Biometric Update reports that a recent Government Accountability Office (GAO) audit has identified significant shortcomings in the cybersecurity strategies of both the Federal Aviation Administration (FAA) and the Transportation Security Administration (TSA), raising concerns about the protection of critical aviation systems.The GAO audit found that the FAA has only fully implemented three out of seven objectives for protecting agency networks, with critical areas like cyber monitoring, response, and the transition to zero-trust security remaining incomplete. The TSA, meanwhile, relies on an outdated cybersecurity plan from 2018 that lacks clear assignment of responsibilities for securing airlines and airports, leading to confusion within the industry. Despite no reported successful cyberattacks on aircraft avionics, the broader aviation sector has faced numerous cyber threats, with reported incidents rising significantly between 2020 and 2022. Vulnerabilities include poor software patching and unsupported operating systems, which could disrupt communications and alter flight data.While the FAA’s aircraft certification process and ground system security received favorable findings, its zero-trust implementation plan needs further development. The TSA’s lack of clarity in its cybersecurity roadmap makes accountability and progress measurement difficult. GAO has recommended that both agencies update their strategies, assign clear responsibilities, and improve reporting and implementation monitoring to enhance the overall cybersecurity posture of the U.S. aviation system.Source: Biometric Update
