U.S. air traffic control system 'open to hackers'

The report released yesterday by the U.S. Government Accountability Office, identified significant security weaknesses that "threaten the integrity, confidentiality, and availability of Federal Aviation Administration systems - including weaknesses in controls that are designed to prevent, limit, and detect access to these systems."

"The agency has not adequately managed its networks, software updates, user accounts and passwords, and user privileges, nor has it consistently logged security relevant events," the GAO found.

The report also found that other security controls, including physical security, background investigations, segregation of duties, and system changes, also showed signs of weakness, increasing the risk that unauthorized users could breach the FAA's air-traffic control systems, potentially disrupting aviation operations.

"The proprietary features of these systems cannot fully protect them from attacks by disgruntled current or former employees who are familiar with these features nor will they keep out more sophisticated hackers," said Gregory Wilshusen, GAO director of information security issues and chief author of the report.

FAA CIO Daniel Mehan, commented on the draft version of the report and said the problems identified by the report "are not necessarily indicative of the security posture of the air traffic control system as a whole."

The GAO recommended 12 actions the FAA needed to undertake, including ensuring that risk assessments are completed and implementation of the FAA's plan to deploy intrusion detection capabilities for portions of the network infrastructure that are not currently covered.

The FAA said it will consider the recommendations and indicated that all security findings for air traffic control systems, including those from the report, "are evaluated and prioritized for action."

Last month, SC Magazine reported that data mining efforts at five federal agencies did not follow all rules for ensuring privacy of personal information, according to the GAO.

www.gao.gov