Air Traffic Control:

FAA Needs a More Comprehensive Approach to Address Cybersecurity As Agency Transitions to NextGen

GAO-15-370: Published: Apr 14, 2015. Publicly Released: Apr 14, 2015.

Additional Materials:

Contact:

Gerald Dillingham, Ph.D.
(202) 512-2834
dillinghamg@gao.gov

 

Gregory C. Wilshusen
(202) 512-6244
wilshuseng@gao.gov

 

Nabajyoti Barkakati, Ph.D.
(202) 512-4499
barkakatin@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

What GAO Found

As the agency transitions to the Next Generation Air Transportation System (NextGen), the Federal Aviation Administration (FAA) faces cybersecurity challenges in at least three areas: (1) protecting air-traffic control (ATC) information systems, (2) protecting aircraft avionics used to operate and guide aircraft, and (3) clarifying cybersecurity roles and responsibilities among multiple FAA offices.

As GAO reported in January 2015, FAA has taken steps to protect its ATC systems from cyber-based threats; however, significant security-control weaknesses remain that threaten the agency's ability to ensure the safe and uninterrupted operation of the national airspace system. FAA has agreed to address these weaknesses. Nevertheless, FAA will continue to be challenged in protecting ATC systems because it has not developed a cybersecurity threat model. NIST guidance, as well as experts GAO consulted, recommend such modeling to identify potential threats to information systems, and as a basis for aligning cybersecurity efforts and limited resources. While FAA has taken some steps toward developing such a model, it has no plans to produce one and has not assessed the funding or time that would be needed to do so. Without such a model, FAA may not be allocating resources properly to guard against the most significant cybersecurity threats.

  • Modern aircraft are increasingly connected to the Internet. This interconnectedness can potentially provide unauthorized remote access to aircraft avionics systems. As part of the aircraft certification process, FAA's Office of Safety (AVS) currently certifies new interconnected systems through rules for specific aircraft and has started reviewing rules for certifying the cybersecurity of all new aircraft systems.
  • FAA is making strides to address the challenge of clarifying cybersecurity roles and responsibilities among multiple FAA offices, such as creating a Cyber Security Steering Committee (the Committee) to oversee information security. However, AVS is not represented on the Committee but can be included on an ad-hoc advisory basis. Not including AVS as a full member could hinder FAA's efforts to develop a coordinated, holistic, agency-wide approach to cybersecurity.

FAA's acquisition management process generally aligned with federal guidelines for incorporating requirements for cybersecurity controls in its acquisition of NextGen programs. For example, the process included the six major information-technology and risk-management activities as described by NIST. Timely implementation of some of these activities could have been improved based on their importance to NextGen, cost, and deployment status. The Surveillance and Broadcast Services Subsystem (SBSS)—which enables satellite guidance of aircraft and is currently deployed in parts of the nation—has not adopted all of the April 2013 changes to NIST security controls, such as intrusion detection improvements, although the Office of Management and Budget guidance states that deployed systems must adopt changes within one year. Systems with weaknesses that could be exploited by adversaries may be at increased risk if relevant controls are not implemented.

Why GAO Did This Study

FAA is responsible for overseeing the national airspace system, which comprises ATC systems, procedures, facilities, and aircraft, and the people who operate them. FAA is implementing NextGen to move the current radar-based ATC system to one that is based on satellite navigation and automation. It is essential that FAA ensures effective information-security controls are incorporated in the design of NextGen programs to protect them from threats.

GAO was asked to review FAA's cybersecurity efforts. This report (1) identifies the cybersecurity challenges facing FAA as it shifts to the NextGen ATC system and how FAA has begun addressing those challenges, and (2) assesses the extent to which FAA and its contractors, in the acquisition of NextGen programs, have followed federal guidelines for incorporating cybersecurity controls. GAO reviewed FAA cybersecurity policies and procedures and federal guidelines, and interviewed FAA officials, aviation industry stakeholders, and 15 select cybersecurity experts based on their work and recommendations by other experts.

What GAO Recommends

GAO recommends that FAA: 1) assess developing a cybersecurity threat model, 2) include AVS as a full member of the Committee, and 3) develop a plan to implement NIST revisions within OMB's time frames. FAA concurred with recommendations one and three, but believes that AVS is sufficiently involved in cybersecurity. GAO maintains that AVS should be a member of the Committee.

For more information, contact Gerald L. Dillingham, Ph.D. at (202) 512-2834 or dillinghamg@gao.gov, Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov, Nabajyoti Barkakati, Ph.D. at (202) 512-4499 or barkakatin@gao.gov.

Recommendations for Executive Action

  1. Status: Open

    Comments: DOT concurred with this 2015 recommendation, and FAA's Working Group continues to work on developing a threat model for the Cyber Security Steering Committee's (CSC) review and approval. The Working Group is scheduled to brief the CSC on the model around July 2016. By implementing a threat model, FAA will be better able to allocate resources to guard against the most significant cybersecurity threats.

    Recommendation: To better ensure that cybersecurity threats to NextGen systems are addressed, as a first step to developing an agency-wide threat model, the Secretary of Transportation should instruct the FAA Administrator to assess the potential cost and timetable for developing such a threat model and the resources required to maintain it.

    Agency Affected: Department of Transportation

  2. Status: Open

    Comments: DOT concurred with these recommendations. In its comments on the draft report DOT stated that the Cybersecurity Steering Committee has set a priority of establishing an agency-wide cybersecurity threat model for fiscal year 2016. The Secretary should ensure that the threat model is implemented according to the FAA's time frame and that FAA implements the latest NIST guidelines as soon as practical.

    Recommendation: To better ensure that cybersecurity threats to NextGen systems are addressed, the Secretary of Transportation should instruct the FAA Administrator to incorporate the Office of Safety into FAA's agency-wide approach by including it on the Cybersecurity Steering Committee.

    Agency Affected: Department of Transportation

  3. Status: Open

    Comments: DOT concurred with this recommendation. FAA officials told us the agency is unable to implement all requirements within OMB's one-year time frame based on resource availability to address the number of FAA's FISMA reportable systems and NIST's newly revised requirements. As such, FAA's approach to achieve compliance with the most current NIST security controls (NIST SP 800-53 Revision 4) is to adopt a three-year assessment cycle where at least one-third (1/3) of these controls for all systems are assessed each year over a three year period. Each system will be fully assessed against all new and modified security controls in the current revision by the end of fiscal year 2017. Systems with weaknesses that could be exploited by adversaries may be at increased risk if relevant controls are not implemented. A three-year assessment cycle may not be adequate to maintain currency with NIST standards as future revisions are released. Therefore, FAA should report to OMB on how its alternative plan for implementing revised NIST standards will be adequate to protect the security of NextGen systems.

    Recommendation: To better ensure that cybersecurity threats to NextGen systems are addressed, given the challenges FAA faces in meeting the Office of Management and Budget's (OMB) guidance to implement the latest security controls in the National Institute of Standards and Technology's (NIST) revised guidelines within one year of issuance, the Secretary of Transportation should instruct the FAA Administrator to develop a plan to fund and implement the NIST revisions within OMB's time frames.

    Agency Affected: Department of Transportation

 

Explore the full database of GAO's Open Recommendations »

Sep 14, 2016

Sep 2, 2016

Aug 8, 2016

Jul 28, 2016

Jul 13, 2016

Jul 7, 2016

Jun 24, 2016

Jun 21, 2016

May 26, 2016

Looking for more? Browse all our products here