploiting vulnerable services and settings.
CIS CIS SubSecurity
Asset Type
Control Control
Function
5
5.1
Applications Protect

55.2

Applications

Protect

55.3

Applications

Protect

Table 6. Center for Internet Security control 5.
Title

Description

Establish
Maintain documented, standard
Securesecurity configuration standards for all
Configurations authorized operating systems andsoftware.

Maintain
Maintain secure images or templates
Secure Images for all systems in the enterprise basedon the organization's approved
configuration standards. Any new
system deployment or existing systemthat becomes compromised should be
imaged using one of those images or
templates.
Securely Store Store the master images and templates
Master Images on securely configured servers,
validated with integrity monitoring
tools, to ensure that only authorizedchanges to the images are possible.

72

NIST
Subcategory Name
CSF
PR.IP-1 A baseline configuration of
information
technology/industrial control
systems is created andmaintained incorporating
security principles (e.g., conceptof least functionality).
PR.IP-1 A baseline configuration of
information
technology/industrial control
systems is created andmaintained incorporating
security principles (e.g., conceptof least functionality).
PR.IP-1 A baseline configuration of
information
technology/industrial control
systems is created andmaintained incorporating
security principles (e.g., conceptof least functionality).

Transportation Management Center Information Technology Security

Table 6. Center for Internet Security control 5 (continuation).
CIS CIS SubSecurity
NIST
Asset Type
Title
Description
Subcategory NameControl Control
Function
CSF
5
5.4
Applications Protect
DeployDeploy system configuration
Systemmanagement tools that will
Configuration automatically enforce and redeploy
Management configuration settings to systems at
Tools
regularly scheduled intervals.
5
5.5
Applications
DetectImplement Utilize a Security Content Automation DE.CM-8 Vulnerability scans are
Automated Protocol (SCAP)-compliant
performed.
Configuration configuration monitoring system to
Monitoring verify all security configuration
Systems
elements, catalog approved exceptions,and alert when unauthorized changes
occur.

73

Transportation Management Center Information Technology Security

MAINTENANCE, MONITORING, AND ANALYSIS OF AUDIT LOGS
Collect, manage, and analyze audit logs of events that could help detect, understand, or recover from an attack.
Table 7. Center for Internet Security control 6.

CIS
CIS Sub- Asset Security
Title
Description
Control Control
Type Function
6
6.1
Network Detect Utilize Three Use at least three synchronized time
Synchronized sources from which all servers andTime Sources network devices retrieve time
information on a regular basis so thattimestamps in logs are consistent.
6
6.2
Network Detect Activate audit Ensure that local logging has been
loggingenabled on all systems andnetworking devices.

NIST CSF

Subcategory Name

PR.PT-1

Audit/log records are
determined, documented,
implemented, and reviewed inaccordance with policy.
Event data are collected andcorrelated from multiple sources
and sensors.
Audit/log records are
determined, documented,
implemented, and reviewed inaccordance with policy.

DE.AE-3
6

6.3

Network

DetectEnableDetailed
Logging

6

6.4

Network

DetectEnsureadequate
storage forlogs

Enable system logging to include
detailed information such as an event
source, date, user, timestamp, source
addresses, destination addresses, andother useful elements.
Ensure that all systems that store logs
have adequate storage space for thelogs generated.

74

PR.PT-1

PR.DS-4

Adequate capacity to ensure
availability is maintained.

Transportation Management Center Information Technology Security

Table 7. Center for Internet Security control 6 (continuation).
CIS CIS Sub- Asset Security
NIST
Title
Description
Subcategory NameControl Control
Type Function
CSF
6
6.5
Network Detect
Central Log Ensure that appropriate logs are
PR.PT-1 Audit/log records are determined,
Management being aggregated to a central log
documented, implemented, andreviewed in accordance with policy.
management system for analysis
and review.
DE.AE-3 Event data are collected and correlated
from multiple sources and sensors.
6
6.6
Network Detect
DeployDeploy Security Information and DE.AE-3 Event data are collected and correlated
SIEM or Event Management (SIEM) or log
from multiple sources and sensors.
Log Analytic analytic tool for log correlation
tool
and analysis.
6
6.7
Network Detect
Regularly On a regular basis, review logs to DE.AE-3 Event data are collected and correlated
Review Logs identify anomalies or abnormal
from multiple sources and sensors.
events.
PR.PT-1 Audit/log records are determined,
documented, implemented, andreviewed in accordance with policy.
RS.AN-1 Notifications from detection systems
are investigated.
DE.AE-2 Detected events are analyzed tounderstand attack targets and methods.
6
6.8
Network Detect
Regularly On a regular basis, tune yourDE.AE-5 Incident alert thresholds are
Tune SIEM SIEM system to better identify
established.
actionable events and decrease
event noise.

75

Transportation Management Center Information Technology Security

EMAIL AND WEB BROWSER PROTECTIONSMinimize the attack surface and the opportunities for attackers to manipulate human behavior though their interaction with webbrowsers and email systems.
Table 8. Center for Internet Security control 7.
CIS CIS SubSecurity
NIST
Asset Type
Title
Description
Subcategory NameControl Control
Function
CSF
7
7.1
Applications Protect Ensure Use of Ensure that only fully supported web
PR.IP-1 A baseline configuration of
Only Fully browsers and email clients are allowed to
information
Supported execute in the organization, ideally only
technology/industrial control
Browsers and using the latest version of the browsers
systems is created andEmail Clients and email clients provided by the vendor.
maintained incorporating
security principles (e.g.,concept of least functionality).
7
7.2
Applications Protect
DisableUninstall or disable any unauthorized
PR.IP-1 A baseline configuration of
Unnecessary or browser or email client plugins or add-on
information
Unauthorized applications.
technology/industrial control
Browser orsystems is created andEmail Client
maintained incorporating
Plugins
security principles (e.g.,concept of least functionality).
7
7.3
Applications Protect
Limit Use of Ensure that only authorized scripting
PR.IP-1 A baseline configuration of
Scriptinglanguages are able to run in all web
information
Languages in browsers and email clients.
technology/industrial control
Web Browsers
systems is created andand Emailmaintained incorporating
Clients
security principles (e.g.,concept of least functionality).

