Air Traffic Control: FAA Needs a More Comprehensive Approach to Address Cybersecurity As Agency Transitions to NextGen
Published: 2015-04-14T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: FAA is responsible for overseeing the national airspace system, which comprises ATC systems, procedures, facilities, and aircraft, and the people who operate them. FAA is implementing NextGen to move the current radar-based ATC system to one that is based on satellite navigation and automation. It is essential that FAA ensures effective information-security controls are incorporated in the design of NextGen programs to protect them from threats.
GAO was asked to review FAA's cybersecurity efforts. This report (1) identifies the cybersecurity challenges facing FAA as it shifts to the NextGen ATC system and how FAA has begun addressing those challenges, and (2) assesses the extent to which FAA and its contractors, in the acquisition of NextGen programs, have followed federal guidelines for incorporating cybersecurity controls. GAO reviewed FAA cybersecurity policies and procedures and federal guidelines, and interviewed FAA officials, aviation industry stakeholders, and 15 select cybersecurity experts based on their work and recommendations by other experts.
section_title: What GAO Found
paragraphs: As the agency transitions to the Next Generation Air Transportation System (NextGen), the Federal Aviation Administration (FAA) faces cybersecurity challenges in at least three areas: (1) protecting air-traffic control (ATC) information systems, (2) protecting aircraft avionics used to operate and guide aircraft, and (3) clarifying cybersecurity roles and responsibilities among multiple FAA offices.
As GAO reported in January 2015, FAA has taken steps to protect its ATC systems from cyber-based threats; however, significant security-control weaknesses remain that threaten the agency's ability to ensure the safe and uninterrupted operation of the national airspace system. FAA has agreed to address these weaknesses. Nevertheless, FAA will continue to be challenged in protecting ATC systems because it has not developed a cybersecurity threat model. NIST guidance, as well as experts GAO consulted, recommend such modeling to identify potential threats to information systems, and as a basis for aligning cybersecurity efforts and limited resources. While FAA has taken some steps toward developing such a model, it has no plans to produce one and has not assessed the funding or time that would be needed to do so. Without such a model, FAA may not be allocating resources properly to guard against the most significant cybersecurity threats.
Modern aircraft are increasingly connected to the Internet. This interconnectedness can potentially provide unauthorized remote access to aircraft avionics systems. As part of the aircraft certification process, FAA's Office of Safety (AVS) currently certifies new interconnected systems through rules for specific aircraft and has started reviewing rules for certifying the cybersecurity of all new aircraft systems.
FAA is making strides to address the challenge of clarifying cybersecurity roles and responsibilities among multiple FAA offices, such as creating a Cyber Security Steering Committee (the Committee) to oversee information security. However, AVS is not represented on the Committee but can be included on an ad-hoc advisory basis. Not including AVS as a full member could hinder FAA's efforts to develop a coordinated, holistic, agency-wide approach to cybersecurity.
FAA's acquisition management process generally aligned with federal guidelines for incorporating requirements for cybersecurity controls in its acquisition of NextGen programs. For example, the process included the six major information-technology and risk-management activities as described by NIST. Timely implementation of some of these activities could have been improved based on their importance to NextGen, cost, and deployment status. The Surveillance and Broadcast Services Subsystem (SBSS)—which enables satellite guidance of aircraft and is currently deployed in parts of the nation—has not adopted all of the April 2013 changes to NIST security controls, such as intrusion detection improvements, although the Office of Management and Budget guidance states that deployed systems must adopt changes within one year. Systems with weaknesses that could be exploited by adversaries may be at increased risk if relevant controls are not implemented.
section_title: What GAO Recommends
paragraphs: GAO recommends that FAA: 1) assess developing a cybersecurity threat model, 2) include AVS as a full member of the Committee, and 3) develop a plan to implement NIST revisions within OMB's time frames. FAA concurred with recommendations one and three, but believes that AVS is sufficiently involved in cybersecurity. GAO maintains that AVS should be a member of the Committee.

section_title: Letter
paragraphs: Cyber-based threats to federal information systems are evolving and  growing. These threats can come from many sources, including criminals  and other adversarial groups, foreign nations, terrorists, and insiders.  Further, the growing interconnectivity among information systems  presents increasing opportunities for cyber attacks. Specifically, the  number of incidents reported by federal agencies to the United States  Computer Emergency Readiness Team (US-CERT) has increased  dramatically in recent years from 5,503 incidents reported in fiscal year  2006 to 60,753 incidents in fiscal year 2013. Federal policy identifies 16  infrastructure sectors critical to the nation’s security, economy, and public  health and safety—including the nation’s air-traffic-control and federal- information technology systems—that rely extensively on computerized  information systems and electronic data. Effectively implementing  appropriate security over the information systems and data can make  these sectors more resilient to attack or unintentional compromise.
For more than 10 years, the Federal Aviation Administration (FAA) has  been modernizing the air-traffic control (ATC) system across the national  airspace system (NAS). FAA initiated its current modernization efforts in  2004 with the Next Generation Air Transportation System (NextGen),  which consists of several programs that provide digital communications  between controllers and pilots, as well as between satellite-based  surveillance and navigation. NextGen increases reliance on integrated  information systems and distribution of information, digital communication  methods, and Global Positioning System (GPS) technology that may put  the ATC system at greater risk for intentional or unintentional information- system failures and breaches. You asked us to examine these risks. This  report identifies the cybersecurity challenges facing FAA as it shifts to the  NextGen ATC system and how FAA has begun addressing those  challenges. In addition, this report assesses the extent to which FAA and  its contractors, in the acquisition of NextGen programs, have followed  federal guidelines for incorporating cybersecurity controls.
To ascertain the key challenges FAA faces and how it is addressing  them, we reviewed relevant cybersecurity documents from FAA and  asked FAA officials to provide us with detailed descriptions of their  cybersecurity plans as they relate to the NextGen ATC system. We  interviewed FAA officials in the Air Traffic Organization—specifically the  Technical Operations Information Security Office, NAS Cyber Operations  Center, and the Program Management Office; the Office of NextGen; the  Office of Safety; and the Office of Finance and Management—to identify  information about the cybersecurity risks and challenges officials have  identified, as well as mitigation strategies either in place or planned. We  interviewed a diverse but non-generalizable sample of 15 aviation and  cybersecurity experts in private industry and academia to obtain their  views on FAA’s efforts to address NextGen cybersecurity issues. We  selected these experts based on their knowledge of these topics, as  demonstrated by their publications, participation as experts in prior  relevant GAO work, or recommendation by other experts. We also  reviewed studies on NextGen cybersecurity challenges and spoke with a  variety of industry stakeholders and academics.
To assess the extent to which FAA and its contractors, in the acquisition  of NextGen programs, have followed federal guidelines for incorporating  cybersecurity controls, we compared pertinent FAA policies, procedures,  and practices with selected federal information-security laws and federal  guidance, including standards and guidelines from the National Institute  of Standards and Technology (NIST). In particular, we compared FAA’s  Acquisition Management System (AMS) against NIST’s risk  management guidelines and information-technology security guidelinesto determine if it follows these guidelines for the six foundational NextGen  programs, Surveillance and Broadcast Services Subsystem (SBSS), Data  Communications (Data Comm), NAS Voice Switch, Collaborative Air  Traffic Management (CATM), Common Support Service-Weather (CSS- Wx), and System Wide Information Management (SWIM). We analyzed  FAA’s documentation of key cybersecurity activities for these programs  and interviewed program managers to determine if FAA completed the  key activities in the process, or has plans to complete activities that were  started but not completed. We then chose two key NextGen acquisitions,  SBSS and Data Comm. We chose them for a detailed, in-depth review  because of their importance to NextGen, their cost, and their deployment  status. SBSS has completed key activities in the acquisition cycle. Our  reviewing Data Comm, which has not completed the cycle, should allow  insight into how the process has changed and what still might be an issue  for upcoming programs. For these two programs, we assessed how well  FAA and its contractors completed key cybersecurity activities and the  extent to which they complied with AMS and NIST guidelines relating to  cybersecurity. As part of this effort, we also compared documentation of  program activities and plans to these requirements, and interviewed  agency officials. We also reviewed pertinent sections of prior GAO reports  related to cybersecurity. We performed our work at FAA headquarters in  Washington, D.C.; the Air Traffic Control Systems Command Center in  Warrenton, Virginia; and an FAA contractor location in Herndon, Virginia.  See appendix I for a more detailed description of our scope and  methodology.
