Thu, May 07, 2009
OK, In This Day And Age... Who Isn't?
A report (FI-2009-049) from the Department of Transportation's
office of the Inspector General is raising the alarm over the
potential vulnerabilities of the nations air traffic system to
damage and interference by hackers.
The IG's Office claims that, "we issued our report on Federal
Aviation Administration (FAA) web applications security and
intrusion detection in air traffic control (ATC) systems, requested
by the Ranking Minority Members of the full House Transportation
and Infrastructure Committee and its Aviation Subcommittee. The
objectives of this performance audit were to determine whether (1)
web applications used in supporting ATC operations were properly
secured to prevent unauthorized access to ATC systems, and (2)
FAA’s network intrusion–detection capability was
effective in monitoring ATC cyber–security incidents."
The IG adds that, "We found that web applications used in
supporting ATC systems operations were not properly secured to
prevent attacks or unauthorized access. During the audit, our staff
gained unauthorized access to information stored on web application
computers and an ATC system, and confirmed system vulnerability to
malicious code attacks. In addition, FAA had not established
adequate intrusion–detection capability to monitor and detect
potential cyber security incidents at ATC facilities. The
intrusion–detection system has been deployed to only 11 (out
of hundreds of) ATC facilities. Also, cyber incidents detected were
not remediated in a timely manner."
The report explains a bit more about
their concerns by stating that 'The need to protect ATC systems
from cyber attacks requires enhanced attention because the Federal
Aviation Administration (FAA) has increasingly turned toward the
use of commercial software and Internet Protocol (IP)1-based
technologies to modernize ATC systems. While use of commercial IP
products, such as Web applications,2 has enabled FAA to efficiently
collect and disseminate information to facilitate ATC services, it
inevitably poses a higher security risk to ATC systems than when
they were developed primarily with proprietary software. Now,
attackers can take advantage of software vulnerabilities in
commercial IP products to exploit ATC systems, which is especially
worrisome at a time when the Nation is facing increased threats
from sophisticated nation-state-sponsored cyber attacks.'
More News
Airbus Racer Demonstrator Makes Inaugural Flight Airbus Helicopters' ambitious Racer demonstrator has achieved its inaugural flight as part of the Clean Sky 2 initiative, a corners>[...]
A little Bit Quieter, Said Testers, But in the End it's Still a DA40 Diamond Aircraft recently completed a little pilot project with Lufthansa Aviation Training, putting a pair of >[...]
Line Up And Wait (LUAW) Used by ATC to inform a pilot to taxi onto the departure runway to line up and wait. It is not authorization for takeoff. It is used when takeoff clearance >[...]
Contributing To The Accident Was The Pilot’s Use Of Methamphetamine... Analysis: The pilot departed on a local flight to perform low-altitude maneuvers in a nearby desert val>[...]
From 2015 (YouTube Version): Overcoming Obstacles To Achieve Their Dreams… At EAA AirVenture 2015, FedEx arrived with one of their Airbus freight-hauling aircraft and placed>[...]
Airbus Racer Helicopter Demonstrator First Flight Part of Clean Sky 2 Initiative
See All