United States Government Publishing Office publisher pbl distributor dst United States Government Accountability Office Accounting and Information Management Division author aut Government Organization text government publication eng GAOREPORTS Legislative Agency Publications gao legislative 2010-08-12 U.S. Government Printing Office 1998-05-18 monographic deposited born digital 22 p. GA 1.13:AIMD-98-155 https://www.govinfo.gov/app/details/GAOREPORTS-AIMD-98-155 P0b002ee18039ed71 f:ai98155 DGPO 2010-08-12 2011-03-24 GAOREPORTS-AIMD-98-155 machine generated eng fdlp REPORT GAOREPORTS-AIMD-98-155 AIMD-98-155 Computer security Air traffic control systems Transportation safety Systems conversions Internal controls Facility security Information resources management Aviation Letter Report AIMD Pursuant to a congressional request, GAO reviewed the Federal Aviation Administration's (FAA) computer security practices focusing on: (1) whether FAA is effectively managing physical security at air traffic control (ATC) facilities and systems security for its current operational systems; (2) whether FAA is effectively managing systems security for future ATC modernization systems; and (3) the effectiveness of FAA's management structure and implementation of policy for computer security.<p/>GAO noted that: (1) FAA is ineffective in all critical areas included in GAO's computer security review--facilities physical security, operational systems information security, future systems modernization security, and management structure and policy implementation; (2) in the physical security area, known weaknesses exist at many ATC facilities; (3) FAA is similarly ineffective in managing systems security for its operational systems and is in violation of its own policy; (4) an October 1996 information systems security assessment concluded that FAA had performed the necessary analysis to determine system threats, vulnerabilities, and safeguards for only 3 of 90 operational ATC computer systems, or less than 4 percent; (5) FAA officials told GAO that this assessment is an accurate depiction of the current state of operational systems security; (6) according to the team that maintains FAA's telecommunications networks, only one of the nine operational ATC telecommunications networks has been analyzed; (7) without knowing the specific vulnerabilities of its ATC systems, FAA cannot adequately protect them; (8) FAA is also not effectively managing systems security for future ATC modernization systems; (9) it does not consistently include well formulated security requirements in specifications for all new ATC modernization systems, as required by FAA policy; (10) it does not have a well-defined security architecture, a concept of operations, or security standards all of which are needed to define and ensure adequate security throughout the ATC network; (11) FAA's management structure and implementation of policy for ATC computer security is not effective; (12) security responsibilities are distributed among three organizations, all of which have been remiss in their ATC security duties; (13) the Office of Civil Aviation Security is responsible for developing and enforcing security policy, the Office of Air Traffic Services is responsible for implementing security policy for operational ATC systems, and the Office of Research and Acquisitions is responsible for implementing policy for ATC systems that are being developed; (14) the Office of Civil Aviation Security has not adequately enforced FAA's policies that require the assessment of physical security controls at all ATC facilities and vulnerabilities, threats, and safeguards for all operational ATC computer systems; and (15) the Office of Research and Acquisitions has not implemented the FAA policy that requires it to formulate requirements for security in specifications for all new ATC modernization systems. https://www.govinfo.gov/content/pkg/GAOREPORTS-AIMD-98-155/html/GAOREPORTS-AIMD-98-155.htm https://www.govinfo.gov/content/pkg/GAOREPORTS-AIMD-98-155/pdf/GAOREPORTS-AIMD-98-155.pdf GAO/AIMD-98-155 https://www.govinfo.gov/app/details/GAOREPORTS-AIMD-98-155 Letter Report GAO/AIMD-98-155; Air Traffic Control: Weak Computer Security Practices Jeopardize Flight Safety; Computer security Air traffic control systems Transportation safety Systems conversions Internal controls Facility security Information resources management Aviation Volume 110 Page 684 110 Stat. 684 Public Law 100-235 Public Law 104-13 Public Law 104-106