We conducted this performance audit from September 2013 to March  2015, in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: FAA’s Transition to NextGen
paragraphs: NextGen is a modernization effort begun in 2004 by FAA to transform the  nation’s ground-based ATC system into a system that uses satellite- based navigation and other advanced technology. This effort is a  multiyear, incremental transformation that will introduce new technologies  and leverage existing technologies to affect every part of the NAS. These  new technologies will use an Internet Protocol (IP) based network to   See figure 1 below for a graphic illustration of the different  communicate.parts of the NAS, the flow of information among them, and their transition  to an IP-based network.
According to FAA, the shift to NextGen technologies will require FAA to  replace its proprietary, relatively isolated ATC computer systems with  information systems that interoperate and share data throughout FAA’s  operations and those of its aviation partners. These combined aviation  operations are known as the enterprise. These new systems, which will  be described in detail later in this report, will use IP-networking  technologies to communicate across the enterprise. This transformation  involves acquiring, certifying, and operating a vast network of navigation,  communications, and surveillance systems, including information systems  in the cockpits of thousands of aircraft (avionics); it will also employ digital  and Internet-based computer-networking technologies, exposing the air- traffic control (ATC) system to new cybersecurity risks.
NextGen comprises many programs that are in various stages of  acquisition and deployment in the NAS. FAA classifies six programs as its  foundational NextGen programs: Surveillance and Broadcast Services  Subsystem (SBSS), Collaborative Air Traffic Management (CATM),  Common Support Services Weather (CSS-Wx), Data Communications  (Data Comm), NAS Voice Switch (NVS), and System Wide Information  Management (SWIM) (see fig. 2).
For the six programs we examined, FAA relies on contractors to assist  with or complete most of the broad information technology and risk  management activities. NIST, OMB, and FISMA state that regardless of  whether a security task was performed by a contractor or by a federal  agency, the federal agency is ultimately responsible for ensuring system  security. The AMS requires that FAA program officials monitor the  contractors’ performance in implementing contractual requirements,  including those related to security.
section_title: Several Offices within FAA Have Cybersecurity Responsibilities
paragraphs: The Office of the Chief Information Security Officer within the Office of  Finance and Management oversees cybersecurity across the three  main areas of FAA activity known as domains (i.e., NAS ATC  operations, Mission Support, and Research and Development ).  This office provides operational security services to the Mission  Support and R&D domains through efforts across FAA, as well as the  Cyber Security Management Center (CSMC). The CSMC provides  system monitoring and vulnerability remediation for FAA’s standard  information-technology systems that support the agency. Mission- support information systems, such as email, are separate from the  NAS and R&D domain systems.
The Air Traffic Organization (ATO), the operational arm of FAA,  implements and oversees cybersecurity measures for ATC  information systems through several of its offices. The ATO’s NAS  Security Risk Executive (Risk Executive) located in Technical  Operations has responsibility for cybersecurity on all NAS ATC  systems, including continuous monitoring, threat response  coordination, and policy. According to FAA, the Risk Executive  works internally with FAA’s Security and Hazardous Materials Office  and NextGen offices, and externally with Department of Homeland  Security (DHS) and airline stakeholders to provide an understanding  of FAA’s critical mission and how it relates to other critical  infrastructures. Another office within ATO, the NAS Cyber Operations  unit, is responsible for monitoring some NAS systems, network data  flows, and cyber events to detect anomalous and unauthorized cyber  activities in the NAS domain. ATO’s Program Management Office is  responsible for developing and fulfilling cybersecurity and all other  system requirements for NAS information systems, including NextGen  systems, through the acquisitions process.
The Office of NextGen develops and disseminates cybersecurity  policy on NextGen’s system engineering and controls, develops the  NAS Enterprise Architecture, which is the agency’s long-term strategic  plan for NextGen that includes, among other things, the information  systems security (ISS) plans, and is responsible for the overall  implementation of FAA’s NextGen initiative.
The Office of Security and Hazardous Material Safety performs  internal forensics investigations on computers that CSMC identifies as  involved in activity that may compromise cybersecurity.
The Office of Safety certifies the safety of all aircraft and aircraft  equipment, including the software components for the avionics  systems that could affect the safe operation of an aircraft.
section_title: Federal Cybersecurity Guidance for Information Systems
paragraphs: The Federal Information Security Management Act of 2002 (FISMA)  established a comprehensive framework to better ensure the  effectiveness of security controls over information resources that  support federal operations and assets. FISMA requires each agency to  develop, document, and implement an agency-wide information-security  program, using a risk-based approach to determine and address  cybersecurity requirements for information system management. Such a  program includes planning, implementing, evaluating, and documenting  remedial actions to address information security deficiencies. Federal  cybersecurity guidelines, such as those published by NIST, strongly  encourage agencies to implement information cybersecurity early in the  process of developing information systems. In this manner, the  cybersecurity requirements can change as needed and be integrated  cost-effectively. NIST also provides a process for integrating  information-security and risk-management activities into the system  development process over the life of the system. Accordingly, NIST has  developed a risk management framework of standards and guidelines for  agencies to follow in developing information security programs. Relevant  publications include the following:
Guide for Applying the Risk Management Framework to Federal  Information Systems: A Security Life Cycle Approach provides a  process that integrates information-security and risk-management  activities into the system development’s life cycle including security  categorization, security control selection and implementation, security  control assessment, information system authorization, and security  control monitoring of an information system.
Security and Privacy Controls for Federal Information Systems and  Organizationsfederal information systems and organizations, and a process for  selecting controls to protect organizational operations, assets,  individuals, other organizations, and the nation from a diverse set of  threats including hostile cyber attacks, natural disasters, structural  failures, and human errors. The guidance includes privacy controls to  be used in conjunction with the specified security controls to achieve  comprehensive security and privacy protection.  provides a catalog of security and privacy controls for
Security Considerations in the System Development Life Cyclepresents a framework for incorporating security across the life cycle of  a system and describes a minimum set of security steps needed to  effectively incorporate security into a system during its development. It  is intended to help agencies select and acquire cost-effective security  controls by explaining how to include information-system security  requirements in the system development’s life cycle.
In addition to these NIST publications, the Office of Management and  Budget’s (OMB) Security of Federal Automated Information  Resources establishes a minimum set of controls to be included in  federal automated information-security programs; assigns federal  agency responsibilities for the security of automated information; and  links the agency’s automated information-security programs and the  agency’s management control systems.
section_title: FAA Acquisition Management System
paragraphs: FAA’s Acquisition Management System (AMS) provides policies and  guidance for managing all of its acquisitions. The AMS serves as the  framework for IT project management and risk evaluation to help ensure  that systems are developed and maintained on time and within budget,  and that they deliver the capabilities necessary to meet user requirements  including the development and integration of cybersecurity controls.
section_title: FAA’s Shift to NextGen Implementation Raises Cybersecurity Challenges That FAA Has Taken Some Steps to Address
paragraphs: FAA faces cybersecurity challenges in at least three areas: (1) protecting  its air traffic control (ATC) information systems, (2) securing aircraft  avionics used to operate and guide aircraft, and (3) clarifying  cybersecurity roles and responsibilities among multiple FAA offices. FAA  has taken several steps to address these challenges, but cybersecurity  experts suggested additional actions FAA could take to enhance  cybersecurity.
subsections: section_title: FAA Faces Cybersecurity Challenges to Protect ATC Information Systems, and Most Experts Consulted Indicated That FAA Could Take Additional Steps
subsections: section_title: New Networking Technologies Expose ATC Systems to New Cybersecurity Risks
paragraphs: New networking technologies connecting FAA’s ATC information systems  expose these systems to new cybersecurity risks, potentially increasing  opportunities for systems to be compromised and damaged. Such  damage could stem both from attackers seeking to gain access to and  move among information systems, and from trusted users of the systems,  such as controllers or pilots, who might inadvertently cause harm. FAA’s  ATC-related information systems are currently a mixture of old, legacy  systems and new, IP-networked systems. FAA’s legacy systems consist  mainly of decades-old, point-to-point, hardwired information systems,  such as controller voice-switching systems, that share information only  within their limited, wired configuration. In contrast, FAA plans for  NextGen call for the new information systems to be networked together  with IP technology into an overarching system of interoperating  subsystems.