76

Transportation Management Center Information Technology Security

Table 8. Center for Internet Security control 7 (continuation).
CIS CIS SubSecurity
NIST
Asset Type
Title
Description
Subcategory NameControl Control
Function
CSF
7
7.4
Network
Protect Maintain and Enforce network-based URL filters that DE.CM-7 Monitoring for unauthorized
Enforcelimit a system's ability to connect topersonnel, connections,
Network-Based websites not approved by thedevices, and software is
URL Filters organization. This filtering shall be
performed.
enforced for each of the organization's
systems, whether they are physically atan organization's facilities or not.
7
7.5
Network
Protect
Subscribe to Subscribe to URL categorization
DE.CM-7 Monitoring for unauthorized
URLservices to ensure that they are up to datepersonnel, connections,Categorization with the most recent website category
devices, and software isdefinitions available. Uncategorized sites
Serviceperformed.
shall be blocked by default.
7
7.6
Network
DetectLog all URL Log all URL requests from each of the DE.AE-3 Event data are aggregated andrequesterorganization's systems, whether on-sitecorrelated from multiple
or a mobile device, in order to identify
sources and sensors.
potentially malicious activity and assist
incident handlers with identifying
potentially compromised systems.
7
7.7
Network
Protect
Use of DNS Use Domain Name System (DNS)
DE.CM-1 The network is monitored toFilteringfiltering services to help block access todetect potential cybersecurity
events.
Services
known malicious domains.
DE.CM-7 Monitoring for unauthorized
personnel, connections,devices, and software is
performed.

77

Transportation Management Center Information Technology Security

Table 8. Center for Internet Security control 7 (continuation).
CIS CIS SubSecurity
NIST
Asset Type
Title
Description
Subcategory NameControl Control
Function
CSF
7
7.8
Network
Protect
Implement To lower the chance of spoofed or
PR.IP-1 A baseline configuration of
DMARC and modified emails from valid domains,
information
Enableimplement Domain-based Message
technology/industrial control
Receiver-Side Authentication, Reporting andsystems is created andVerification Conformance (DMARC) policy andmaintained incorporating
verification, starting by implementing thesecurity principles (e.g.,
Sender Policy Framework (SPF) and theconcept of least functionality).
Domain Keys Identified Mail (DKIM)
standards.
7
7.9
Network
Protect
Block
Block all e-mail attachments entering the DE.CM-7 Monitoring for unauthorized
Unnecessary organization's email gateway if the filepersonnel, connections,File Types types are unnecessary for thedevices, and software isorganization's business.
performed.
7
7.10
Network
Protect
Sandbox All Use sandboxing to analyze and block
DE.CM-4 Malicious code is detected.
Emailinbound email attachments with
Attachments malicious behavior.

78

Transportation Management Center Information Technology Security

MALWARE DEFENSES
Control the installation, spread, and execution of malicious code at multiple points in the enterprise, while optimizing the use of
automation to enable rapid updating of defense, data gathering, and corrective action.
CIS
Control
8

CIS SubControl
8.1

Asset
Type
Devices88.2

Devices88.3

Devices88.4

Devices

Table 9. Center for Internet Security control 8.
Security
Title
Description
FunctionProtect
Utilize
Utilize centrally managed antiCentrally
malware software to continuously
Managedmonitor and defend each of theAnti-Malware organization's workstations andSoftwareservers.
Protect
Ensure Anti- Ensure that the organization's antiMalware
malware software updates its
Software and scanning engine and signature
Signatures are database on a regular basis.
UpdatedProtect
EnableEnable anti-exploitation features
Operatingsuch as Data Execution
System Anti- Prevention (DEP) or Address
Exploitation Space Layout Randomization
Features/Depl (ASLR) that are available in an
oy Antioperating system or deploy
Exploitappropriate toolkits that can be
Technologies configured to apply protection to abroader set of applications andexecutables.
DetectConfigureConfigure devices so that theyAnti-Malware automatically conduct an antiScanning of malware scan of removable media
Removable
when inserted or connected.
Devices

79

NIST
CSF
DE.CM-4

Subcategory Name
Malicious code is
detected.

DE.CM-4

Malicious code is
detected.

PR.IP-1

A baseline
configuration of
information
technology/industrial
control systems iscreated and maintained
incorporating security
principles (e.g., conceptof least functionality).

DE.CM-4

Malicious code is
detected.

Transportation Management Center Information Technology Security

CIS
Control
8

CIS SubControl
8.5

Asset
Type
Devices8

8.6

Devices8

8.7

Network

Table 9. Center for Internet Security control 8 (continuation).
Security
NIST
Title
Description
Function
CSF
Protect
ConfigureConfigure devices to not auto-run
PR.PT-2
Devices Not content from removable media.
to Auto-Run
Content
DetectCentralize
Send all malware detection events DE.AE-3
Antito enterprise anti-malware
Malwareadministration tools and event log
Logging
servers for analysis and alerting.
DetectEnable DNS Enable DNS query logging to
DE.AE-3Querydetect hostname lookups for
Logging
known malicious domains.
DE.CM-18

8.8

Devices

DetectEnableCommandLine Audit
Logging

Enable command-line audit
logging for command shells, suchas Microsoft PowerShell and
Bash.

80

DE.AE-3

Subcategory Name
Removable media is
protected and its use
restricted according topolicy.
Event data are collected
and correlated frommultiple sources andsensors.
Event data are collected
and correlated frommultiple sources andsensors.
The network ismonitored to detect
potential cybersecurity
events.
Event data are collected
and correlated frommultiple sources andsensors.

Transportation Management Center Information Technology Security

LIMITATION AND CONTROL OF NETWORK PORTS, PROTOCOLS, AND SERVICESManage (track/control/correct) the ongoing operational use of ports, protocols, and services on networked devices in order tominimize windows of vulnerability available to attackers
CIS
CIS Sub- Asset Security
Control Control Type Function
99.1
Devices Identify

99.2

DevicesProtect

99.3

Devices

Detect99.4

DevicesProtect

99.5

DevicesProtect

Table 10. Center for Internet Security control 9.
NIST
Title
Description
Subcategory Name
CSF
Associate Associate active ports, services
Active Ports, and protocols to the hardware
Services and assets in the asset inventory.
Protocols to
Asset Inventory
Ensure Only Ensure that only network ports,
PR.IP-1 A baseline configuration of information
Approved protocols, and services listening ontechnology/industrial control systems is
Ports, Protocols a system with validated businesscreated and maintained incorporating
and Services needs are running on each system.
security principles (e.g., concept of least
Are Running
functionality).
Perform
Perform automated port scans on a DE.CM-8 Vulnerability scans are performed.
Regularregular basis against all systems
Automated Port and alert if unauthorized ports are
Scansdetected on a system.
Apply Host- Apply host-based firewalls or port PR.IP-1 A baseline configuration of information
Basedfiltering tools on end systems, withtechnology/industrial control systems is
Firewalls or a default-deny rule that drops all
created and maintained incorporating
Port Filtering traffic except those services andsecurity principles (e.g., concept of least
ports that are explicitly allowed.
functionality).
Implement Place application firewalls in front PR.IP-1 A baseline configuration of information
Application of any critical servers to verify andtechnology/industrial control systems is
Firewalls validate the traffic going to thecreated and maintained incorporating
server. Any unauthorized traffic
security principles (e.g., concept of least
should be blocked and logged.
functionality) systems to provide only
essential capabilities.

