Report: U.S. DOT needs to improve IT security