According to FAA officials and experts we consulted, the ease of access  to these different types of systems, and the potential to damage them,  varies. The older systems, depicted on the left in figure 3 below, are  difficult to access remotely because few of them connect from FAA to  external entities such as through the Internet. They also have limited lines  of direct connection within FAA. Conversely, the new information systems  for NextGen programs are designed to interoperate with other systems  and use IP networking to communicate within FAA, as shown on the right  in figure 3 below. According to experts, if one system connected to an IP  network is compromised, damage can potentially spread to other systems  on the network, continually expanding the parts of the system at risk. As  shown in the figure, cybersecurity controls, if properly designed and  effectively implemented, can make IP-networked systems more resilient  against damage while allowing the systems to interoperate. According to  MITRE, because the older systems had limited connectivity, they were  generally not protected with cybersecurity controls. Once one of them is  breached, it is easy to potentially damage that system, gain access to  other systems with which it communicates, and potentially damage those  systems as well. According to FAA, so far, approximately 36 percent of  the ATC systems in the national airspace system (NAS) are connected  using IP, and FAA officials expect the percentage of NAS systems using  IP networking to grow to 50 to 60 percent by 2020. According to MITRE  and other experts, a hybrid system comprising both IP-connected and  point-to-point subsystems increases the potential for the point-to-point  systems to be compromised because of the increased connectivity to the  system as a whole provided by the IP-connected systems.
We reported in January 2015 that FAA has taken steps to protect its ATC  systems from cyber-based threats. However, we stated that significant  security-control weaknesses remain that threaten the agency’s ability to  ensure the safe and uninterrupted operation of the national airspace  system. We made numerous recommendations to address these  weaknesses, and FAA has concurred with these recommendations.
GAO, Information Security: FAA Needs to Address Weaknesses in Air Traffic Control  Systems. GAO-15-221. (Washington DC: January 2015).
section_title: FAA Is Designing and Deploying an Enterprise Approach Intended to Strengthen the Cybersecurity of Its Information Systems
paragraphs: FAA is developing an approach, called an enterprise approach, to  connect and protect its information systems enterprise-wide. The  enterprise approach views IP-networked systems as subsystems within  the larger enterprise-wide system. Under this approach, the subsystems  can interoperate while an enterprise-wide set of shared cybersecurity  controls, called “common controls,” and a monitoring program protect  and increase the resiliency of the subsystems. According to FAA officials  and cybersecurity experts we spoke to, using common controls in an  enterprise approach increases the efficiency of cybersecurity efforts. For  example, NIST recommends the use of common controls because when  new threats to the system are discovered and those threats can be  addressed by revisions to common controls, agencies can then  immediately protect all the interoperating subsystems by revising just the  common control. For isolated, legacy systems, cybersecurity control  revisions have to be developed and implemented uniquely for each  individual system. FAA officials said that they apply both common  controls and individual system controls, where appropriate, to IP- connected systems interoperating within an enterprise domain, in  accordance with NIST guidance and OMB policy.
section_title: Selected Experts Generally Agreed That FAA’s Enterprise Approach Is Appropriate, but Noted That Further Actions Could Enhance Cybersecurity
subsections: section_title: A Holistic Threat Model Could Enhance FAA’s Cybersecurity Posture
paragraphs: Twelve of our 15 cybersecurity experts discussed enterprise-level holistic  threat modeling, and all 12 agreed that FAA should develop such a model  to strengthen cybersecurity agency-wide. NIST and the 12 experts we  consulted said that threat modeling, a cybersecurity best practice,  enables an organization to identify known threats, including insider  threats, across its organization and align its cybersecurity efforts and  limited resources accordingly to protect its mission. NIST guidance also  states that an integrated, agency-wide view for managing risk can  address the complex relationship among missions, the business  processes needed to carry out missions, and the information systems  supporting those missions and processes. NIST also recommends  organization-wide threat modeling,because an agency-wide threat model would help to identify all known  threats to information systems, allowing an agency to further identify  vulnerabilities in those systems.
FAA officials said that FAA has not produced a plan to develop an  enterprise-wide threat model but has made some initial steps toward  developing such a model. Specifically, FAA officials said that they have  examined threats to the future NextGen air-transportation system and are  currently working to develop multiple threat models. Such efforts include  reviewing the resiliency of the ATC system in conjunction with the  Department of Homeland Security (DHS). NIST recommended such a  review in its guidelines to promote the protection of critical infrastructure.  According to FAA, it also assesses risks associated with individual  systems when it acquires them and during system reauthorization.  According to FAA, these assessments examine how the system in  question interoperates with other systems; however, FAA officials agree  that these assessments do not constitute a holistic threat model that  might give FAA an agency-wide view of known threats to the entire ATC  system. One FAA official said and an aviation advisory group published a  report stating that such a threat model would allow FAA to approach  cybersecurity in a proactive way, whereas FAA’s current activities are  reactive. For example, a threat model like that recommended by NIST  and our experts could help FAA be more proactive in dealing with the rise  of insider threats in federal agencies.
FAA officials told us that they have not yet reached a point where they are  prepared to pursue a comprehensive enterprise-wide threat model. Some  experts told us that developing and maintaining a threat model would be  costly and time consuming. FAA officials told us that they have not  determined the funding or time that would be needed to develop such a  model or identified the resources needed to implement it. One senior FAA  official agreed with the experts’ view that an enterprise holistic-wide threat  model is expensive and time-consuming to accomplish and maintain; he  said that no plan currently exists to produce one for this reason.
While developing a holistic threat model could be costly and time- consuming, in a constrained-resource environment such as FAA’s, the  information contained in such a model could allow FAA to target  resources to parts of the system commensurate with the likelihood of  compromise and the danger associated with the potential consequences  that might occur. Without a holistic threat model, it is unclear how FAA will  be able to develop a more comprehensive picture of threats to its  systems, and how they might compromise these systems. Most of our  experts said that without this knowledge, FAA might not target its  cybersecurity resources and analyses appropriately, leaving some  important risks unmitigated while overprotecting against less severe risks.
subsections: section_title: Continuous-Monitoring Efforts Are Under Way
paragraphs: Ten of the cybersecurity experts we contacted also said that a holistic  continuous-monitoring program is necessary for the IP-networked  agency-wide approach that FAA is taking to accommodate NextGen  programs. Cybersecurity experts and FAA officials told us that a holistic,  continuous-monitoring program includes (1) real-time monitoring of the  enterprise system’s boundaries, (2) detection of would-be attackers  probing for vulnerabilities, (3) real-time monitoring and investigation of  internal user activity that is outside expectations, and (4) other  continuous-monitoring activities such as incident detection, response, and  recovery activities and mitigations.
FAA officials said they have implemented some monitoring activities for  ATC systems. Although no coordinated policy exists for FAA enterprise- wide continuous monitoring, the Cyber Security Steering Committee has  developed a plan that will incorporate DHS’s Continuous Diagnostics and  Mitigation programOperations (NCO) group, which has responsibility for incident response  for NAS ATC systems, daily analyzes ATC’s system activity reports,  which, among other things, report on cyber attacks. Currently 9 of 39 IP-  in the future. For example, the NAS Cyber  connected ATC systems provide system activity reports for NCO’s review.  NCO does not currently analyze activity reports for the other 30 systems.  We have previously found that this limited monitoring ability increased  the risk that a cybersecurity event affecting NAS systems could go  undetected and recommended that FAA provide the NCO function with  sufficient access to provide more comprehensive monitoring. FAA officials  said that ATO plans to have all NAS’s IP-connected systems reporting  daily to NCO within 3 years.
section_title: Securing Aircraft Avionics Systems Is an Increasing Challenge as FAA Adapts Its Aircraft Certification Process to Better Focus on Cybersecurity
paragraphs: According to FAA and experts we interviewed, modern communications  technologies, including IP connectivity, are increasingly used in aircraft  systems, creating the possibility that unauthorized individuals might  access and compromise aircraft avionics systems. Aircraft information  systems consist of avionics systems used for flight and in-flight  entertainment (see fig. 4 below). Historically, aircraft in flight and their  avionics systems used for flight guidance and control functioned as  isolated and self-contained units, which protected their avionics systems  from remote attack. However, according to FAA and experts we spoke to,  IP networking may allow an attacker to gain remote access to avionics  systems and compromise them—as shown in figure 4 (below). Firewalls  protect avionics systems located in the cockpit from intrusion by cabin- system users, such as passengers who use in-flight entertainment  services onboard. Four cybersecurity experts with whom we spoke  discussed firewall vulnerabilities, and all four said that because firewalls  are software components, they could be hacked like any other software  and circumvented. The experts said that if the cabin systems connect to  the cockpit avionics systems (e.g., share the same physical wiring  harness or router) and use the same networking platform, in this case IP,  a user could subvert the firewall and access the cockpit avionics system  from the cabin. An FAA official said that additional security controls  implemented onboard could strengthen the system.
