California Road Charge Cybersecurity Assessment

Assuring the security of a pilot vehicle tolling system for the nation’s largest road charge research program.

Location

California, USA

Client

California Department of Transportation

Project Status

Completed

The California Department of Transportation (CalTrans) appointed WSP to design and oversee a pilot road charge program referred to as the California Road Charge (CRC), a mechanism for electronic vehicle tolling. The pilot, which took place over a six-month period, tested the feasibility of funding road and highway repairs based on how many miles a driver travels instead of how much gas they purchase.

In addition to providing various data and transportation engineering services for the CRC pilot, WSP also conducted a cybersecurity assessment of the solution, with the goal of identifying and mitigating any cybersecurity vulnerabilities in the program.

Sub-systems

5

Month long pilot

6

Critical collaboration

Our cybersecurity team led multiple workshops with CalTrans, design engineers and service providers to ensure the assessments covered every critical aspect and scenario. From there, we developed a Data Security Assessment Report (DSAR), which established processes, findings and recommendations for cyber securing vehicle tolling data.

The DSAR focused on five important sub-systems: the platform network, data collection module, account management platform, administration and the data clearing house. Data collection, inter-system transfer, processing and storage were analyzed, modeled and assigned risk impact scores. We documented risk areas, specifically considering personally identifiable information and financial data where it was most vulnerable: in-transit and between sub-systems.

Testing defenses

Finally, we utilized the MITRE ATT&CK framework as a baseline to test defenses, focusing on the tactics, techniques and procedures bad actors utilize to infiltrate corporate networks. National Institute of Standards and Technology guidance was incorporated into the DSAR and platform for increased resiliency and compliance.

Our cybersecurity team led multiple workshops with CalTrans, supporting program managers and design engineers to ensure completed assessments were accurately addressed through all iterations of the pilot for optimized results.