FAA Cybersecurity Weaknesses Exposed by GAO Report

• •GAO identified significant cybersecurity weaknesses in FAA's aircraft communications.
• •FAA has not completed risk assessments or developed real-time monitoring for spectrum threats.
• •Malicious actors could exploit these vulnerabilities, leading to potential flight safety issues.

The GAO reported that the FAA has not adequately addressed cybersecurity threats to aircraft communications, particularly vulnerabilities related to spoofing and jamming. Despite identifying electromagnetic spectrum threats, the FAA has failed to complete necessary risk assessments and develop real-time monitoring capabilities. The report highlights weaknesses in communication applications used by the FAA and aviation stakeholders, which could allow malicious actors to intercept or spoof communications, potentially leading to flight delays or safety issues. GAO issued nine recommendations for improving FAA's cybersecurity management and collaboration with federal and non-federal partners. The FAA has acknowledged these vulnerabilities and agreed to the recommendations, but has not fully implemented key elements of a risk-based cybersecurity program. The report emphasizes the need for better coordination and information sharing to mitigate risks affecting aviation communications.