This system, known as the National Airspace System (NAS),  includes air traffic control systems, ATC procedures, operational facilities,  aircraft, and the people who certify, operate, and maintain them. Our previous reports, and  Recent federal guidance demonstrates that securing critical  infrastructures from internal and external threats is a national priority. The  order also directed the National Institute of Standards and Technology  (NIST) to develop a technology-neutral voluntary framework for improving  critical infrastructure cybersecurity. Security Weaknesses Place Air Traffic Control Systems at Risk

Although FAA has taken steps to safeguard its air traffic control systems,  significant security control weaknesses remain in NAS systems and  networks, threatening the agency’s ability to adequately fulfill its mission. Additionally, significant  interconnectivity exists between non-NAS systems and the NAS  operational environment, increasing the risk from these weaknesses. A key reason for both the technical  control weaknesses and the security management weaknesses is that  FAA had not fully established an integrated, organization-wide approach  to managing information security risk that is aligned with its mission. An agency can accomplish this by designing and implementing controls  that are intended to prevent, limit, and detect unauthorized access to  computer resources (e.g., data, programs, equipment, and facilities),  thereby protecting them from unauthorized disclosure, modification, and  loss. Although FAA had issued security policies, it did not consistently protect  its network boundary from possible intrusions; identify and authenticate  users; authorize access to resources; ensure that sensitive data are  encrypted; or audit and monitor actions taken on NAS systems and  networks. FAA Did Not Fully Implement Its Information Security Program, Limiting the Effectiveness of Information Security Controls

An entity-wide information security program is the foundation of a security  control structure and a reflection of senior management’s commitment to  addressing security risks. FISMA requires each agency to develop,  document, and implement an information security program that, among  other things, includes policies and procedures that (1) are based on risk assessments, (2)  cost-effectively reduce information security risks to an acceptable  level, (3) ensure that information security is addressed throughout the  life cycle of each system, and (4) ensure compliance with applicable  requirements;  security awareness training to inform personnel of information security  risks and of their responsibilities in complying with agency policies  and procedures, as well as training personnel with significant security  responsibilities for information security; periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls  for every system identified in the agency’s required inventory of major  information systems; a process for planning, implementing, evaluating, and documenting  remedial actions to address any deficiencies in information security  policies, procedures, or practices; procedures for detecting, reporting, and responding to security plans and procedures to ensure continuity of operations for  information systems that support the operations and assets of the  agency. Inadequate Agency-Wide Information Security Risk Management Processes Contribute to Weaknesses in Security Controls and Security Management

One important reason for many of the weaknesses in security controls as  well as the security program shortcomings identified in our review is that  FAA has not yet fully established an integrated, organization-wide  approach to managing information security risk. Specifically, the FAA Chief Information  Security Officer stated that in November 2013, the agency established a  risk executive function at the agency level in the form of a Cyber Security  Steering Committee. However,  FAA has not yet fully established the governance structures and practices  necessary for ensuring that its information security risk management  decisions are aligned strategically with its mission. Specifically:  FAA has not clearly and consistently established roles and  responsibilities for information security for NAS systems. Significant  changes in the NAS environment, such as the increased reliance on IP  networks, increased connectivity between systems, the introduction of  NextGen systems, and the designation of the NAS as part of the nation’s  critical infrastructure, have changed the level and nature of the  information security risks facing air traffic control systems. Until FAA establishes stronger agency-wide information security risk  management processes, fully develops its NAS information security  program, and ensures that remedial actions are addressed in a timely  manner, the weaknesses that we identified are likely to continue, placing  the safe and uninterrupted operation of the nation’s air traffic control  system at increased and unnecessary risk. We are also making 168 recommendations to address 60 findings in a  separate report with limited distribution. Using the requirements identified by the Federal Information Security  Management Act of 2002, which establishes key elements for an effective  agency-wide information security program, and associated NIST  guidelines and agency requirements, we evaluated the FAA’s information  security program by analyzing processes and documentation that were part of FAA’s  information security risk management processes to determine the  extent to which the process sufficiently supported the agency’s  mission and operations; examining system security plans to determine whether they described  the security controls in place or planned for meeting the security  requirements of the system; examining security awareness training records to determine whether  employees and contractors had received training according to FAA  policy and federal guidance; analyzing security testing and evaluation results for four systems to  determine whether testing of management, operational, and technical  controls was sufficient to conclude that controls were in place and  operating effectively; examining remedial action plans for four systems to determine  whether FAA addressed identified vulnerabilities in a timely manner; examining contingency plans and contingency test results for selected  systems to determine whether those plans were appropriately  documented and had been sufficiently tested; and  reviewing FAA’s processes for identifying and responding to  information security incidents to determine whether FAA has  implemented an effective incident response capability for its air traffic  control systems. These included  FAA’s employee background investigation data.
Why GAO Did This Study