FAA officials and experts we interviewed said that modern aircraft are  also increasingly connected to the Internet, which also uses IP- networking technology and can potentially provide an attacker with  remote access to aircraft information systems. According to cybersecurity  experts we interviewed, Internet connectivity in the cabin should be  considered a direct link between the aircraft and the outside world, which  includes potential malicious actors. FAA officials and cybersecurity and  aviation experts we spoke to said that increasingly passengers in the  cabin can access the Internet via onboard wireless broadband systems.  One cybersecurity expert noted that a virus or malware planted in  websites visited by passengers could provide an opportunity for a  malicious attacker to access the IP-connected onboard information  system through their infected machines. According to five cybersecurity  experts, the threat of malicious activity by trusted insiders also grows with  the ease of access to avionics systems afforded by IP connectivity if  proper controls, such as role-based access, are not in place. For  example, the presence of personal smart phones and tablets in the  cockpit increases the risk of a system’s being compromised by trusted  insiders, both malicious and non-malicious, if these devices have the  capability to transmit information to aircraft avionics systems.
FAA’s Office of Safety (AVS) is responsible for certifying the airworthiness  of new aircraft and aviation equipment, including software components for  avionics systems. Although FAA’s aircraft-airworthiness certification  does not currently include assurance that cybersecurity is addressed, FAA currently issues rules with limited scope, called Special Conditions,  to aircraft manufacturers when aircraft employ new technologies where IP  interconnectivity could present cybersecurity risks. FAA views Special  Conditions as an integral part of the certification process, which gives the  manufacturer approval to design and manufacture the aircraft, engine, or  propeller with additional capabilities not referred to in FAA regulations.  For example, FAA issued Special Conditions to address the increased  connectivity among aircraft cockpit and cabin systems for the Boeing 787  and Airbus A350 to provide systems cybersecurity and computer network  protection from unauthorized external and internal access. FAA officials  said that research supporting cybersecurity-related Special Conditions  could be aggregated and used to support portions of a new rule, and  industry experts we spoke with said they would support the certainty  rulemaking would bring.
According to FAA officials and the Radio Technical Commission for  Aeronautics (RTCA), FAA has not yet developed new regulations to certify cybersecurity assurance for avionics systems because historically,  aircraft avionics systems were isolated within the aircraft itself and not  considered vulnerable to cybersecurity attacks. According to RTCA,  FAA’s certification process for component airworthiness focuses on  design assurance, which evaluates the probability and consequences of  component failure. Further, RTCA reports that a focus on cybersecurity  assurance would evaluate the likelihood and consequences of  cybersecurity failure. The likelihood of an attack takes into account  different levels of trustworthiness of entities with access to a component  and the relative intention to do harm. However, FAA officials and an  aviation expert said that intention has not been considered a factor in  avionics component-system failures because other security processes  generally prevented untrusted entities from gaining access to avionics  components. FAA officials said that the agency recognizes that  cybersecurity is an increasingly important issue in the aircraft-operating  environment and is shifting the certification focus to address this potential  new threat.
FAA’s Office of Safety began developing a larger airworthiness rule  covering avionics cybersecurity in 2013 but determined more research  was necessary before rulemaking could begin and halted the process. In  December 2014, FAA tasked its Aviation Rulemaking Advisory  Committee (ARAC) with submitting a report within 14 months of the  March 2015 kickoff meeting that provides recommendations on  rulemaking and policy, and guidance on best practices for information  security protection for aircraft, including both certification of avionics  software and hardware, and continued airworthiness. FAA states that  without updates to regulations, policy, and guidance to address aircraft  system information security/protection (ASISP), aircraft vulnerabilities  may not be identified and mitigated in a timely manner, thus increasing  exposure times to security threats. According to the ARAC task  assignment, the report should provide recommendations by early 2016 on  whether ASISP-related rulemaking, policy, and/or guidance on leading  practices are needed, and the rationale behind such recommendations. If  policy or guidance, or both, are needed, among other things, the report  should specify which aircraft and airworthiness standards would be  affected.
section_title: FAA Has Taken Steps to Clarify Cybersecurity Roles and Responsibilities, but Opportunity Exists for Further Action
paragraphs: Cybersecurity roles and responsibilities are spread across FAA among  different offices with varying missions and functions related to  cybersecurity. FAA is taking steps to align agency cybersecurity orders  and policies, as well as IT infrastructure and governance, with the  changing needs of the NextGen cyber environment. In November 2013,  the Chief Information Officer (CIO) and Chief Information Security Officer  (CISO) under the FAA’s reorganized IT office began reorganizing and  rewriting cybersecurity-related policies and plans agency-wide, and  restructuring the agency’s IT infrastructure and governance, in part to  address the shifts in cybersecurity activities and roles due to ATC  modernization. According to FAA, a working group expects to complete  a draft by September 2015 that reflects the restructuring of IT  infrastructure. The FAA’s CIO is developing an enterprise approach for  non-NAS information systems and cybersecurity, and is also leading a  cross-agency team in developing the Cyber Security Strategy for 2016– 2020. Separately, the ATO is also developing and maintaining an  enterprise approach for NAS systems in the ATC domain.
FAA has also taken steps to better coordinate its cybersecurity efforts.  FAA runs exercises that simulate cyber attacks and are designed to  increase internal collaboration and help clarify roles during such events.  Specifically, the NAS Security Risk Executive and other ATO staff  organized and conducted five of these exercises between 2013 and 2015  involving FAA cybersecurity staff from different FAA offices as well as  staff from the departments of Defense and Homeland Security, and  MITRE. FAA officials said that these exercises are an integral part of  sustaining and improving operational activities and are incorporated into  the planning process for all NAS activities. FAA plans to continue  conducting one or two per year.
In addition to the ATO’s NAS Risk Executive, FAA established the  Cybersecurity Steering Committee in November 2013 to better coordinate  FAA agency-wide cybersecurity efforts at the executive level and provide  an integrated approach to cybersecurity strategy and planning with a  mission focus for FAA. The Committee has begun establishing the  specific roles and responsibilities required to fulfill its mission. It is chaired  by the CISO and includes representatives from ATO, NextGen, and  Security and Hazardous Material Safety. These members are tasked with  working together to identify, prioritize, strategize, and operationalize  cybersecurity requirements, issues, programs, and projects needed to  integrate an agency-wide approach to cybersecurity. Given that the  Committee is in its early phases of operation, it is too early to tell whether  it will be able to provide the cybersecurity visibility and coordination  functions as outlined by the committee charter.