81Transportation Management Center Information Technology Security

DATA RECOVERY CAPABILITIESThe processes and tools used to properly back up critical information with a proven methodology for timely recovery of it.
CIS CIS Sub- Asset Security
Control Control Type Function
10
10.1
Data
Protect
10

10.2

Data

Protect

10

10.3

Data

Protect

10

10.4

Data

Protect

10

10.5

Data

Protect

Table 11. Center for Internet Security control 10.
Title

Description

NIST
Subcategory Name
CSF
PR.IP-4 Backups of information are
conducted, maintained, and tested.

Ensure Regular Ensure that all system data is
Automated
automatically backed up on a regular
BackUpsbasis.
Perform
Ensure that all of the organization's
PR.IP-4 Backups of information are
Completekey systems are backed up as aconducted, maintained, and tested.
System Backups complete system, through processes
such as imaging, to enable the quick
recovery of an entire system.
Test Data on Test data integrity on backup media
PR.DS-6 Integrity checking mechanisms are
Backup Media on a regular basis by performing aused to verify software, firmware,data restoration process to ensure thatand information integrity.
the backup is properly working.
PR.IP-4 Backups of information are
conducted, maintained, and tested.
EnsureEnsure that backups are properly
PR.DS-1 Data-at-rest is protected.
Protection of protected via physical security or
Backupsencryption when they are stored, as
well as when they are moved acrossthe network. This includes remote
backups and cloud services.
Ensure Backups Ensure that all backups have at least PR.DS-1 Data-at-rest is protected.
Have At least one backup destination that is not
PR.PT-5 Mechanisms (e.g., failsafe, load
One Noncontinuously addressable throughbalancing, hot swap) are
Continuously operating system calls.
implemented to achieve resilience
Addressable
requirements in normal and
Destination
adverse situations.

82

Transportation Management Center Information Technology Security

SECURE CONFIGURATION FOR NETWORK DEVICES, SUCH AS FIREWALLS, ROUTERS, AND SWITCHES
Establish, implement, and actively manage (track, report on, correct) the security configuration of network infrastructure devices
using a rigorous configuration management and change control process in order to prevent attackers from exploiting vulnerable
services and settings.
CIS
CIS SubControl Control
11
11.1

Asset
Type
Network

Security
Function
Identify

11

11.2

Network

Identify

11

11.3

Network

DetectTable 12. Center for Internet Security control 11.

NIST
Subcategory Name
CSF
Maintain
Maintain standard, documented
PR.IP-1 A baseline configuration ofStandard
security configuration standards for
information
Security
all authorized network devices.
technology/industrial control
Configurations
systems is created andfor Network
maintained incorporating
Devicessecurity principles (e.g.,concept of least functionality).
Document
All configuration rules that allow
ID.AM-3 Organizational
Traffic
traffic to flow through network
communication and data
Configuration devices should be documented in aflows are mapped.
Rules
configuration management systemwith a specific business reason foreach rule, a specific individual’s
name responsible for that business
need, and an expected duration of
the need.
Use Automated Compare all network device
PR.IP-3 Configuration change control
Tools to Verify configuration against approved
processes are in place.
Standard Device security configurations defined for DE.CM-8 Vulnerability scans are
Configurations each network device in use andperformed.
and Detect
alert when any deviations are
Changes
discovered.
Title

Description

83Transportation Management Center Information Technology Security

CIS
CIS Sub- Asset
Control Control
Type
11
11.4
Network

11

11.5

Network

11

11.6

Network

11

11.7

Network

Table 12. Center for Internet Security control 11 (continuation).
Security
NIST
Title
Description
Subcategory Name
Function
CSF
Protect Install the Latest Install the latest stable version of any
PR.IP-1 A baseline configuration of
Stable Version security-related updates on all network
informationof Anydevices.
technology/industrial control
Securitysystems is created andRelated Updates
maintained incorporatingon All Network
security principles (e.g.,
Devices
concept of least
functionality).
Protect
ManageManage all network devices using multi- PR.AC-7 Users, devices, and other
Networkfactor authentication and encrypted
assets are authenticated (e.g.,
Devices Using sessions.
single-factor, multifactor)
Multi-Factor
commensurate with the risk
Authenticationof the transaction (e.g.,
and Encryptedindividuals’ security andSessions
privacy risks and otherorganizational).
Protect Use Dedicated Ensure network engineers use a dedicated PR.AC-5 Network integrity is
Machines for machine for all administrative tasks orprotected (e.g., network
All Network tasks requiring elevated access. Thissegregation, network
Administrative machine shall be segmented from thesegmentation).
Tasks
organization's primary network and not beallowed Internet access. This machine shallnot be used for reading e-mail, composing
documents, or surfing the Internet.
Protect
ManageManage the network infrastructure across PR.AC-5 Network integrity is
Network
network connections that are separated
protected (e.g., network
Infrastructure from the business use of that network,
segregation, network
Through asegmentation).
relying on separate Virtual Local Access
Dedicated
Network (VLAN) or, preferably, on
Network
entirely different physical connectivity for
management sessions for network devices.

84

Transportation Management Center Information Technology Security

BOUNDARY DEFENSE
Detect/prevent/correct the flow of information transferring networks of different trust levels with a focus on security-damaging data.
CIS CIS Sub- Asset
Security
Control Control
Type Function
12
12.1
Network Identify

12

12.2

Network

Detect12

12.3

Network

Protect

1212.4

Network

Protect

Table 13. Center for Internet Security control 12.
Title

Description

Maintain an
Maintain an up-to-date inventory
Inventory of of all of the organization's
Network
network boundaries.
Boundaries
Scan for
Perform regular scans from
Unauthorized outside each trusted network
Connections boundary to detect any
across Trusted unauthorized connections which
Network
are accessible across theBoundaries
boundary.
Deny
Deny communications with
Communications known malicious or unusedwith Known Internet IP addresses and limit
Malicious IP access only to trusted andAddresses
necessary IP address ranges at
each of the organization's
network boundaries.

NIST
Subcategory Name
CSF
ID.AM-4 External information systems
are catalogued.

ID.AM-4 External information systems
are catalogued.
DE.CM-7 Monitoring for unauthorized
personnel, connections,devices, and software is
performed.
PR.IP-1 A baseline configuration of
information
technology/industrial control
systems is created andmaintained incorporating
security principles (e.g.,concept of least
functionality).
Deny
Deny communication over
PR.IP-1 A baseline configuration ofCommunication unauthorized TCP or UDP ports
information
overor application traffic to ensuretechnology/industrial control
Unauthorized that only authorized protocols are
systems is created andPortsallowed to cross the network
maintained incorporatingboundary in or out of the network
security principles (e.g.,
at each of the organization's
concept of least
network boundaries.
functionality).

