FY2017 PROPOSED BUDGET

Washington Metropolitan Area Transit Authority
Proposed FY2017 Budget
Chapter 3
Web filtering services for WMATA’s network has been enhanced to web security via group-based
web browsing policies with user repository integration. Advanced SSL decryption allows for the
protection for access to specific web sites while decrypting and inspecting traffic from unknown
entities. Bandwidth control applied to designated categories ensure quality of service to
business/mission critical network applications.
Aim Parallel Environment (AIMPE), a SCADA system for Rail Operations, is building a new
network infrastructure to contain rail operations at JGB and CTF to include staging and lab areas.
The environment was designed with security at the forefront and is in progress of implementation.
Security equipment was procured, configured and installed at three individual sites. New features
of the incumbent design over the predecessor include full mesh network and secure connectivity
between the existing dual networks used for ROCC AIM systems. Security risk scanning and
vulnerability update methodologies are in place to active security monitoring and alerting. The
current LAB environment designs have been updated, secured and are now actively monitored.
WMATA Identity and Access Management (IAM) suite has been migrated from Windows to
Linux platform for better performance and reliability. This service provides Single Sign On (SSO)
for various enterprise applications to include Cognos, Travel Authorization / Travel
Reimbursement, Board Agenda Review and Nomination Form. PeopleSoft Finance has been
integrated to automate application access removal for separated users to comply with FTA audit
requirements. Automation of user activation has been implemented for the annual security
awareness training process. Integration between Active Directory and PeopleSoft has provided
automation for granting network access for new hires and the automatic removal of network access
for separated users, eliminating manual processes, and minimizing organization exposure to legacy
accounts.
During this period, Metro IT Security revised position descriptions to match industry standards
and re-organized department staff. MITS sought to improve the control of project and task flow
and to provide consistency in expectations. To accomplish this, IT established a customer facing
Program Manager’s role and a service focused operations team. The Program Manager has been
assigned and is integrated in daily activities. The operations team is in the process of standing up.
FY2015 closed out a long standing staff augmentation contract which made up 35 percent of MITS
staff. The contract was awarded and personnel switch has been completed. The current contract is
stable for the next five years.
MITS has completed numerous projects for customers to include development of NEPP datacenter
build with security architecture design and deployment, rollout of a CAD/RMS (Computer Aided
Dispatch / Remote Management System) network allowing secure remote connectivity for MTPD,
TWDT 7K which provides secure wireless communication to the rail cars, and the expansion of
WMATA guest wireless services at CTF. In addition, the MITS created a new secure environment
for ESS to have a separate off-production network for testing of video streaming to mitigate risk
from network disruptions caused by testing multicasting on the production network.
Security Center is used as a vulnerability scanning tool to identify vulnerabilities on network
devices, servers, workstations, and databases. MITS has rolled an Authority-wide scanning portal
which allows PCI system administrators, DCI system administrators, and DBA’s access to scan
III-79