While FAA is working to transform the organization of its cybersecurity  efforts, the experts we consulted said that it could improve upon those  efforts by including all key stakeholders in its agency-wide approach. All  15 of our cybersecurity and aviation experts agreed that organizational  clarity regarding roles, responsibilities, and accountability is key to  ensuring cybersecurity across the organization. In addition, the five  experts who commented on stakeholder inclusion all said that because  aircraft avionics systems have the potential to be connected to systems  outside the aircraft, aircraft cybersecurity issues should be included in an  agency-wide cybersecurity effort. For instance, AVS issues cybersecurity- related rules for aircraft and has begun reviewing rulemaking on  cybersecurity, but AVS is not included in developing the agency-wide  approach for information systems security and has no representative on  the Cybersecurity Steering Committee. FAA states that AVS subject  matter experts can be called upon to share information and  recommendations but that regulatory aspects associated with  cybersecurity for AVS’s information systems are addressed by the FAA’s  CIO and are therefore not under the purview of the FAA Cybersecurity  Steering Committee. While AVS has not directly requested to be on this  committee, we previously found that it is important to ensure that relevant  participants be included in collaborative efforts.could result in omitting an FAA stakeholder that has an understanding of  specific technological changes in aircraft traversing the NAS environment  and how these changes might intersect with changing ATC technologies  and cybersecurity needs.
section_title: FAA’s Acquisition Management Process Reflects Federal Guidance, but Management of Security Controls and Contractor Oversight Could Be Improved
paragraphs: According to NIST, one goal of an agency-wide approach to cybersecurity  is protecting new information systems from threats by ensuring that when  those systems are acquired, they incorporate security controls. To  accomplish this goal, FAA’s Acquisition Management System (AMS)  includes the six major information-technology and security-risk- management activities described in key NIST guidance. While FAA has integrated these six activities into the AMS lifecycle, our analysis of two  NextGen foundational programs, SBSS and Data Comm, revealed  instances in which some of these activities were not completed properly,  or were completed in an untimely manner. In addition, while Data Comm  managers have thus far provided oversight of their contractors’ security- related acquisition activities, SBSS managers did not possess some of  the detailed information that would have enhanced their oversight prior to  the system’s deployment.
subsections: section_title: FAA’s Acquisition Management System Incorporates NIST’s Information-Security Guidance throughout the Acquisition Life Cycle
paragraphs: To its credit, FAA has integrated NIST’s six broad information-security  and risk-management activities into its AMS, which guides the life cycle  processes to be followed in developing FAA information systems. These  activities include assessing the security controls, authorizing the system to operate based on the results of security  categorizing the system’s impact level,selecting security controls,  implementing the security controls,  assessments and a determination of risk, and monitoring the efficacy of the security controls on an ongoing basis  following a system’s deployment.
These activities and their relationship to FAA’s AMS life cycle are shown  in figure 5 below.
System categorization: NIST guidance states that in applying the risk  management framework to federal information systems’ design and  development processes, agencies should first categorize each  information system’s impact level (i.e., the severity of the consequences  to the agency’s mission if a system were compromised). In accordance  with this guidance and other federal agency requirements, FAA’s  acquisition process requires that each new system’s security impact level  be categorized as low, moderate, or high based upon the risks associated  with the system and the information it processes, stores, or transmits.Of the six foundational NextGen systems we reviewed, all have  completed at least an initial categorization process.
Select security controls: NIST guidance states that agencies should next  select protective measures, known as security controls, based on the  characterization described above. According to NIST guidance and  federal agency requirements, the impact categorization determines which  security control baseline (i.e., starting point for consideration) the system  should use, as the low-impact baseline lists fewer controls than the  moderate- or high-impact baselines. NIST guidance also states that as  part of the selection phase, organizations should tailor the baseline  security controls so that they align with the system’s specific mission,  function, or environment. In some cases, this aligning may include  eliminating some inapplicable controls or applying supplemental controls.  In accordance with NIST guidance, FAA’s acquisition policies require the  selection of appropriate security controls that reflect the system’s  categorization, and allow for appropriate tailoring of security controls. For  example, detailed tailoring directions are provided in an FAA handbook  that supplements the AMS. In addition, FAA recently drafted guidance to  require that programs report, among other things, the cybersecurity  decisions and activities conducted in the selection of security controls.
Implement security controls: NIST guidance also states that once  selected, the system must implement controls specified in the security  plan. The guidance emphasizes that implementation helps protect  systems against possible compromise. When NIST changes its guidance  and introduces new security controls, OMB calls for deployed systems to  implement the controls within one year of the change, and for systems  under development to comply with NIST publications upon their eventual  deployment. The handbook that supplements FAA’s AMS states that  selected and tailored security controls should be implemented; however,  according to FAA officials, FAA does not have a policy regarding how  quickly to implement new NIST controls, and one official stated that the  OMB’s direction is “not realistic” given current constraints. The official  noted that while the agency recognizes that its implementation cycle for  critical cybersecurity controls needs to be more agile and responsive,  swift implementation is hampered by federal-funding processes,  acquisition requirements, and, as discussed below, the need to  extensively test security controls. The official noted that FAA is  considering adapting acquisition practices in order to rapidly implement  critical controls; however, no definitive plan has been established.
Assess security controls: Additionally, NIST guidance states that  assessments are important to ensuring that the security controls are  functioning as intended. If a weakness is discovered during the  assessment process, agencies are expected to generate a remediation  plan to address the identified weakness. OMB directs agencies to  develop plans of action and milestones (POA&Ms), which are intended to  help agencies act upon assessment findings. Similarly, FAA’s acquisition  policies state that security controls should be assessed to ensure that  they provide the necessary security protection for each acquired system.  The FAA handbook that supplements the AMS provides detailed  guidance on managing POA&Ms in the event that the assessments  discover weaknesses.
Authorize system to operate based on risk: In addition, FAA’s AMS states  that systems must obtain security authorization approval prior to receiving  authorization to operate, which reflects NIST guidance that authorization  to deploy a system should only be granted after considering the risks.  NIST guidance states the authorizing officials should consider the results  of assessments, including POA&Ms, in their decisions. Similarly, the FAA  acquisition process requires that the authorizing official receive POA&Ms  to assist them in deciding if the system can be deployed. Moreover, the  AMS requires that systems be reauthorized at least every 3 years, and  the decision regarding whether or not the security risks are acceptable  must be reconsidered at that time. According to both NIST and FAA  policy, reauthorization may take place more frequently than every 3 years  if significant changes occur to the information system environment.
Monitor security controls on ongoing basis: Last, NIST guidance states  that agencies should monitor the security controls on an ongoing basis  after deployment, including assessing controls’ effectiveness and  reporting on the security state of the system. FAA’s AMS states that the  security controls must be monitored after the system is deployed to  ensure that they operate as expected and provide the necessary  protection. Examples of FAA’s continuous monitoring activities include  periodic scans of operational systems, patching vulnerabilities, and  updating the system’s security plan. FAA’s acquisition policies also  require that each system assess a subset of its controls every year. Core  security controls, which have greater volatility or importance to the  organization, are to be assessed every year.
NextGen programs are completed in stages, sometimes referred to as builds. As a  result, even when one build of a system is operational, the program is not necessarily  complete. New features and capabilities can be added to the system over time as future  builds move through the acquisition process. Moreover, some steps can be completed  more than once. For example, multiple assessments can take place. repeated to determine whether updates are required. For example,  security controls for SBSS have been re-assessed by FAA’s independent  risk assessment team, which conducts testing, demonstrations, file  reviews, and interviews with relevant personnel before and after a system  becomes operational.
section_title: FAA Generally Followed Federal Guidance for Two Selected NextGen Programs, but Opportunities Exist for Improvement
paragraphs: Many of the six broad risk-management activities described in the AMS  and NIST guidance involve security controls. These detailed protective  measures—which include topics like access control, contingency  planning, and physical security measures—are critical to ensuring that  systems are sufficiently protected. Among other things, NIST guidance  states that agencies should select security controls and assess the  efficacy of security controls. In addition, NIST and OMB expect agencies  to address weaknesses found during assessments. We analyzed two  NextGen programs’ treatment of security controls and remediation  activities: (1) SBSS, which is operating in some parts of the NAS,  including over the Gulf of Mexico, and (2) Data Comm, which has not yet  finished the acquisition process but has deployed a test system. We  selected these because of their importance to NextGen, cost, and  deployment status. Although FAA adhered to aspects of federal guidance  on control selection, assessment, and weakness remediation, its  implementation of these risk management activities could be or could  have been improved.