85

Transportation Management Center Information Technology Security

CIS CIS Sub- Asset
Control Control
Type
12
12.5
Network

12

12.6

Network

12

12.7

Network

12

12.8

Network

Table 13. Center for Internet Security control 12 (continuation).
Security
NIST
Title
Description
Subcategory Name
Function
CSF
DetectConfigure Configure monitoring systems to
DE.CM-1 The network is monitored to
Monitoring record network packets passing
detect potential cybersecurity
Systems to through the boundary at each of theevents.
Recordorganization's network boundaries.
Network
Packets
DetectDeployDeploy network-based Intrusion
DE.CM-1 The network is monitored to
Network-Based Detection Systems (IDS) sensors todetect potential cybersecurity
IDS Sensors look for unusual attack mechanisms
events.
and detect compromise of thesesystems at each of theorganization's network boundaries.
Protect
DeployDeploy network-based Intrusion
DE.CM-1 The network is monitored to
Network-Based Prevention Systems (IPS) to blockdetect potential cybersecurity
malicious network traffic at each of
events.
Intrusion
Prevention the organization's network
Systemsboundaries.
DetectDeployEnable the collection of NetFlow
DE.CM-1 The network is monitored to
NetFlow
and logging data on all network
detect potential cybersecurity
Collection on boundary devices.
events.
Networking
Boundary
Devices86Transportation Management Center Information Technology Security

Table 13. Center for Internet Security control 12 (continuation).
CIS CIS Sub- Asset
Security
NIST
Title
Description
Subcategory NameControl Control
Type Function
CSF
12
12.9
Network Detect
DeployEnsure that all network traffic to or DE.CM-1 The network is monitored to
Application from the Internet passes through an
detect potential cybersecurity
Layer Filtering authenticated application layer
events.
Proxy Server proxy that is configured to filter
DE.CM-7 Monitoring for unauthorized
unauthorized connections.
personnel, connections,devices, and software is
performed.
12
12.10
Network Detect
Decrypt
Decrypt all encrypted network
DE.CM-1 The network is monitored to
Networktraffic at the boundary proxy priordetect potential cybersecurity
Traffic at
to analyzing the content. However,
eventsProxythe organization may use whitelists DE.CM-7 Monitoring for unauthorizedof allowed sites that can bepersonnel, connections,accessed through the proxy without
devices, and software isdecrypting the traffic.
performed.
12
12.11
Users
Protect
Require All Require all remote login access to
PR.AC-3 Remote access is managed.
Remote Login the organization's network to
to Use Multi- encrypt data in transit and use
Factormulti-factor authentication.
Authentication
12
12.12
Devices Protect
Manage All Scan all enterprise devices remotely PR.MA-2 Remote maintenance ofDeviceslogging into the organization'sorganizational assets is
Remotely
network prior to accessing theapproved, logged, andLogging into network to ensure that each of theperformed in a manner thatprevents unauthorized access.
Internalorganization's security policies has
Network
been enforced in the same manner PR.AC-3 Remote access is managed.
as local network devices.

87

Transportation Management Center Information Technology Security

DATA PROTECTION
The processes and tools used to prevent data exfiltration, mitigate the effects of exfiltrated data, and ensure the privacy and integrityof sensitive information.
CIS
CIS Sub- Asset
Control Control Type
13
13.1
Data

Security
Function
Identify

13

13.2

Data

Protect

13

13.3

Data

Detect

13

13.4

Data

Protect

Table 14. Center for Internet Security control 13.
Title

Description

Maintain an
Inventory of
Sensitive
Information

Maintain an inventory of allsensitive information stored,
processed, or transmitted by theorganization's technology systems,
including those located on-site or ata remote service provider.
Remove Sensitive Remove sensitive data or systems
Data or Systems not regularly accessed by the
Not Regularly organization from the network.
Accessed by These systems shall only be used as
Organization standalone systems (disconnectedfrom the network) by the business
unit needing to occasionally use thesystem or completely virtualized
and powered off until needed.
Monitor and Deploy an automated tool on
Block
network perimeters that monitors for
Unauthorized unauthorized transfer of sensitive
Network Traffic information and blocks suchtransfers while alerting information
security professionals.
Only Allow
Only allow access to authorized
Access tocloud storage or email providers.
Authorized Cloud
Storage or Email
Providers

88

NIST CSF

Subcategory Name

ID.AM-5 Resources (e.g., hardware,
devices, data, time, personnel,
and software) are prioritizedbased on their classification,
criticality, and business value.
PR.DS-3 Assets are formally managed
throughout removal, transfers,
and disposition.

PR.DS-5 Protections against data leaks
are implemented.

PR.DS-5 Protections against data leaks
are implemented.

Transportation Management Center Information Technology Security

CIS
CIS Sub- Asset
Control Control Type
13
13.5
Data

13

13.6

Data

13

13.7

Data

13

13.8

Data

13

13.9

Data

Table 14. Center for Internet Security control 13 (continuation).
Security
Title
Description
NIST CSF
Subcategory Name
Function
DetectMonitor and Monitor all traffic leaving theDE.CM-7 Monitoring for unauthorized
Detect Any organization and detect any
personnel, connections,
Unauthorized unauthorized use of encryption.
devices, and software is
Use ofperformed.
Encryption
Protect
Encrypt the Utilize approved whole disk
PR.DS-1 Data-at-rest is protected.
Hard Drive of encryption software to encrypt the
All Mobile hard drive of all mobile devices.
Devices.
Protect
Manage USB If USB storage devices are
PR.PT-2 Removable media is
Devicesrequired, enterprise software
protected and its use
should be used that can configure
restricted according tosystems to allow the use ofpolicy.
specific devices. An inventory ofsuch devices should bemaintained.
Protect
ManageConfigure systems not to write
PR.PT-2 Removable media is
System's
data to external removable media,
protected and its use
External
if there is no business need for
restricted according to
Removable supporting such devices.
policy.
Media's
Read/Write
Configurations
Protect Encrypt Data on If USB storage devices are
PR.PT-2 Removable media is
USB Storage required, all data stored on suchprotected and its use
Devices
restricted according todevices must be encrypted while atrest.
policy.

89

Transportation Management Center Information Technology Security

CONTROLLED ACCESS BASED ON THE NEED TO KNOW
The processes and tools used to track/control/prevent/correct secure access to critical assets (e.g., information, resources, systems)
according to the formal determination of which persons, computers, and applications have a need and right to access these criticalassets based on an approved classification.
CIS
Control
14

14

14

14

Table 15. Center for Internet Security control 14.
CIS Sub- Asset Security
Title
Description
ControlType Function
14.1
Network Protect
Segment the Segment the network based on the
Network Based label or classification level of theon Sensitivity information stored on the servers,
locate all sensitive information on
separated VLANs.
14.2
Network Protect Enable Firewall Enable firewall filtering between
Filtering
VLANs to ensure that only authorized
Betweensystems are able to communicate with
VLANs
other systems necessary to fulfill their
specific responsibilities.
14.3
Network Protect
DisableDisable all workstation to workstation
Workstation to communication to limit an attacker's
Workstation ability to move laterally andCommunication compromise neighboring systems,
through technologies such as Private
VLANs or micro segmentation.
14.4
Data
Protect
Encrypt All Encrypt all sensitive information in
Sensitive
transit.
Information inTransit90

NIST CSF

Subcategory Name

PR.AC-5

Network integrity is protected(e.g., network segregation,
network segmentation).

