2). FAA’s Shift to NextGen Implementation Raises Cybersecurity Challenges That FAA Has Taken Some Steps to Address

FAA faces cybersecurity challenges in at least three areas: (1) protecting  its air traffic control (ATC) information systems, (2) securing aircraft  avionics used to operate and guide aircraft, and (3) clarifying  cybersecurity roles and responsibilities among multiple FAA offices. We reported in January 2015 that FAA has taken steps to protect its ATC  systems from cyber-based threats. However, we stated that significant  security-control weaknesses remain that threaten the agency’s ability to  ensure the safe and uninterrupted operation of the national airspace  system. GAO-15-221. FAA officials said that FAA has not produced a plan to develop an  enterprise-wide threat model but has made some initial steps toward  developing such a model. FAA officials told us that they have not  determined the funding or time that would be needed to develop such a  model or identified the resources needed to implement it. FAA officials and experts we interviewed said that modern aircraft are  also increasingly connected to the Internet, which also uses IP- networking technology and can potentially provide an attacker with  remote access to aircraft information systems. FAA’s Office of Safety (AVS) is responsible for certifying the airworthiness  of new aircraft and aviation equipment, including software components for  avionics systems. For instance, AVS issues cybersecurity- related rules for aircraft and has begun reviewing rulemaking on  cybersecurity, but AVS is not included in developing the agency-wide  approach for information systems security and has no representative on  the Cybersecurity Steering Committee. We  selected these because of their importance to NextGen, cost, and  deployment status. Although FAA adhered to aspects of federal guidance  on control selection, assessment, and weakness remediation, its  implementation of these risk management activities could be or could  have been improved. Systems with  weaknesses that could be exploited by these adversaries may be at  increased risk if relevant controls in the new NIST guidelines are not  implemented. FAA is making strides to address these risks,  including implementing an enterprise approach for protecting its systems  from cyber attack by both internal and external threats in accordance with  NIST and other cybersecurity leading practices; however, FAA has not  developed a holistic threat model that would describe the landscape of  security risks to FAA’s information systems. Such a model would inform  the ongoing implementation of FAA’s cybersecurity efforts to protect the  National Airspace System. FAA’s acquisition management system is evolving to stay up-to-date on  federal cybersecurity guidance as FAA designs and develops NextGen  systems; and FAA has made significant strides in incorporating  requirements for security controls recommended by NIST guidelines into  its acquisition of these systems. Specifically, FAA concurred with the  recommendation that it assess the potential cost and timetable for  developing an agency-wide threat model, and the recommendation that it  develop a plan to fund and implement NIST revisions within OMB  timeframes. Because aircraft aviation systems are becoming increasingly connected  to systems outside the aircraft, the Office of Safety, which is responsible  for certifying aircraft systems, should be involved in agency-wide  cybersecurity efforts, including cybersecurity planning and vulnerability  identification, since such efforts may be crucial in conducting its  certification activities. As we state in the report, not including the Office of  Safety as a full member of the Committee could hinder FAA’s efforts to  develop a coordinated, holistic, agency-wide approach to cybersecurity. According to the Department, FAA is initiating a  comprehensive program to improve the cybersecurity defenses of the  NAS infrastructure, as well as other mission critical systems. Appendix I: Objectives, Scope, and Methodology

The objectives of this report were to (1) identify the key challenges facing  FAA as it shifts to the NextGen ATC system and how FAA is addressing  those challenges and (2) assess the extent FAA and its contractors  followed federal guidelines for incorporating cybersecurity requirements in  its acquisition of NextGen programs. To assess the extent to which FAA and its contractors, in the acquisition  of NextGen programs, have followed federal guidelines for incorporating  cybersecurity controls, we compared pertinent FAA policies, procedures,  and practices with selected federal information security laws and federal  guidance, including standards and guidelines from the National Institute  of Standards and Technology (NIST).
Why GAO Did This Study

FAA is responsible for overseeing the national airspace system, which comprises ATC systems, procedures, facilities, and aircraft, and the people who operate them. FAA is implementing NextGen to move the current radar-based ATC system to one that is based on satellite navigation and automation. It is essential that FAA ensures effective information-security controls are incorporated in the design of NextGen programs to protect them from threats.
GAO was asked to review FAA's cybersecurity efforts. This report (1) identifies the cybersecurity challenges facing FAA as it shifts to the NextGen ATC system and how FAA has begun addressing those challenges, and (2) assesses the extent to which FAA and its contractors, in the acquisition of NextGen programs, have followed federal guidelines for incorporating cybersecurity controls. GAO reviewed FAA cybersecurity policies and procedures and federal guidelines, and interviewed FAA officials, aviation industry stakeholders, and 15 select cybersecurity experts based on their work and recommendations by other experts.

What GAO Found

As the agency transitions to the Next Generation Air Transportation System (NextGen), the Federal Aviation Administration (FAA) faces cybersecurity challenges in at least three areas: (1) protecting air-traffic control (ATC) information systems, (2) protecting aircraft avionics used to operate and guide aircraft, and (3) clarifying cybersecurity roles and responsibilities among multiple FAA offices.
As GAO reported in January 2015, FAA has taken steps to protect its ATC systems from cyber-based threats; however, significant security-control weaknesses remain that threaten the agency's ability to ensure the safe and uninterrupted operation of the national airspace system. FAA has agreed to address these weaknesses. Nevertheless, FAA will continue to be challenged in protecting ATC systems because it has not developed a cybersecurity threat model. NIST guidance, as well as experts GAO consulted, recommend such modeling to identify potential threats to information systems, and as a basis for aligning cybersecurity efforts and limited resources. While FAA has taken some steps toward developing such a model, it has no plans to produce one and has not assessed the funding or time that would be needed to do so. Without such a model, FAA may not be allocating resources properly to guard against the most significant cybersecurity threats.
Modern aircraft are increasingly connected to the Internet. This interconnectedness can potentially provide unauthorized remote access to aircraft avionics systems. As part of the aircraft certification process, FAA's Office of Safety (AVS) currently certifies new interconnected systems through rules for specific aircraft and has started reviewing rules for certifying the cybersecurity of all new aircraft systems.
FAA is making strides to address the challenge of clarifying cybersecurity roles and responsibilities among multiple FAA offices, such as creating a Cyber Security Steering Committee (the Committee) to oversee information security. However, AVS is not represented on the Committee but can be included on an ad-hoc advisory basis. Not including AVS as a full member could hinder FAA's efforts to develop a coordinated, holistic, agency-wide approach to cybersecurity.
FAA's acquisition management process generally aligned with federal guidelines for incorporating requirements for cybersecurity controls in its acquisition of NextGen programs. For example, the process included the six major information-technology and risk-management activities as described by NIST. Timely implementation of some of these activities could have been improved based on their importance to NextGen, cost, and deployment status. The Surveillance and Broadcast Services Subsystem (SBSS)—which enables satellite guidance of aircraft and is currently deployed in parts of the nation—has not adopted all of the April 2013 changes to NIST security controls, such as intrusion detection improvements, although the Office of Management and Budget guidance states that deployed systems must adopt changes within one year. Systems with weaknesses that could be exploited by adversaries may be at increased risk if relevant controls are not implemented.

What GAO Recommends

GAO recommends that FAA: 1) assess developing a cybersecurity threat model, 2) include AVS as a full member of the Committee, and 3) develop a plan to implement NIST revisions within OMB's time frames. FAA concurred with recommendations one and three, but believes that AVS is sufficiently involved in cybersecurity. GAO maintains that AVS should be a member of the Committee.