	Background

FAA is an agency of the Department of Transportation (DOT); one of its  central missions is to ensure safe, orderly, and efficient air travel in the  national airspace system. The air traffic control systems are very complex and highly automated. Although Progress Has Been Made, Air Traffic Control Systems Remain Vulnerable

Although FAA has made progress in implementing information security for  its air traffic control systems by establishing an agencywide information  security program and addressing many of its previously identified security  weaknesses, significant control weaknesses threaten the integrity,  confidentiality, and availability of those systems and information. As a result, FAA’s air traffic  control systems remain vulnerable to unauthorized access, use,  modification, and destruction that could disrupt aviation operations. Agency officials also pointed out that because major portions  of air traffic control systems consist of custom-built, older equipment with  special-purpose operating systems, proprietary communication interfaces,  and custom-built software, the possibilities for unauthorized access are  limited and therefore mitigate the risks. In addition, the systems’  proprietary features do not provide protection from attack by disgruntled  current and former employees who understand them, or from more  sophisticated hackers. These weaknesses increase the risk of  unauthorized access to and modification of FAA’s information systems and  of disruption of service. Information Security Program Is Not Yet Fully Implemented

A key reason for the information security weaknesses that we identified in  FAA’s air traffic control systems was that the agency had not yet fully  implemented its information security program to help ensure that effective  controls were established and maintained. FISMA requires agencies to implement an information security program  that includes  periodic assessments of the risk and the magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems;  policies and procedures that (1) are based on risk assessments, (2) cost- effectively reduce risks, (3) ensure that information security is  addressed throughout the life cycle of each system, and (4) ensure  compliance with applicable requirements;  plans for providing adequate information security for networks,  facilities, and systems;  security awareness training to inform personnel—including contractors  and other users of information systems—of information security risks  and of their responsibilities in complying with agency policies and  procedures;  at least annual testing and evaluation of the effectiveness of information  security policies, procedures, and practices relating to management,  operational, and technical controls of every major information system  that is identified in the agencies’ inventories;  a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in their information security  policies, procedures, or practices;  procedures for detecting, reporting, and responding to security   plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency. If continuity of operations controls are inadequate, even a relatively minor  interruption could result in significant adverse nationwide impact on air  traffic. These include weaknesses in electronic  access controls, for example, in managing networks, system patches, user  accounts and passwords, and user rights and in logging and auditing  security-relevant events. Weaknesses in physical security, background  investigations, segregation of duties, and application change controls  increase the level of risk. Although FAA has initiatives under way  to address these areas, further efforts are needed to fully implement them.
Why GAO Did This Study

The Federal Aviation Administration (FAA) performs critical functions that contribute to ensuring safe, orderly, and efficient air travel in the national airspace system. To that end, it operates and relies extensively on an array of interconnected automated information systems and networks that comprise the nation's air traffic control systems. These systems provide information to air traffic controllers and aircraft flight crews to help ensure the safe and expeditious movement of aircraft. Interruptions of service by these systems could have a significant adverse impact on air traffic nationwide. Effective information security controls are essential for ensuring that the nation's air traffic control systems are adequately protected from inadvertent or deliberate misuse, disruption, or destruction. Accordingly, GAO was asked to evaluate the extent to which FAA has implemented information security controls for these systems.

What GAO Found

FAA has made progress in implementing information security for its air traffic control information systems; however, GAO identified significant security weaknesses that threaten the integrity, confidentiality, and availability of FAA's systems--including weaknesses in controls that are designed to prevent, limit, and detect access to these systems. The agency has not adequately managed its networks, software updates, user accounts and passwords, and user privileges, nor has it consistently logged security-relevant events. Other information security controls--including physical security, background investigations, segregation of duties, and system changes--also exhibited weaknesses, increasing the risk that unauthorized users could breach FAA's air traffic control systems, potentially disrupting aviation operations. While acknowledging these weaknesses, agency officials stated that the possibilities for unauthorized access were limited, given that the systems are in part custom built and that they run on older equipment that employs special-purpose operating systems, proprietary communication interfaces, and custom-built software. Nevertheless, the proprietary features of these systems cannot fully protect them from attacks by disgruntled current or former employees who are familiar with these features, nor will they keep out more sophisticated hackers. A key reason for the information security weaknesses that GAO identified in FAA's air traffic control systems is that the agency had not yet fully implemented its information security program to help ensure that effective controls were established and maintained. Although the agency has initiatives under way to improve its information security, further efforts are needed. Weaknesses that need to be addressed include outdated security plans, inadequate security awareness training, inadequate system testing and evaluation programs, limited security incident-detection capabilities, and shortcomings in providing service continuity for disruptions in operations. Until FAA has resolved these issues, the information security weaknesses that GAO has identified will likely persist.