FAA is an agency of the Department of Transportation (DOT); one of its central missions is to ensure safe, orderly, and efficient air travel in the national airspace system. FAA’s quarterly administrator’s fact book for March 2005 reports that, in 2004, air traffic in the national airspace system exceeded 46 million flights and 647 million people. According to the agency’s 2004 annual performance report for its air traffic organization, Year One—Taking Flight, at any one time as many as 7,000 aircraft—both civilian and military—could be aloft over the United States (see fig. 1). More than 36,000 employees support the operations that help move aircraft through the national airspace system. The agency’s ability to fulfill its mission depends on the adequacy and reliability of its air traffic control systems, a vast network of computer hardware, software, and communications equipment. These systems reside at, or are associated with, several types of facilities: air traffic control towers, Terminal Radar Approach Control facilities, Air Route Traffic Control Centers (or en route centers), and the Air Traffic Control System Command Center. According to FAA, Four hundred eighty-eight air traffic control towers (see fig. 2) manage and control the airspace within about 5 miles of an airport. They control departures and landings as well as ground operations on airport taxiways and runways. One hundred seventy Terminal Radar Approach Control facilities provide air traffic control services for airspace that is located within approximately 40 miles of an airport and generally up to 10,000 feet above the airport, where en route centers’ control begins. Terminal controllers establish and maintain the sequence and separation of aircraft. Twenty-one en route centers control planes over the United States—in transit and during approaches to some airports. Each center handles a different region of airspace. En route centers operate the computer suite that processes radar surveillance and flight planning data, reformats it for presentation purposes, and sends it to display equipment that is used by controllers to track aircraft. The centers control the switching of voice communications between aircraft and the center as well as between the center and other air traffic control facilities. Two en route centers also control air traffic over the oceans. The Air Traffic Control System Command Center (see fig. 3) manages the flow of air traffic within the United States. This facility regulates air traffic when weather, equipment, runway closures, or other conditions place stress on the national airspace system. In these instances, traffic management specialists at the command center take action to modify traffic demands in order to keep traffic within system capacity. As aircraft move across the national airspace system, controllers manage their movements during each phase of flight. See figure 4 for a visual summary of air traffic control over the United States and its oceans. The air traffic control systems are very complex and highly automated. These systems process a wide range of information, including radar, weather, flight plans, surveillance, navigation/landing guidance, traffic management, air-to-ground communication, voice, network management, and other information—such as airspace restrictions—that is required to support the agency’s mission. To support its operational management functions, the agency relies on several interconnected systems to process and track flights around the world. In order to successfully carry out air traffic control operations, it is essential that FAA’s systems interoperate, functioning both within and across facilities as one integrated system of systems. Each type of facility that we described in the previous section consists of numerous interrelated systems. For example, each of the en route centers, according to FAA officials, relies on 16 systems to perform mission-critical information processing and display, navigation, surveillance, communications, and weather functions. In addition, systems from different facilities interact with each other so that together they can successfully execute the entire air traffic control process. For example, systems integrate data on aircraft position from surveillance radars with data on flight destination from flight planning data systems, for use on controllers’ displays. As FAA modernizes its air traffic control systems, information security will become even more critical. The agency’s modernization efforts are designed to enhance the safety, capacity, and efficiency of the national airspace system through the acquisition of a vast network of radar, navigation, communications, and information processing systems. Newer systems use digital computer networking and telecommunications technologies that can create new vulnerabilities and expose them to risks that must be assessed and mitigated to ensure adequate protection. New vulnerabilities may also result from FAA’s increasing reliance on commercially available hardware and software and from growing interconnectivity among computer and communication systems. Increasing interconnection increases the extent to which systems become vulnerable to intruders, who may severely disrupt operations or manipulate sensitive information. The administrator has designated the CIO as the focal point for information system security within the agency. The CIO is responsible for overseeing the development of the information security program, including oversight of information security policies, architectures, concepts of operation, procedures, processes, standards, training, and plans. This responsibility is delegated to the Office of Information Systems Security, whose mission is to protect the agency’s infrastructure through leadership in innovative information assurance initiatives. In addition, the agency has established