PR.AC-5

Network integrity is protected(e.g., network segregation,
network segmentation).

PR.AC-5

Network integrity is protected(e.g., network segregation,
network segmentation).

PR.DS-2

Data-in-transit is protected.

Transportation Management Center Information Technology Security

CIS
Control
14

CIS SubControl
14.5

Asset
Type
Data

14

14.6

Data

14

14.7

Data

14

14.8

Data

14

14.9

Data

Table 15. Center for Internet Security control 14 (continuation).
Security
Title
Description
NIST CSF
Subcategory Name
Function
DetectUtilize an
Utilize an active discovery tool to identify
Activeall sensitive information stored, processed,
Discovery Tool or transmitted by the organization's
to Identify technology systems, including those
Sensitive Data located on-site or at a remote service
provider, and update the organization's
sensitive information inventory.
Protect
Protect
Protect all information stored on systems
PR.AC-4 Access permissions andInformation with file system, network share, claims,
authorizations are managed,
through Access application, or database specific accessincorporating the principles ofControl Lists control lists. These controls will enforce
least privilege and separationof duties.
the principle that only authorizedindividuals should have access to theinformation based on their need to accessthe information as a part of their
responsibilities.
Protect Enforce Access Use an automated tool, such as host-based PR.DS-5 Protections against data leaks
Control to Data Data Loss Prevention, to enforce accessare implemented.
through
controls to data even when data is copied
Automated off a system.
Tools
Protect
Encrypt
Encrypt all sensitive information at rest
PR.DS-1 Data-at-rest is protected.
Sensitive
using a tool that requires a secondary
Information at authentication mechanism not integrated
Rest
into the operating system, in order toaccess the information.
DetectEnforce Detail Enforce detailed audit logging for accessPR.DS-6 Integrity checking
Logging for to sensitive data or changes to sensitive
mechanisms are used toAccess ordata (utilizing tools such as File Integrity
verify software, firmware,
Changes to Monitoring or Security Information andand information integrity.
Sensitive Data Event Monitoring).

91

Transportation Management Center Information Technology Security

WIRELESS ACCESS CONTROLThe processes and tools used to track/control/prevent/correct the security use of wireless local area networks (WLANs), access points,
and wireless client systems.
CIS CIS Sub- Asset Security
Control Control Type Function
15
15.1 Network Identify

15

15.2

Network

Detect15

15.3

Network

Detect15

15.4

DevicesProtect15

15.5

DevicesProtect

Table 16. Center for Internet Security control 15.
NIST
Title
Description
Subcategory Name
CSF
Maintain an
Maintain an inventory of
ID.AM-3 Organizational communication andInventory ofauthorized wireless accessdata flows are mapped.
Authorized
points connected to the wired
DE.AE-1 A baseline of network operations andWireless Access network.
expected data flows for users andPointssystems is established and managed.
Detect Wireless Configure network vulnerability DE.CM-7 Monitoring for unauthorized
Access Points
scanning tools to detect and alert
personnel, connections, devices, andConnected to the on unauthorized wireless accesssoftware is performed.
Wired Network points connected to the wired
network.
Use a Wireless Use a WIDS to detect and alert DE.CM-1 The network is monitored to detect
Intrusion Detection on unauthorized wireless accesspotential cybersecurity events.
System (WIDS) points connected to the network.
Disable Wireless Disable wireless access on
PR.IP-1 A baseline configuration ofAccess on Devices devices that do not have ainformation technology/industrial
if Not Required business purpose for wirelesscontrol systems is created andaccess.
maintained incorporating security
principles (e.g., concept of least
functionality).
Limit Wireless Configure wireless access on
PR.IP-1 A baseline configuration ofAccess on Client client machines that do have an
information technology/industrial
Devicesessential wireless business
control systems is created andpurpose, to allow access only tomaintained incorporating security
authorized wireless networks
principles (e.g., concept of leastand to restrict access to otherfunctionality).
wireless networks.

92

Transportation Management Center Information Technology Security

Table 16. Center for Internet Security control 15 (continuation).
CIS CIS Sub- Asset Security
NIST
Title
Description
Subcategory NameControl Control
Type Function
CSF
15
15.6
Devices Protect Disable Peer-to- Disable peer-to-peer (ad hoc)
PR.IP-1 A baseline configuration ofPeer Wireless wireless network capabilities on
information technology/industrial
Network
wireless clients.
control systems is created andCapabilities onmaintained incorporating security
Wireless Clients
principles (e.g., concept of least
functionality).
15
15.7
Network Protect
Leverage the Leverage the Advanced
PR.DS-2 Data-in-transit is protected.
Advanced
Encryption Standard (AES) to
Encryption
encrypt wireless data in transit.
Standard (AES)
to Encrypt
Wireless Data15
15.8
Network Protect
Use Wireless Ensure that wireless networks
PR.AC-7 Users, devices, and other assets are
Authentication use authentication protocols such
authenticated (e.g., single-factor,
Protocols that as Extensible Authentication
multifactor) commensurate with theRequire Mutual, Protocol-Transport Layer
risk of the transaction (e.g.,
Multi-Factor Security (EAP/TLS), which
individuals’ security and privacy
Authentication requires mutual, multi-factor
risks and other organizational risks).
authentication.
15
15.9
Devices Protect Disable Wireless Disable wireless peripheral
PR.IP-1 A baseline configuration ofPeripheral
access of devices (such as
information technology/industrial
Access ofBluetooth and NFC), unless suchcontrol systems is created andDevices
access is required for a businessmaintained incorporating security
purpose.
principles (e.g., concept of least
functionality).
15
15.10
Network Protect Create Separate Create a separate wirelessPR.AC-5 Network integrity is protected (e.g.,
Wireless
network for personal or untrusted
network segregation, network
Network for devices. Enterprise access fromsegmentation).
Personal and this network should be treated as
untrusted and filtered and audited
Untrusted
Devicesaccordingly.

93Transportation Management Center Information Technology Security

ACCOUNT MONITORING AND CONTROL
Actively manage the life cycle of system and application accounts—their creation, use, dormancy, deletion—in order to minimize
opportunities for attackers to leverage them.
CIS
CIS Sub- Asset
Control Control Type
16
16.1
Users

Security
Function
Identify

16

16.2

Users

Protect

16

16.3

Users

Protect

16

16.4

Users

Protect

16

16.5

Users

Protect

Table 17. Center for Internet Security control 16.

