NextGen is a modernization effort begun in 2004 by FAA to transform the nation’s ground-based ATC system into a system that uses satellite- based navigation and other advanced technology. This effort is a multiyear, incremental transformation that will introduce new technologies and leverage existing technologies to affect every part of the NAS. These new technologies will use an Internet Protocol (IP) based network to See figure 1 below for a graphic illustration of the different communicate.parts of the NAS, the flow of information among them, and their transition to an IP-based network. According to FAA, the shift to NextGen technologies will require FAA to replace its proprietary, relatively isolated ATC computer systems with information systems that interoperate and share data throughout FAA’s operations and those of its aviation partners. These combined aviation operations are known as the enterprise. These new systems, which will be described in detail later in this report, will use IP-networking technologies to communicate across the enterprise. This transformation involves acquiring, certifying, and operating a vast network of navigation, communications, and surveillance systems, including information systems in the cockpits of thousands of aircraft (avionics); it will also employ digital and Internet-based computer-networking technologies, exposing the air- traffic control (ATC) system to new cybersecurity risks. NextGen comprises many programs that are in various stages of acquisition and deployment in the NAS. FAA classifies six programs as its foundational NextGen programs: Surveillance and Broadcast Services Subsystem (SBSS), Collaborative Air Traffic Management (CATM), Common Support Services Weather (CSS-Wx), Data Communications (Data Comm), NAS Voice Switch (NVS), and System Wide Information Management (SWIM) (see fig. 2). For the six programs we examined, FAA relies on contractors to assist with or complete most of the broad information technology and risk management activities. NIST, OMB, and FISMA state that regardless of whether a security task was performed by a contractor or by a federal agency, the federal agency is ultimately responsible for ensuring system security. The AMS requires that FAA program officials monitor the contractors’ performance in implementing contractual requirements, including those related to security. The Office of the Chief Information Security Officer within the Office of Finance and Management oversees cybersecurity across the three main areas of FAA activity known as domains (i.e., NAS ATC operations, Mission Support, and Research and Development ). This office provides operational security services to the Mission Support and R&D domains through efforts across FAA, as well as the Cyber Security Management Center (CSMC). The CSMC provides system monitoring and vulnerability remediation for FAA’s standard information-technology systems that support the agency. Mission- support information systems, such as email, are separate from the NAS and R&D domain systems. The Air Traffic Organization (ATO), the operational arm of FAA, implements and oversees cybersecurity measures for ATC information systems through several of its offices. The ATO’s NAS Security Risk Executive (Risk Executive) located in Technical Operations has responsibility for cybersecurity on all NAS ATC systems, including continuous monitoring, threat response coordination, and policy. According to FAA, the Risk Executive works internally with FAA’s Security and Hazardous Materials Office and NextGen offices, and externally with Department of Homeland Security (DHS) and airline stakeholders to provide an understanding of FAA’s critical mission and how it relates to other critical infrastructures. Another office within ATO, the NAS Cyber Operations unit, is responsible for monitoring some NAS systems, network data flows, and cyber events to detect anomalous and unauthorized cyber activities in the NAS domain. ATO’s Program Management Office is responsible for developing and fulfilling cybersecurity and all other system requirements for NAS information systems, including NextGen systems, through the acquisitions process. The Office of NextGen develops and disseminates cybersecurity policy on NextGen’s system engineering and controls, develops the NAS Enterprise Architecture, which is the agency’s long-term strategic plan for NextGen that includes, among other things, the information systems security (ISS) plans, and is responsible for the overall implementation of FAA’s NextGen initiative. The Office of Security and Hazardous Material Safety performs internal forensics investigations on computers that CSMC identifies as involved in activity that may compromise cybersecurity. The Office of Safety certifies the safety of all aircraft and aircraft equipment, including the software components for the avionics systems that could affect the safe operation of an aircraft. The Federal Information Security Management Act of 2002 (FISMA) established a comprehensive framework to better ensure the effectiveness of security controls over information resources that support federal operations and assets. FISMA requires each agency to develop, document, and implement an agency-wide information-security program, using a risk-based approach to determine and address cybersecurity requirements for information system management. Such a program includes planning, implementing, evaluating, and documenting remedial actions to address information security deficiencies. Federal cybersecurity