Objectives, Scope, and Methodology

The objectives of our review were to determine (1) whether FAA is effectively managing physical security at ATC facilities and systems security for its current operational systems, (2) whether FAA is effectively managing systems security for future ATC modernization systems, and (3) the effectiveness of FAA’s management structure and implementation of policy for computer security. FAA is not effectively managing physical security at ATC facilities. Known physical security weaknesses exist at many ATC facilities. ATC Operational System Security Is Ineffective and Systems Are Vulnerable

FAA policy requires that all ATC systems be certified and accredited. FAA officials told us that this assessment is an accurate depiction of the agency’s knowledge regarding operational systems security. Accordingly, less than 4 percent of the 90 operational systems are certified. For example, FAA’s officials responsible for maintaining the nine FAA-owned and leased communication networks told us that only one has been assessed. Sound overall security guidance, including a security architecture, security concept of operations, and security standards, is needed to ensure that well formulated security requirements are included in specifications for all new ATC systems. FAA’s Management Structure Is Not Effectively Implementing and Enforcing Computer Security Policy

FAA’s management structure and implementation of policy for computer security has been ineffective: the Office of Civil Aviation Security has not adequately enforced the security policies it has formulated; the Office of Air Traffic Services has not adequately implemented security policy for operational ATC systems; and the Office of Research and Acquisitions has not adequately implemented policy for new ATC systems development. FAA has not analyzed the threats and vulnerabilities, or developed safeguards to protect 87 of its 90 operational ATC computer systems and 8 of its 9 operational ATC telecommunications networks. FAA does not have a well-defined security architecture, a security concept of operations, or security standards, and does not consistently include well formulated security requirements in specifications for new ATC systems. None of the three organizations responsible for ATC security have discharged their respective security responsibilities effectively: the Office of Civil Aviation Security has not adequately enforced FAA policies that require the assessment of (1) physical security controls at all ATC facilities and (2) vulnerabilities, threats, and safeguards of all operational ATC computer systems; the Office of Air Traffic Services has not implemented FAA policies that require it to analyze all ATC systems for security vulnerabilities, threats, and safeguards; and the Office of Research and Acquisitions has not implemented FAA policy that requires it to formulate requirements for security in specifications for all new ATC modernization systems.
Why GAO Did This Study

Pursuant to a congressional request, GAO reviewed the Federal Aviation Administration's (FAA) computer security practices, focusing on: (1) whether FAA is effectively managing physical security at air traffic control (ATC) facilities and systems security for its current operational systems; (2) whether FAA is effectively managing systems security for future ATC modernization systems; and (3) the effectiveness of FAA's management structure and implementation of policy for computer security.

What GAO Found

GAO noted that: (1) FAA is ineffective in all critical areas included in GAO's computer security review--facilities physical security, operational systems information security, future systems modernization security, and management structure and policy implementation; (2) in the physical security area, known weaknesses exist at many ATC facilities; (3) FAA is similarly ineffective in managing systems security for its operational systems and is in violation of its own policy; (4) an October 1996 information systems security assessment concluded that FAA had performed the necessary analysis to determine system threats, vulnerabilities, and safeguards for only 3 of 90 operational ATC computer systems, or less than 4 percent; (5) FAA officials told GAO that this assessment is an accurate depiction of the current state of operational systems security; (6) according to the team that maintains FAA's telecommunications networks, only one of the nine operational ATC telecommunications networks has been analyzed; (7) without knowing the specific vulnerabilities of its ATC systems, FAA cannot adequately protect them; (8) FAA is also not effectively managing systems security for future ATC modernization systems; (9) it does not consistently include well formulated security requirements in specifications for all new ATC modernization systems, as required by FAA policy; (10) it does not have a well-defined security architecture, a concept of operations, or security standards, all of which are needed to define and ensure adequate security throughout the ATC network; (11) FAA's management structure and implementation of policy for ATC computer security is not effective; (12) security responsibilities are distributed among three organizations, all of which have been remiss in their ATC security duties; (13) the Office of Civil Aviation Security is responsible for developing and enforcing security policy, the Office of Air Traffic Services is responsible for implementing security policy for operational ATC systems, and the Office of Research and Acquisitions is responsible for implementing policy for ATC systems that are being developed; (14) the Office of Civil Aviation Security has not adequately enforced FAA's policies that require the assessment of physical security controls at all ATC facilities and vulnerabilities, threats, and safeguards for all operational ATC computer systems; and (15) the Office of Research and Acquisitions has not implemented the FAA policy that requires it to formulate requirements for security in specifications for all new ATC modernization systems.