subsections: section_title: SBSS and Data Comm Generally Documented Security Control Selection Decisions, but Do Not Require the Most Recent NIST Controls
paragraphs: NIST provides the specific security protections, known as security  controls that an organization should consider to help protect an  information system. For a “moderate impact” system, like the majority of  the foundational NextGen systems that have completed the  categorization process, NIST lists more than 200 such controls as a  baseline. However, NIST acknowledges that agencies should tailor  security controls so that they are relevant and appropriate for their  individual systems. The process of tailoring controls can include electing  to rely on common controls rather than selecting a comparable NIST  control for implementation,are not applicable for a particular system. According to NIST guidance,  these decisions must be justified and appropriately documented, such as  in a system security plan.   or deciding that controls identified by NIST  When SBSS was developed, FAA and its contractors selected controls  from NIST guidance. For example, they selected controls such as an  audit record of login attempts and automated mechanisms to alert  security personnel to malicious activity. As allowed by the NIST and FAA  guidance, SBSS determined that many controls were not applicable or  were already covered by existing common controls, such as policies and  procedures related to FAA security management activities. SBSS’s initial  system-security plan accounted for the majority of moderate baseline  controls recommended at the time. However, it did not sufficiently  document the implementation details for some controls, including  contingency planning and incident response controls. For example, the  initial system security plan described the existing process that FAA used  to detect and respond to incidents affecting NAS systems. However, it did  not describe system-level requirements or procedures for incident  handling for SBSS. A few of these controls were associated with  weaknesses identified during the assessment process, indicating that  these controls should have received more consideration during the  selection process. Better documentation in the system security plan may  have supported such consideration. While FAA’s system-security plan  template from fiscal year 2009 provided guidance on documenting  security controls, the fiscal year 2015 system-security plan template has  since been updated based on NIST guidance and provides substantially  more detailed instruction than in the past.
In addition, the 2008 SBSS system security plan did not record decisions  associated with more than three dozen enhancements that NIST provides  to strengthen the controls and that are included in the security baseline.  For example, while the system security plan accounted for permitted  actions without identification or authentication, it did not document the  enhancement that clarified that actions should be permitted to the extent  necessary to accomplish mission objectives. This lack of documentation  may have been due to limitations in FAA’s system security-plan template  during that time period. While the template provided instruction that  enhancements were to be documented, it did not specifically identify them  in the same way that other controls were identified. SBSS continues to  update the system security plan and security controls as part of the  ongoing monitoring process, and the current system -security plan  template covers enhancements.
The Data Comm program is newer than SBSS and is not yet operational,   As of  and as such, its initial security control selection is still under way.October 2014, Data Comm had included approximately 60 percent of the  more than 250 controls listed in the third version of the NIST 800-53  guidelines, some of which were identified as common controls. As for the  slightly more than 100 controls that were identified as out of scope at this  time, an FAA official explained that updates will be made as the program  matures and that more security controls may be added in the future as  deemed necessary. In accordance with NIST guidance, Data Comm has  documented its justification for its current selection of NIST controls and  its tailoring decisions to date in the system security plan.
However, even though SBSS and Data Comm contractors justify control  selection in the programs’ respective system-security plans, the  contractors are not required to implement the most recent controls unless  specifically tasked to do so by FAA. Currently, the SBSS contractor is  only obligated to follow the first revision of NIST guidelines from 2006,  although NIST has updated the guidelines three times since that time,  most recently in 2013. Data Comm’s contractor is required to follow the  third version of the guidelines, which was published in 2009, and updated  in 2010. NIST updates its guidelines to reflect new and emerging threats,  and issues new security controls to help agencies better protect their  systems. According to NIST, the most recent update was motivated by  the increasing sophistication of cyber attacks and the operations tempo of  adversaries (i.e., the frequency of such attacks, the technical competence  of the attackers, and the persistence of targeting by attackers). According  to FAA, systems can incorporate new controls on an ad-hoc basis or by  modifying systems’ contracts to reflect updated NIST guidance, and  NIST’s most recent controls are reflected in FAA’s updated templates and  guidance. However, FAA does not require that contracts be modified  within a particular time frame to reflect NIST revisions.
Although the SBSS program asks the contractor to implement more  recent NIST controls on an ad-hoc basis, these actions are outside of the  contract’s requirements and, according to program officials, must be paid  for separately. While ad-hoc additions may be sufficient in some cases,  SBSS has not yet implemented some of the controls that NIST  recommended in its 2010 revision, but plans to address these controls in  accordance with NIST’s 2013 update as these are part of a large update.  SBSS officials explained that they did not previously have funding for an  update of such a large scope, but they requested and received funding  beginning in fiscal year 2015. According to program officials, these funds  will allow them to adopt the missing controls. An FAA official stated that  the SBSS program plans to adopt the most recent version of the NIST  standards in fiscal year 2016. Given the pace of change in the threat  environment, OMB is directing agencies that timely adoption of new NIST  guidance, within a year, is critical to enhancing the protection of agencies’  information systems. As previously discussed, OMB requires that if NIST  updates its security control guidance—which has occurred four times  since the guidance was initially developed in 2005—deployed systems  must implement all relevant updates within one year. Systems with  weaknesses that could be exploited by these adversaries may be at  increased risk if relevant controls in the new NIST guidelines are not  implemented.
With regard to Data Comm, an FAA official responsible for the program  explained that the program security office had reviewed the changes in  the most recent version of the NIST guidelines and that the official did not  believe any security control changes that warranted a contract  modification. Rather, the program will identify any security differences  between the baseline and the latest NIST 800-53 revision 3 as part of the  acquisition process and address them in the resulting POA&Ms, if  required. However, the program office did not have an official analysis  associated with this decision. NIST guidance recommends that agencies  document the assumptions, constraints, and rationale supporting  significant risk-management decisions in order to inform future decisions.  Without documentation of its analysis, Data Comm’s future managers  may not be able to react appropriately when the threat landscape  changes to such a degree that a contract modification would be  warranted.
section_title: SBSS Did Not Sufficiently Assess Key Controls Prior to Deployment, a Lack Which Contributed to a System Outage
paragraphs: FAA did not sufficiently test certain security controls provided by the  system’s contractor prior to SBSS’s deployment. As previously discussed,  NIST guidance permits agencies to rely on controls provided by another  party, such as a contractor; however, it instructs agencies to ensure that  such controls are still sufficient and appropriate. As NIST explains and as  GAO has previously found, the responsibility for mitigating risks arising  from the use of contractor-provided systems and security controls lies  with the agency. NIST instructs agencies to determine if security controls  provided by external parties are sufficient to ensure protection. While  NIST guidance provides some latitude in how agencies are to accomplish  this task, the guidance makes clear that the steps must be sufficient to  ensure the security of the system at hand. However, FAA’s pre- deployment testing of SBSS was insufficient. Specifically, according to  the SBSS contractor, FAA used a briefing by the contractor to determine  that the contractor’s processes for managing and controlling changes to  SBSS were sufficient. However, the agency did not evaluate the  processes to ensure that they were in place and operating effectively until  October 2009, nearly a year after the system was initially deployed, when  FAA identified significant weaknesses with the SBSS configuration  controls implemented by the contractor.
Shortcomings in these contractor-provided change-management security  controls contributed to a significant SBSS system outage. Specifically, in  August 2010, an engineer made an error while implementing a system  change that caused the network to shut down, which prevented  surveillance data transmitted through the hub from reaching FAA control  centers. As a result, air traffic controllers could not use SBSS surveillance  data to help separate aircraft in the affected locations for nearly 16 hours.  A report produced by the SBSS contractor after the outage identified that  the outage had occurred because of shortcomings in the processes and  controls for managing and controlling changes to the system, and  recommended steps to ensure that such a disruption would not occur  again, including strengthening these controls. Although FAA’s testing  had discovered weaknesses in a few of the controls less than a year  before the outage, more robust testing of the controls prior to deployment  may have indentified these issues earlier—possibly allowing for any  identified to be corrected in time to potentially prevent or reduce the  impact of the outage. However, these weaknesses had not yet been  remedied when the outage occurred.has been thoroughly investigated to ensure that the SBSS program and  the contractor learned from the experience, and that remedial actions  were taken to strengthen the controls. Furthermore, a representative from  the SBSS contractor noted that NextGen programs share information on  an ad hoc basis to allow other systems to benefit from their experiences.
FAA officials stated the outage  Although Data Comm has not finished selecting its security controls, an  FAA official who manages the program reported that the contractor is  testing controls that have been selected thus far. In addition, Data  Comm had identified more than 70 controls as of October 2014 that it  classified as common controls. As previously discussed, common  controls are managed by the agency, and accepting these controls is  permitted by NIST guidance. According to FAA, Data Comm and other  NextGen systems rely on the integrity of common controls so that they do  not have to duplicate effort and spend funds needlessly. However, we  recently reported that FAA did not test how some common controls  protected the security of systems being added to the ATC environment.  For example, FAA defined the security awareness training common  control, but the testers did not examine training records to verify that  personnel on the systems that rely on the control were taking the training.