guidelines, such as those published by NIST, strongly encourage agencies to implement information cybersecurity early in the process of developing information systems. In this manner, the cybersecurity requirements can change as needed and be integrated cost-effectively. NIST also provides a process for integrating information-security and risk-management activities into the system development process over the life of the system. Accordingly, NIST has developed a risk management framework of standards and guidelines for agencies to follow in developing information security programs. Relevant publications include the following: Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach provides a process that integrates information-security and risk-management activities into the system development’s life cycle including security categorization, security control selection and implementation, security control assessment, information system authorization, and security control monitoring of an information system. Security and Privacy Controls for Federal Information Systems and Organizationsfederal information systems and organizations, and a process for selecting controls to protect organizational operations, assets, individuals, other organizations, and the nation from a diverse set of threats including hostile cyber attacks, natural disasters, structural failures, and human errors. The guidance includes privacy controls to be used in conjunction with the specified security controls to achieve comprehensive security and privacy protection. provides a catalog of security and privacy controls for Security Considerations in the System Development Life Cyclepresents a framework for incorporating security across the life cycle of a system and describes a minimum set of security steps needed to effectively incorporate security into a system during its development. It is intended to help agencies select and acquire cost-effective security controls by explaining how to include information-system security requirements in the system development’s life cycle. In addition to these NIST publications, the Office of Management and Budget’s (OMB) Security of Federal Automated Information Resources establishes a minimum set of controls to be included in federal automated information-security programs; assigns federal agency responsibilities for the security of automated information; and links the agency’s automated information-security programs and the agency’s management control systems. FAA’s Acquisition Management System (AMS) provides policies and guidance for managing all of its acquisitions. The AMS serves as the framework for IT project management and risk evaluation to help ensure that systems are developed and maintained on time and within budget, and that they deliver the capabilities necessary to meet user requirements including the development and integration of cybersecurity controls. FAA faces cybersecurity challenges in at least three areas: (1) protecting its air traffic control (ATC) information systems, (2) securing aircraft avionics used to operate and guide aircraft, and (3) clarifying cybersecurity roles and responsibilities among multiple FAA offices. FAA has taken several steps to address these challenges, but cybersecurity experts suggested additional actions FAA could take to enhance cybersecurity. New networking technologies connecting FAA’s ATC information systems expose these systems to new cybersecurity risks, potentially increasing opportunities for systems to be compromised and damaged. Such damage could stem both from attackers seeking to gain access to and move among information systems, and from trusted users of the systems, such as controllers or pilots, who might inadvertently cause harm. FAA’s ATC-related information systems are currently a mixture of old, legacy systems and new, IP-networked systems. FAA’s legacy systems consist mainly of decades-old, point-to-point, hardwired information systems, such as controller voice-switching systems, that share information only within their limited, wired configuration. In contrast, FAA plans for NextGen call for the new information systems to be networked together with IP technology into an overarching system of interoperating subsystems. According to FAA officials and experts we consulted, the ease of access to these different types of systems, and the potential to damage them, varies. The older systems, depicted on the left in figure 3 below, are difficult to access remotely because few of them connect from FAA to external entities such as through the Internet. They also have limited lines of direct connection within FAA. Conversely, the new information systems for NextGen programs are designed to interoperate with other systems and use IP networking to communicate within FAA, as shown on the right in figure 3 below. According to experts, if one system connected to an IP network is compromised, damage can potentially spread to other systems on the network, continually expanding the parts of the system at risk. As shown in the figure, cybersecurity controls, if properly designed and effectively implemented, can make IP-networked systems more resilient against damage while allowing the systems to interoperate. According to MITRE, because the older systems had limited connectivity, they were generally not protected with cybersecurity controls. Once one of them is breached, it is easy to potentially damage that system, gain access to other systems with which it communicates, and potentially damage those systems as well.