NIST
Subcategory Name
CSF
Maintain an Maintain an inventory of each of the PR.AC-1 Identities and credentials are
Inventory of organization's authentication systems,
issued, managed, verified,
Authentication including those located on-site or at a
revoked, and audited forremote service provider.
Systems
authorized devices, users andprocesses.
ConfigureConfigure access for all accounts
Centralized through as few centralized points ofPoint ofauthentication as possible, including
Authentication network, security, and cloud systems.
Require Multi- Require multi-factor authentication
PR.AC-7 Users, devices, and other assets
Factorfor all user accounts, on all systems,
are authenticated (e.g., singleAuthentication whether managed on-site or by afactor, multi-factor)
third-party provider.
commensurate with the risk of thetransaction (e.g., individuals’
security and privacy risks andother organizational risks).
Encrypt or Encrypt or hash with a salt all
PR.AC-1 Identities and credentials are
Hash allauthentication credentials whenissued, managed, verified,
Authentication stored.
revoked, and audited for
Credentials
authorized devices, users andprocesses.
Encrypt
Ensure that all account usernames
PR.DS-2 Data-in-transit is protected.
Transmittal of and authentication credentials are
Username and transmitted across networks using
Authentication encrypted channels.
Credentials
Title

Description

94

Transportation Management Center Information Technology Security

CIS CIS Sub- Asset
Control Control Type
16
16.6
Users

16

16.7

Users

16

16.8

Users

16

16.9

Users

16

16.10

Users

Table 17. Center for Internet Security control 16 (continuation).
Security
NIST
Title
Description
Subcategory Name
Function
CSF
Identify
Maintain an Maintain an inventory of all accounts PR.AC-1 Identities and credentials are
Inventory of organized by authentication system.
issued, managed, verified,Accounts
revoked, and audited forauthorized devices, users andprocesses.
Protect
Establish
Establish and follow an automatedPR.AC-1 Identities and credentials are
Process for process for revoking system accessissued, managed, verified,
Revokingby disabling accounts immediately
revoked, and audited forAccessupon termination or change ofauthorized devices, users andprocesses.
responsibilities of an employee orcontractor. Disabling these accounts, PR.IP-11 Cybersecurity is included in
instead of deleting accounts, allows
human resources practices (e.g.,preservation of audit trails.
deprovisioning, personnel
screening).
RespondDisable Any Disable any account that cannot be
PR.AC-1 Identities and credentials are
Unassociated associated with a business process or
issued, managed, verified,Accounts
business owner.
revoked, and audited forauthorized devices, users andprocesses.
RespondDisableAutomatically disable dormant
PR.AC-1 Identities and credentials are
Dormant
accounts after a set period ofissued, managed, verified,Accounts
inactivity.
revoked, and audited forauthorized devices, users andprocesses.
Protect
Ensure All Ensure that all accounts have an
PR.AC-1 Identities and credentials are
Accounts Have expiration date that is monitored andissued, managed, verified,an Expiration enforced.
revoked, and audited forDateauthorized devices, users andprocesses.

95

Transportation Management Center Information Technology Security

Table 17. Center for Internet Security control 16 (continuation).
CIS
CIS Sub- Asset Security
NIST
Title
Description
Control Control Type Function
CSF
16
16.11
Users Protect
Lock
Automatically lock workstation
PR.IP-1
Workstation sessions after a standard period of
Sessions After inactivity.
Inactivity
16

16.12

Users

Detect

16

16.13

Users

DetectSubcategory Name

A baseline configuration of
information technology/industrial
control systems is created andmaintained incorporating security
principles (e.g., concept of least
functionality).
DE.CM-3 Personnel activity is monitored todetect potential cybersecurity
events.

MonitorMonitor attempts to accessAttempts to deactivated accounts through audit
Accesslogging.
DeactivatedAccounts
Alert on
Alert when users deviate from
DE.CM-3 Personnel activity is monitored to
Account Login normal login behavior, such as timedetect potential cybersecurity
Behavior
of-day, workstation location andevents.
Deviation
duration.

96

Transportation Management Center Information Technology Security

IMPLEMENT A SECURITY AWARENESS AND TRAINING PROGRAM
For all functional roles in the organization (prioritizing those mission-critical to the business and its security), identify the specificknowledge, skills and abilities needed to support defense of the enterprise; develop and execute an integrated plan to assess, identify
gaps, and remediate through policy, organizational planning, training, and awareness programs.
CIS CIS Sub- Asset
Control Control Type
17
17.1
N/A

Security
Function
N/A

17

17.2

N/A

N/A

17

17.3

N/A

N/A

Table 18. Center for Internet Security control 17.
Title

Description

NIST
CSF

Subcategory Name

Perform a Perform a skills gap analysis to understand
Skills Gap the skills and behaviors workforce
Analysis members are not adhering to, using thisinformation to build a baseline education
roadmap.
Deliver Deliver training to address the skills gap
PR.AT-5 Physical and cybersecurity
Training to identified to positively impact workforce
personnel understand their roles
and responsibilities.
Fill the members' security behavior.
Skills Gap
PR.AT-4 Senior executives understand theirroles and responsibilities.
PR.AT-3 Third-party stakeholders (e.g.,
suppliers, customers, partners)
understand their roles andresponsibilities.
PR.AT-2 Privileged users understand theirroles and responsibilities.
PR.AT-1 All users are informed and trained.
Implement a Create a security awareness program for all PR.AT-1 All users are informed and trained.
Security workforce members to complete on a
ID.AM-6 Cybersecurity roles andAwareness regular basis to ensure they understand andresponsibilities for the entire
Program exhibit the necessary behaviors and skills toworkforce and third-party
help ensure the security of the organization.
stakeholders (e.g., suppliers,
The organization's security awarenesscustomers, partners) areprogram should be communicated in aestablished.
continuous and engaging manner.

97

Transportation Management Center Information Technology Security

Table 18. Center for Internet Security control 17 (continuation).
CIS CIS Sub- Asset Security
NIST
Title
Description
Subcategory NameControl Control Type Function
CSF
17
17.4
N/A
N/A
UpdateEnsure that the organization's security
Awareness awareness program is updated
Content
frequently (at least annually) to address
Frequently new technologies, threats, standards andbusiness requirements.
17
17.5
N/A
N/A
Train
Train workforce members on the
PR.AT-1 All users are informed and trained.
Workforce on importance of enabling and utilizing
Securesecure authentication.
Authentication
17
17.6
N/A
N/A
Train
Train the workforce on how to identify PR.AT-1 All users are informed and trained.
Workforce on different forms of social engineering
Identifying attacks, such as phishing, phone scams
Socialand impersonation calls.
Engineering
Attacks
17
17.7
N/A
N/A
Train
Train workforce on how to identify and PR.AT-1 All users are informed and trained.
Workforce on properly store, transfer, archive andSensitive Data destroy sensitive information.
Handling
17
17.8
N/A
N/A
Train
Train workforce members to be aware PR.AT-1 All users are informed and trained.
Workforce on of causes for unintentional data
Causes of exposures, such as losing their mobile
Unintentional devices or emailing the wrong person
Data Exposure due to autocomplete in email.
17
17.9
N/A
N/A
Train
Train employees to be able to identify PR.AT-1 All users are informed and trained.
Workforce the most common indicators of an
Members on incident and be able to report such an
Identifying incident.
and Reporting
Incidents98Transportation Management Center Information Technology Security