We recommended that FAA ensure that testing of security controls,  including common controls, is comprehensive enough to determine  whether these controls are operating effectively, and FAA concurred.
section_title: SBSS Did Not Consistently and in a Timely Manner Address System Weaknesses Discovered during Assessments
paragraphs: According to NIST guidance and the AMS, agencies are expected to  create plans of action and milestones (POA&M) when security  weaknesses are detected during the testing of an information system.  According to NIST and OMB, POA&Ms are a remediation plan with  milestone dates for corrective actions that are needed to mitigate the  identified weakness. In order for a POA&M to be closed, risk must be at  an acceptable level. For example, the program might implement  additional security controls, or further examination may show that the  weakness is an acceptable risk or not actually applicable to the system.  However, SBSS has not always remediated weaknesses identified in  POA&Ms, which exposes the system to risk. According to FAA, SBSS  was deployed in 2008 with weaknesses in the program’s intrusion  detection system, a shortcoming that was still unresolved as of early  2015. An FAA official explained that remedial actions had not been  implemented previously due to a lack of funding, but would be applied as  part of an estimated $42 million update in fiscal year 2015.
GAO, Information Security: FAA Needs to Address Weaknesses in Air Traffic Control  Systems. GAO-15-221. (Washington DC: January 2015). infrequent to facilitate timely oversight and resolution of POA&Ms. In  October 2013, FAA implemented a new POA&M database, known as the  SMART Tool, that FAA officials say is intended to improve oversight, and  could reduce delays in addressing POA&Ms. Although FAA policy does  not identify a maximum amount of time that a POA&M can remain  unresolved, delays in addressing security weaknesses extend the amount  of time that systems are vulnerable to exploitation. FAA officials agreed  that systems are more secure when POA&Ms are resolved in a timely  fashion.
In addition, until September 2014, Data Comm had not finished formally  documenting the rationale as to why it did not plan to mitigate some of the  weaknesses of a test system associated with the program. These  weaknesses had been discovered in fiscal year 2013. Specifically, the  Data Comm program is using a test system at two locations to obtain  feedback from controllers, pilots, and other users. The test system  generated 30 POA&Ms in fiscal year 2013, and FAA has since resolved  them. However, FAA officials reported that they do not intend to address  all of the POA&Ms because they will replace the test system in 2016 with  new technology that reflects user feedback. All of the POA&Ms are  categorized as “low risk,” and FAA officials explained that their analysis of  the costs, risks, and benefits indicates that these POA&Ms are not worth  addressing given the replacement schedule; however, this analysis was  not initially noted in the POA&M records. As noted previously, NIST  guidance states that documenting significant risk management decisions  is imperative in order for officials to have the necessary information to  make credible, risk-based decisions. We asked Data Comm officials  about this concern in September 2014, and were told that Data Comm  had taken action to remedy the situation during the course of our audit.  Specifically, the POA&M records were updated to reflect the program’s  decision process.
section_title: Oversight of the SBSS Contractors’ Security Requirement Development and Security Control Implementation Was Lacking in Some Instances
paragraphs: According to FAA’s AMS, procurement should be an integrated part of the  acquisition life-cycle management process, and contract administration  should include monitoring contract deliverables. We found that FAA and  the SBSS contractor communicated about key milestones during the  acquisition process, and such communication contributes to the broad  goal of contract monitoring. For example, the contractor performed the  design-phase risk assessment (which detailed the methodology for  control selection), presented that assessment to FAA, and received  comments from FAA on the control selection process. However, FAA’s  ability to monitor SBSS’s contract deliverables was reduced by limitations  in the system’s work breakdown structure (WBS).
A WBS deconstructs the program’s end product into successive levels  with smaller elements until the work has been subdivided into a level  suitable for management control. The lowest, most detailed level of the  WBS is defined as the work package level. There were more than 50  work packages for SBSS, but our analysis found that the work packages  for SBSS primarily covered management issues for certification and  accreditation versus detailed security issues. Consequently, most of the  work packages did not address design and development activities for  specific, complex, technical-security requirement areas. Moreover, many  of the work packages’ project implementation activities were not formally  tracked or monitored. As a result of these issues, FAA could not  effectively monitor the contractor’s cost, schedule, and technical problems  associated with specific security requirements. The lack of specificity and  oversight unnecessarily increased the risk that weaknesses could occur.
SBSS’s contractors are also responsible for implementing security  controls to address weaknesses, but we found that in at least one case,  FAA did not exercise its oversight responsibility to provide the contractor  with sufficiently timely feedback on the plans of action (i.e., POA&Ms) that  detail which security controls should be adopted. Specifically, in 2013, the  contractor provided FAA with cost and schedule assessments associated  with 48 POA&Ms. However, despite attempts to solicit feedback, FAA did  not provide the contractor with timely feedback on this proposal for 5  months, when FAA declined the proposal. Instead, FAA determined it  would issue a new request for proposals based on more recent NIST  guidance (rev. 4) to address these controls.
As Data Comm is still under development, its security requirements and  selected controls continue to evolve. Officials stated that they work  closely with the contractor to ensure delivery against technical cost and  schedule requirements. For the security controls selected thus far, FAA is  able to trace the control to the associated security requirement, an ability  that indicates that FAA is exercising oversight in this area. We also found  that the Data Comm program also monitors system development and  security through a variety of meetings, such as monthly Program  Management reviews, quarterly Executive Committee meetings, bi- weekly Program Management Working Groups, and weekly Contracts  meetings. While the AMS does not delineate specific meeting frequency  or agenda requirements, the regularity and content from Data Comm’s  meetings aligns with the AMS guidance to monitor the contract  deliverables.
section_title: Conclusions
paragraphs: Through its NextGen initiative, FAA is shifting the ATC system from a  point-to-point communications system to an Internet-technology-based,  interconnected system, a process of changeover that increases  cybersecurity risks. FAA is making strides to address these risks,  including implementing an enterprise approach for protecting its systems  from cyber attack by both internal and external threats in accordance with  NIST and other cybersecurity leading practices; however, FAA has not  developed a holistic threat model that would describe the landscape of  security risks to FAA’s information systems. Such a model would inform  the ongoing implementation of FAA’s cybersecurity efforts to protect the  National Airspace System. Development of a threat model could require  significant resources and time, however, and FAA would first need to  assess the costs and time frames involved in such an effort. FAA has also  recognized that extensive changes to its information-security procedures  and some realignment of information security functions within its  organization are required to implement a secure, interconnected IP-based  ATC system, and has taken a number of steps in this direction. However,  the experts we consulted were concerned that FAA’s plans for  organizational realignment have not adequately considered the role of the  Office of Safety, which is responsible for certifying the avionics systems  aboard aircraft, including cybersecurity of those systems that enable  communication with air traffic control and that guide aircraft.
FAA’s acquisition management system is evolving to stay up-to-date on  federal cybersecurity guidance as FAA designs and develops NextGen  systems; and FAA has made significant strides in incorporating  requirements for security controls recommended by NIST guidelines into  its acquisition of these systems. While FAA generally followed many of  the NIST guidelines for establishing security controls in the two key  NextGen acquisitions we examined, we found instances where FAA  lacked assurance that security weaknesses were properly addressed. For  SBSS, FAA did not ensure that weaknesses identified during security  reviews were adequately tracked and in some cases were not resolved  on a timely basis. As a result, FAA lacked assurance that weaknesses  that could compromise system security were addressed, exposing  systems to potential compromise. FAA has taken steps to ensure future  incidents do not occur, such as creating a more robust remediation  system for tracking weaknesses. Also, for both systems, FAA has not yet  adopted, as directed by OMB, the latest security controls recommended  by NIST guidelines, which reflect updates to deal with the evolving  cybersecurity threat to information. Although FAA anticipates that SBSS  will adopt these controls in fiscal year 2016, the program has yet to  provide the funding to the contractor to implement the controls. Delays in  adopting the latest standards extend the amount of time that system  security requirements may not adequately mitigate system exposure to  the newest threats.
section_title: Recommendations
paragraphs: To better ensure that cybersecurity threats to NextGen systems are  addressed, the Secretary of Transportation should instruct the FAA  Administrator to take the following three actions.
