This is not helping my aviophobia

By Chad Hemenway on March 5, 2015

???????????????

The Government Accountability Office recently found that the Federal Aviation Administration’s air traffic control systems remain terribly vulnerable to cyber and other threats.

The report was difficult for me to read and I can only assume the public version in my hands is far less frightening than the more detailed version provided to federal lawmakers. That’s fine. I don’t want any more details. Ignorance is bliss.

I am not a fan of flying. It’s a combination of many things. Start with claustrophobia. Add in a fear of heights, with a dash of I-really-have-no-idea-how-something-this-incredibly-heavy-is-soaring-above-the-clouds.

And now I am unfortunately aware that the complex and highly automated systems which keep these giant defiers of gravity in the air are vulnerable to cyberattack.

Gulp.

I mean, the report is called, “FAA Needs to Address Weaknesses in Air Traffic Control Systems.” It really doesn’t get any more direct than that. But if you need more: “…significant security control weaknesses remain, threatening the [FAA’s] ability to ensure the safe and uninterrupted operation of the national airspace system (NAS).”

And until the FAA “effectively implements security controls, establishes stronger agency-wide information security risk management processes, fully implements its NAS information security program, and ensures that remedial actions are addressed in a timely manner,” the weaknesses identified will continue, the GAO said.

Interestingly the GAO compared the FAA’s policies and procedures with available guidance including the National Institute of Standards and Technology (NIST) guidelines for critical infrastructure cybersecurity.

The FAA set up multiple firewalls to prevent unauthorized access to systems but NIST also recommends monitoring and controlling communications at the boundaries of NAS systems, with careful management of how systems connect to external networks. These connections are not always protected, the GAO said. Additionally, some servers and applications supporting NAS systems did not have sufficient password controls, sensitive data was not encrypted, and the FAA did not make sure users had authorized access to air traffic control systems.

There’s more, but the fact is the FAA’s cybersecurity is not good. The GAO made 168 recommendations to address 60 findings in another report with limited distribution.

I’m never going to be comfortable with flying no matter how often I do it. This report certainly doesn’t help. My impression after reading it is that the FAA’s cybersecurity has little to do with there not being a major breach, but probably more to do with the fact someone hasn’t really tried.

Chad Hemenway is Managing Editor of Advisen News. He has more than 15 years of journalist experience at a variety of online, daily, and weekly publications. He has covered P&C insurance news since 2007, and he has experience writing about all P&C lines as well as regulation and litigation. Chad won a Jesse H. Neal Award for Best Single Article in 2014 for his coverage of the insurance implications of traumatic brain injuries and Best News Coverage in 2013 for coverage of Superstorm Sandy. Contact Chad at 212.897.4824 or [email protected].