APPLICATION SOFTWARE SECURITY
Manage the security life cycle of all in-house developed and acquired software in order to prevent, detect, and correct security
weaknesses.
CIS
CIS Sub- Asset Security
Control Control Type Function
18
18.1
N/A
N/A

18

18.2

N/A

N/A

18

18.3

N/A

N/A

18

18.4

N/A

N/A

18

18.5

N/A

N/A

Table 19. Center for Internet Security control 18.
Title

Description

NIST
CSF

Subcategory Name

Establish
Establish secure coding practices
Secure Coding appropriate to the programming language
Practicesand development environment being
used.
Ensure Explicit For in-house developed software, ensure
Error Checking that explicit error checking is performed
is Performed for and documented for all input, including
All In-House for size, data type, and acceptable ranges
Developed or formats.
SoftwareVerify That Verify that the version of all software
Acquiredacquired from outside your organization
Software is Still is still supported by the developer or
Supported
appropriately hardened based on
developer security recommendations.
Only Use Up to Only use up-to-date and trusted thirdDate andparty components for the software
Trusted Third- developed by the organization.
Party
Components
Use Only
Use only standardized and extensively
PR.DS-1 Data-at-rest is protected.
Standardized reviewed encryption algorithms.
PR.DS-2 Data-in-transit isand Extensively
protected.
Reviewed
Encryption
Algorithms

99

Transportation Management Center Information Technology Security

Table 19. Center for Internet Security control 18 (continuation).
CIS
CIS Sub- Asset Security
NIST
Title
Description
Subcategory NameControl Control Type Function
CSF
18
18.6
N/A
N/A
EnsureEnsure that all software development personnel
Softwarereceive training in how to write secure code forDevelopment their specific development environment andPersonnel are responsibilities.
Trained in
Secure Coding
18
18.7
N/A
N/A
Apply Static Apply static and dynamic analysis tools toand Dynamic verify that secure coding practices are being
Code Analysis adhered to for internally developed software.
Tools
18
18.8
N/A
N/A
Establish a Establish a process to accept and address
RS.AN-5 Processes are
Process toreports of software vulnerabilities, including
established to receive,
Accept and providing a means for external entities toanalyze and respond to
Address
contact your security group.
vulnerabilities disclosed
to the organization from
Reports ofinternal and external
Softwaresources (e.g., internal
Vulnerabilities
testing, security
bulletins, or security
researchers).
18
18.9
N/A
N/A
Separate
Maintain separate environments for production PR.DS-7 The development andProduction and and non-production systems. Developers
testing environment(s)Non-Production should not have unmonitored access toare separate from the
Systems
production environments.
production
environment.

100

Transportation Management Center Information Technology Security

Table 19. Center for Internet Security control 18 (continuation).
CIS
CIS Sub- Asset Security
NIST
Title
Description
Subcategory NameControl Control Type Function
CSF
18
18.10
N/A
N/A
Deploy Web Protect web applications by deploying WAFs
Application that inspect all traffic flowing to the web
Firewalls
application for common web application(WAF)
attacks. For applications that are not webbased, specific application firewalls should be
deployed if such tools are available for the
given application type. If the traffic isencrypted, the device should either sit behindthe encryption or be capable of decrypting thetraffic prior to analysis. If neither option isappropriate, a host-based web application
firewall should be deployed.
18
18.11
N/A
N/A
Use Standard For applications that rely on a database, use
PR.IP-1 A baseline
Hardening standard hardening configuration templates. All
configuration ofConfiguration systems that are part of critical businessinformation
Templates for processes should also be tested.
technology/industrial
Databases
control systems iscreated and maintained
incorporating security
principles (e.g., conceptof least functionality).

101

Transportation Management Center Information Technology Security

INCIDENT RESPONSE AND MANAGEMENT
Protect the organization's information, as well as its reputation, by developing and implementing an incident response infrastructure(e.g., plans, defined roles, training, communications, management oversight) for quickly discovering an attack and then effectively
containing the damage, eradicating the attacker's presence, and restoring the integrity of the network and systems.
CIS CIS SubControl Control
19
19.1

19

19.2

Asset
Type
N/A

Security
Function
N/A

N/A

N/A

Table 20. Center for Internet Security control 19.
Title
Document
Incident
Response
Procedures
Assign Job
Titles andDuties for
Incident
Response

NIST
Subcategory Name
CSF
Ensure that there are written incident
PR.IP-9 Response plans (Incident
response plans that define roles of
Response and Businesspersonnel as well as phases of incident
Continuity) and recovery plans
handling/management.
(Incident Recovery and Disaster
Recovery) are in place andmanaged.
Assign job titles and duties for handling PR.IP-9 Response plans (Incident
computer and network incidents to
Response and Businessspecific individuals and ensure tracking
Continuity) and recovery plansand documentation throughout the(Incident Recovery and Disaster
incident through resolution.
Recovery) are in place andmanaged.
ID.GV-2 Cybersecurity roles andresponsibilities are coordinatedand aligned with internal roles
and external partners.
RS.CO-1 Personnel know their roles andorder of operations when a
response is needed.
DE.DP-1 Roles and responsibilities for
detection are well defined toensure accountability.
Description

102

Transportation Management Center Information Technology Security

CIS CIS Sub- Asset
Control Control Type
19
19.3
N/A

19

19.4

N/A

19

19.5

N/A

Table 20. Center for Internet Security control 19 (continuation).
Security
NIST
Title
Description
Subcategory Name
Function
CSF
N/A
Designate
Designate management personnel, as
PR.IP-9 Response plans (IncidentManagement well as backups, who will support the
Response and Business
Personnel to incident handling process by acting inContinuity) and recovery plans
Support Incident key decision-making roles.
(Incident Recovery and Disaster
Handling
Recovery) are in place andmanaged.
DE.DP-1 Roles and responsibilities for
detection are well defined toensure accountability.
N/A
DeviseDevise organization-wide standards for RS.CO-2 Incidents are reported consistent
Organization- the time required for systemwith established criteria.
wide Standards administrators and other workforce
for Reporting members to report anomalous events to
Incidents
the incident handling team, themechanisms for such reporting, and thekind of information that should be
included in the incident notification.
N/A
Maintain
Assemble and maintain information on ID.SC-5 Response and recovery planning
Contact
third-party contact information to be
and testing are conducted with
Information for used to report a security incident, suchsuppliers and third-party
Reportingas Law Enforcement, relevant
providers.
Security
government departments, vendors, andIncidents
Information Sharing and Analysis
Centers (ISAC) partners.