In support of its mission, FAA relies on the NAS—one of the nation's critical infrastructures—which is comprised of air traffic control systems, procedures, facilities, aircraft, and people who operate and maintain them. Given the critical role of the NAS and the increasing connectivity of FAA's systems, it is essential that the agency implement effective information security controls to protect its air traffic control systems from internal and external threats.
GAO was asked to review FAA's information security program. Specifically, the objective of this review was to evaluate the extent to which FAA had effectively implemented information security controls to protect its air traffic control systems. To do this, GAO reviewed FAA policies, procedures, and practices and compared them to the relevant federal law and guidance; assessed the implementation of security controls over FAA systems; and interviewed officials. This is a public version of a report containing sensitive security information. Information deemed sensitive has been redacted.

What GAO Found

While the Federal Aviation Administration (FAA) has taken steps to protect its air traffic control systems from cyber-based and other threats, significant security control weaknesses remain, threatening the agency's ability to ensure the safe and uninterrupted operation of the national airspace system (NAS). These include weaknesses in controls intended to prevent, limit, and detect unauthorized access to computer resources, such as controls for protecting system boundaries, identifying and authenticating users, authorizing users to access systems, encrypting sensitive data, and auditing and monitoring activity on FAA's systems. Additionally, shortcomings in boundary protection controls between less-secure systems and the operational NAS environment increase the risk from these weaknesses.
FAA also did not fully implement its agency-wide information security program. As required by the Federal Information Security Management Act of 2002, federal agencies should implement a security program that provides a framework for implementing controls at the agency. However, FAA's implementation of its security program was incomplete. For example, it did not always sufficiently test security controls to determine that they were operating as intended; resolve identified security weaknesses in a timely fashion; or complete or adequately test plans for restoring system operations in the event of a disruption or disaster. Additionally, the group responsible for incident detection and response for NAS systems did not have sufficient access to security logs or network sensors on the operational network, limiting FAA's ability to detect and respond to security incidents affecting its mission-critical systems.
The weaknesses in FAA's security controls and implementation of its security program existed, in part, because FAA had not fully established an integrated, organization-wide approach to managing information security risk that is aligned with its mission. National Institute of Standards and Technology guidance calls for agencies to establish and implement a security governance structure, an executive-level risk management function, and a risk management strategy in order to manage risk to their systems and information. FAA has established a Cyber Security Steering Committee to provide an agency-wide risk management function. However, it has not fully established the governance structure and practices to ensure that its information security decisions are aligned with its mission. For example, it has not (1) clearly established roles and responsibilities for information security for the NAS or (2) updated its information security strategic plan to reflect significant changes in the NAS environment, such as increased reliance on computer networks.
Until FAA effectively implements security controls, establishes stronger agency-wide information security risk management processes, fully implements its NAS information security program, and ensures that remedial actions are addressed in a timely manner, the weaknesses GAO identified are likely to continue, placing the safe and uninterrupted operation of the nation's air traffic control system at increased and unnecessary risk.

What GAO Recommends

GAO is making 17 recommendations to FAA to fully implement its information security program and establish an integrated approach to managing information security risk. In a separate report with limited distribution, GAO is recommending that FAA take 168 specific actions to address weaknesses in security controls. In commenting on a draft of this report, FAA concurred with GAO's recommendations.