GAO was asked to review FAA's cybersecurity efforts. It is essential that FAA ensures effective information-security controls are incorporated in the design of NextGen programs to protect them from threats. FAA is implementing NextGen to move the current radar-based ATC system to one that is based on satellite navigation and automation. Systems with weaknesses that could be exploited by adversaries may be at increased risk if relevant controls are not implemented.įAA is responsible for overseeing the national airspace system, which comprises ATC systems, procedures, facilities, and aircraft, and the people who operate them. The Surveillance and Broadcast Services Subsystem (SBSS)-which enables satellite guidance of aircraft and is currently deployed in parts of the nation-has not adopted all of the April 2013 changes to NIST security controls, such as intrusion detection improvements, although the Office of Management and Budget guidance states that deployed systems must adopt changes within one year. Timely implementation of some of these activities could have been improved based on their importance to NextGen, cost, and deployment status.
For example, the process included the six major information-technology and risk-management activities as described by NIST.
#Atc4 released full
Not including AVS as a full member could hinder FAA's efforts to develop a coordinated, holistic, agency-wide approach to cybersecurity.įAA's acquisition management process generally aligned with federal guidelines for incorporating requirements for cybersecurity controls in its acquisition of NextGen programs. However, AVS is not represented on the Committee but can be included on an ad-hoc advisory basis. As part of the aircraft certification process, FAA's Office of Safety (AVS) currently certifies new interconnected systems through rules for specific aircraft and has started reviewing rules for certifying the cybersecurity of all new aircraft systems.įAA is making strides to address the challenge of clarifying cybersecurity roles and responsibilities among multiple FAA offices, such as creating a Cyber Security Steering Committee (the Committee) to oversee information security. This interconnectedness can potentially provide unauthorized remote access to aircraft avionics systems. Modern aircraft are increasingly connected to the Internet. Without such a model, FAA may not be allocating resources properly to guard against the most significant cybersecurity threats. While FAA has taken some steps toward developing such a model, it has no plans to produce one and has not assessed the funding or time that would be needed to do so. NIST guidance, as well as experts GAO consulted, recommend such modeling to identify potential threats to information systems, and as a basis for aligning cybersecurity efforts and limited resources. Nevertheless, FAA will continue to be challenged in protecting ATC systems because it has not developed a cybersecurity threat model. FAA has agreed to address these weaknesses.
As the agency transitions to the Next Generation Air Transportation System (NextGen), the Federal Aviation Administration (FAA) faces cybersecurity challenges in at least three areas: (1) protecting air-traffic control (ATC) information systems, (2) protecting aircraft avionics used to operate and guide aircraft, and (3) clarifying cybersecurity roles and responsibilities among multiple FAA offices.Īs GAO reported in January 2015, FAA has taken steps to protect its ATC systems from cyber-based threats however, significant security-control weaknesses remain that threaten the agency's ability to ensure the safe and uninterrupted operation of the national airspace system.