103

Transportation Management Center Information Technology Security

Table 20. Center for Internet Security control 19 (continuation).
CIS CIS Sub- Asset Security
NIST
Title
Description
Subcategory NameControl Control Type Function
CSF
19
19.6
N/A
N/A
PublishPublish information for all workforce
DE.DP-4 Event detection information
Information members, regarding reporting computer
is communicated.
Regarding anomalies and incidents to the incident
RS.CO-4 Coordination with
Reportinghandling team. Such information should be
stakeholders occurs
Computerincluded in routine employee awarenessconsistent with response
Anomalies and activities.
plans.
Incidents
19
19.7
N/A
N/A
Conduct
Plan and conduct routine incident, response PR.IP-10 Response and recovery
Periodic
exercises and scenarios for the workforce
plans are tested.
Incident
involved in the incident response to maintain
Scenarioawareness and comfort in responding to real
Sessions for world threats. Exercises should test
Personnel
communication channels, decision making,and incident responders technical capabilities
using tools and data available to them.
19
19.8
N/A
N/A
Create Incident Create incident scoring and prioritization
RS.AN-4 Incidents are categorized
Scoring and schema based on known or potential impact
consistent with response
Prioritization to your organization. Utilize score to defineplans.
Schemafrequency of status updates and escalation
procedures.

104

Transportation Management Center Information Technology Security

PENETRATION TESTS AND RED TEAM EXERCISES
Test the overall strength of an organization's defense (the technology, the processes, and the people) by simulating the objectives andactions of an attacker.
CIS CIS SubControl Control
20
20.1

Asset
Type
N/A

Security
Function
N/A

20

20.2

N/A

N/A

20

20.3

N/A

N/A

20

20.4

N/A

N/A

Table 21. Center for Internet Security control 20.
Title

Description

Establish a Establish a program for penetration tests that
Penetration includes a full scope of blended attacks,
Testingsuch as wireless, client-based, and web
Programapplication attacks.
Conduct
Conduct regular external and internal
Regularpenetration tests to identify vulnerabilities
External and and attack vectors that can be used to exploit
enterprise systems successfully.
Internal
Penetration
Tests
Perform
Perform periodic Red Team exercises to test
Periodic Red organizational readiness to identify and stopTeam
attacks or to respond quickly andExercises effectively.
Include Tests Include tests for the presence of unprotected
for Presence system information and artifacts that wouldofbe useful to attackers, including network
Unprotected diagrams, configuration files, older
Systempenetration test reports, e-mails or
Information documents containing passwords or otherand Artifacts information critical to system operation.

105

NIST
CSF

Subcategory NameTransportation Management Center Information Technology Security

CIS CIS SubControl Control
20
20.5

Asset
Type
N/A

20

20.6

N/A

20

20.7

N/A

20

20.8

N/A

Table 21. Center for Internet Security control 20 (continuation).
Security
NIST
Title
Description
Subcategory Name
Function
CSF
N/A
Create Test Create a test bed that mimics a production
Bed forenvironment for specific penetration tests
Elements Not and Red Team attacks against elements that
Typically are not typically tested in production, such
Tested in as attacks against supervisory control and
Production data acquisition and other control systems.
N/A
Use
Use vulnerability scanning and penetration
Vulnerability testing tools in concert. The results of
Scanning and vulnerability scanning assessments should
Penetration be used as a starting point to guide and focus
Testing Tools penetration testing efforts.
in Concert
N/A
EnsureWherever possible, ensure that Red Team
Results from results are documented using open,
Penetration machine-readable standards (e.g., SCAP).
Test areDevise a scoring method for determining theDocumented results of Red Team exercises so that results
Using Open, can be compared over time.
Machinereadable
Standards
N/A
Control and Any user or system accounts used toPR.AC-1 Identities and credentials
Monitorperform penetration testing should be
are issued, managed,
Accounts controlled and monitored to make sure they
verified, revoked, andAssociated are only being used for legitimate purposes,
audited for authorized
withand are removed or restored to normal
devices, users andPenetration function after testing is over.
processes.
Testing106

Transportation Management Center Information Technology Security

APPENDIX C: REFERENCES
Center for Internet Security (CIS), “CIS Controls V7.1 Mapping to NIST CSF.” Retrieved from:https://www.cisecurity.org/white-papers/cis-controls-v7-1-mapping-to-nist-csf/
Center for Internet Security (CIS), “CIS Controls Version 7.1,” 2019. Retrieved from:https://www.cisecurity.org/controls/
Department of Homeland Security (DHS), “Critical Infrastructure Sectors,” 2013. Retrieved
from: https://www.dhs.gov/cisa/critical-infrastructure-sectors
Department of Homeland Security (DHS), “Cyber Resilience Review (CRR): NIST
Cybersecurity Framework Crosswalks,” 2016. Retrieved from: https://www.uscert.gov/sites/default/files/c3vp/csc-crr-nist-framework-crosswalk.pdf
Department of Homeland Security (DHS), “Cyber Security Procurement Language for Control
Systems,” 2009. Retrieved from: https://ics-cert.uscert.gov/sites/default/files/documents/Procurement_Language_Rev4_100809_S508C.pdf
NIST, “FIPS 199 Standards for Security Categorization of Federal Information and Information
Systems,” 2004. Retrieved from: https://csrc.nist.gov/publications/detail/fips/199/final
NIST, “Risk Management Framework for Information Systems and Organizations,” October
2018. Retrieved from: https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/archive/2017-0928
NIST, “SP 800-37 Rev. 2 Guide for Applying the Risk Management Framework to Federal
Information Systems: A Security Life Cycle Approach,” 2018. Retrieved from:https://csrc.nist.gov/publications/detail/sp/800-37/rev-1/final
NIST, “SP 800-53 Rev. 4 Security and Privacy Controls for Federal Information Systems andOrganizations,” 2015. Retrieved from: https://csrc.nist.gov/publications/detail/sp/800-53/rev4/final
NIST, “SP 800-53A Rev. 4 Assessing Security and Privacy Controls in Federal Information
Systems and Organizations: Building Effective Assessment Plans,” 2014. Retrieved from:https://csrc.nist.gov/publications/detail/sp/800-53a/rev-4/final
NIST, “SP 800-82 Rev. 2 Guide to Industrial Control Systems (ICS) Security,” 2015. Retrieved
from: https://csrc.nist.gov/publications/detail/sp/800-82/rev-2/final
NIST, “SP 800-144 Guidelines on Security and Privacy in Public Cloud Computing,” 2011.
Retrieved from: https://csrc.nist.gov/publications/detail/sp/800-144/final

107

Steven VanRoekel, Executive Office of the President “Security Authorization of Information
Systems in Cloud Computing Environments Memorandum,” 2011. Retrieved from:https://www.fedramp.gov/assets/resources/documents/FedRAMP_Policy_Memo.pdf
TWiki, “NIST Cloud Computing Collaboration Site.” Retrieved from:https://collaborate.nist.gov/twiki-cloud-computing/bin/view/CloudComputing/CloudSecurity
Wiki, “List of TCP and UDP port numbers.” Retrieved from:https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

U.S. Department of Transportation
Federal Highway Administration
Office of Operations
1200 New Jersey Avenue, SE
Washington, DC 20590
https://ops.fhwa.dot.gov
September 2019
FHWA-HOP-19-059