Information System Security Manager positions, with more detailed information security responsibilities, within FAA’s various lines of business, such as the air traffic organization. We have previously reported information security weaknesses at FAA. For instance, in December 2000, we reported that the agency had physical security vulnerabilities, ineffective operational systems security, inadequate service continuity efforts, an ineffective intrusion detection capability, and ineffective personnel security. We also noted that the agency had not yet implemented its information security program. Information system controls are an important consideration for any organization that depends on computerized systems and networks to carry out its mission or business. These controls should provide adequate protections against outside as well as inside threats. It is especially important for government organizations, such as FAA, where maintaining the public trust is essential. Inadequately protected systems are at risk of intrusion by individuals or groups with malicious intent, who could use their illegitimate access to obtain sensitive information, disrupt operations, or launch attacks against other computer systems and networks. Since 1997, we have designated information security as a governmentwide high-risk area. Our previous reports, and those of agency inspectors general, describe persistent information security weaknesses that place a variety of federal operations at risk of disruption, fraud, and inappropriate disclosure. Congress and the executive branch have taken actions to address the risks associated with persistent information security weaknesses. In December 2002, Congress enacted the Federal Information Security Management Act (FISMA), which is intended to strengthen the information security of federal systems. In addition, the administration has taken important steps to improve information security, such as integrating it into the President’s Management Agenda Scorecard. Moreover, the Office of Management and Budget (OMB) and the National Institute of Standards and Technology (NIST) have issued security guidance to federal agencies. The objective of our review was to determine the extent to which FAA had implemented information security for its air traffic control systems. Our evaluation was based on (1) our Federal Information System Controls Audit Manual, which contains guidance for reviewing information system controls that affect the integrity, confidentiality, and availability of computerized data; (2) previous reports from DOT’s Office of Inspector General (OIG); and (3) FISMA, which sets key elements that are required for an effective information security program. Specifically, we evaluated information system controls that are intended to protect resources, data, and software from unauthorized access; prevent the introduction of unauthorized changes to application and provide segregation of duties in the areas of application programming, system programming, computer operations, information security, and quality assurance; ensure recovery of computer processing operations in case of disaster or other unexpected interruption; and ensure an adequate information security program. To evaluate these controls, we identified and reviewed pertinent DOT and FAA security policies and procedures. In addition, to determine whether information system general controls were in place, adequately designed, and operating effectively, we conducted vulnerability testing and assessments of systems from within the agency’s network. We also held discussions with agency staff to gain an understanding of FAA’s processes and controls. In addition, in order to take advantage of their prior work in this area, we held discussions with OIG staff and reviewed recent information security reports pertaining to air traffic control systems. Because the OIG had recently reviewed the system used by controllers to ensure the safe separation of aircraft, we did not include that system in our review. We performed our review at FAA headquarters and tested operational and management controls at three other sites. At two additional sites, we tested these controls and, in addition, tested technical controls for three critical air traffic control systems. The limited distribution report contains further details on the scope of our review. This review was performed from March 2004 through June 2005 in accordance with generally accepted government auditing standards. Although FAA has made progress in implementing information security for its air traffic control systems by establishing an agencywide information security program and addressing many of its previously identified security weaknesses, significant control weaknesses threaten the integrity, confidentiality, and availability of those systems and information. In the systems we reviewed, we identified 36 weaknesses in electronic access controls and in other areas such as physical security, background investigations, segregation of duties, and application change controls. A key reason for these weaknesses is that the agency has not yet fully implemented an information security program. As a result, FAA’s air traffic control systems remain vulnerable to unauthorized access, use, modification, and destruction that could disrupt aviation operations. A basic management objective for any organization is to protect the resources that support its critical operations from unauthorized access. Organizations accomplish this objective by designing and implementing electronic controls that are intended to prevent, limit, and detect unauthorized access to computing resources, programs, and information. Electronic access controls include those related to network management, patch management, user accounts and passwords, user rights and file permissions, and audit and monitoring of security-relevant events.