As a first step to developing an agency-wide threat model, assess the  potential cost and timetable for developing such a threat model and  the resources required to maintain it.
Incorporate the Office of Safety into FAA’s agency-wide approach by  including it on the Cybersecurity Steering Committee.
Given the challenges FAA faces in meeting OMB’s guidance to  implement the latest security controls in NIST’s revised guidelines  within one year of issuance, develop a plan to fund and implement the  NIST revisions within OMB’s time frames.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to the Department of Transportation for  review and comment. The Department provided written comments, which  are reprinted in appendix II. The Department concurred with two of our  three recommendations. Specifically, FAA concurred with the  recommendation that it assess the potential cost and timetable for  developing an agency-wide threat model, and the recommendation that it  develop a plan to fund and implement NIST revisions within OMB  timeframes.
With regard to the recommendation to incorporate the Office of Safety  into FAA’s agency-wide approach by including it as a member on the  Cybersecurity Steering Committee, the Department believes that FAA has  already complied with the intent of the recommendation. According to the  Department, FAA has transferred cybersecurity personnel from the Office  of Safety to the Office of the Chief Information Officer, which manages  cybersecurity for all aviation safety information systems. The Department  also stated that FAA’s Chief Information Office works closely with the  Office of Safety on certification standards for non-FAA information  systems operating within the National Airspace System. We agree that  these actions will help in the execution and coordination of cybersecurity  activities involving the Office of Safety. However, we maintain that in  addition to these actions, the Office of Safety should be a member of the  Cybersecurity Steering Committee, which, as the department notes in its  letter, was established to lead FAA’s efforts to develop a comprehensive  cyber-risk management strategy, and to identify and correct both existing  and evolving vulnerabilities in all Internet protocol-based systems.  Because aircraft aviation systems are becoming increasingly connected  to systems outside the aircraft, the Office of Safety, which is responsible  for certifying aircraft systems, should be involved in agency-wide  cybersecurity efforts, including cybersecurity planning and vulnerability  identification, since such efforts may be crucial in conducting its  certification activities. As we state in the report, not including the Office of  Safety as a full member of the Committee could hinder FAA’s efforts to  develop a coordinated, holistic, agency-wide approach to cybersecurity.  This lack of involvement could result in omitting an FAA stakeholder that  has an understanding of specific technological changes in aircraft  traversing the NAS environment and how these changes might intersect  with changing ATC technologies and cybersecurity needs.
In its comments the Department stated that FAA is committed to  strengthening its capabilities to defend against new and evolving  cybersecurity threats. According to the Department, FAA is initiating a  comprehensive program to improve the cybersecurity defenses of the  NAS infrastructure, as well as other mission critical systems. The  Department’s letter lists a number of actions FAA has taken to improve  cybersecurity, many of which are described in this report. We applaud  FAA’s commitment to strengthening cybersecurity in the NAS, and agree  that the actions it has taken are important steps for FAA to take. We also  believe that addressing our recommendations will result in valuable  improvements to the information security of the NAS.
We are sending copies of this report to the Department of Transportation  and the appropriate congressional committees. In addition, the report will  be available at no charge on the GAO website at http://www.gao.gov.
If you or your staff members have any questions about this report, please  contact me on (202) 512-2834 or at dillinghamg@gao.gov. Contact points  for our Offices of Congressional Relations and Public Affairs may be  found on the last page of this report. Key contributors to this report are  listed in appendix IV.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The objectives of this report were to (1) identify the key challenges facing  FAA as it shifts to the NextGen ATC system and how FAA is addressing  those challenges and (2) assess the extent FAA and its contractors  followed federal guidelines for incorporating cybersecurity requirements in  its acquisition of NextGen programs.
To ascertain challenges FAA faces with NextGen and how FAA has  begun addressing these challenges, we obtained relevant security  documents from FAA and detailed descriptions of FAA’s cybersecurity  efforts from officials. We also selected a non-generalizable sample of 15  cybersecurity and aviation experts with varied experience—some of  whom have knowledge of FAA’s internal cybersecurity activities, policies,  and personnel. We then analyzed the information about FAA’s  cybersecurity efforts, synthesized it, and produced a document that we  provided to the experts for their review. FAA concurred that the document  was accurate. We then interviewed the experts, collecting information on  the cybersecurity challenges they think FAA faces and will face in the  NextGen transition. Interviewees also commented, to the extent they  were able, on the extent to which FAA’s cybersecurity activities and plans  address the identified challenges. We analyzed and synthesized these  responses, reporting on the numbers of experts who discussed particular  topics as well as the numbers of experts who agreed or disagreed on  particular messages. The experts from whom we obtained responses are  listed in table 1.
Separately, we also obtained the views of several aviation industry  officials, including officials from the Airlines for America, Airports Council  International—North America, Air Line Pilots Association, General  Aviation Manufacturers Association, Garmin, MITRE Corporation,National Air Traffic Controller Association, and the Boeing Corporation.  We also reviewed relevant reports issued by GAO, the Inspector General  of the Department of Transportation, and the National Academies.
To assess the extent to which FAA and its contractors, in the acquisition  of NextGen programs, have followed federal guidelines for incorporating  cybersecurity controls, we compared pertinent FAA policies, procedures,  and practices with selected federal information security laws and federal  guidance, including standards and guidelines from the National Institute  of Standards and Technology (NIST). In particular, we compared FAA’s  Acquisition Management System (AMS) against NIST’s risk management  guidelines and information technology-security guidelines (800-37) and  security considerations in software development life cycle (800-64) to  determine if FAA’s acquisition policy follows federal cybersecurity  guidelines for the six foundational NextGen programs: Surveillance and  Broadcast Services (SBSS); Collaborative Air Traffic Management  (CATM); Data Communications (Data Comm); NAS Voice Switch (NVS);  Common Support Service-Weather (CSS-Wx); and System Wide  Information Management (SWIM). The NextGen Foundational Programs  consist of different segments, also called builds; parts; and subsystems.  Some security activities take place at the program level, while others  apply to specific components of the program. We analyzed FAA’s  program documentation of key cybersecurity activities as described by  NIST and interviewed system managers to determine if FAA completed  the activities or has plans to complete the activities that were started but  not fully completed.
In addition, we chose two key NextGen acquisitions, SBSS and Data  Comm, for an in-depth review because of their importance to NextGen,  cost, and deployment status. SBSS has completed the acquisition cycle,  while Data Comm will allow for insight into how the process has changed  and what still might be an issue for upcoming programs. We assessed if  FAA had established and implemented a disciplined life-cycle  management approach integrated with information security by comparing  FAA’s policies for system life-cycle management and cybersecurity to  NIST guidance on security risk management system acquisition. We also  compared documentation of project activities and plans to these  requirements, and interviewed officials about FAA’s policies and FAA’s  information security practices. We assessed how well FAA and  contractors completed key cybersecurity activities and the extent to which  they complied with AMS and NIST requirements relating to cybersecurity.  We also compared documentation of project activities and plans to these  requirements, and interviewed agency officials about FAA’s policies and  information security practices. We also reviewed pertinent sections of  prior GAO reports related to cybersecurity. We performed our work at  FAA headquarters in Washington, D.C.; the Air Traffic Control Systems  Command Center in Warrenton, Virginia; and at an FAA contractor  location in Herndon, Virginia.
We determined that information provided by the federal and nonfederal  entities, such as the type of information contained within FAA’s security  assessments and Plans of Action and Milestones, was sufficiently reliable  for the purposes of our review. To arrive at this assessment, we  corroborated the information by comparing the plans with statements from  relevant agency officials.
We conducted this performance audit from September 2013 through  March 2015 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objective.
section_title: Appendix II: Comments from the Department of Transportation
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, Ed Laughlin, Assistant Director;  Gary Austin, Assistant Director; Nick Marinos, Assistant Director; Jake  Campbell; Bill Cook; Colin Fallon; Elke Kolodinski; Nick Nadarski; Josh  Ormond; Krzysztof Pasternak; and Alison Snyder made key contributions  to this report.