Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe

TSA, FAA Requirements Emphasize Cybersecurity for Airport and Aircraft Operators and Airport Terminal Projects: How Tenable Can Help

TSA, FAA Requirements Emphasize Cybersecurity for Airport and Aircraft Operators and Airport Terminal Projects: How Tenable Can Help

The TSA and FAA are making cybersecurity a priority for airport and aircraft operators and for airport terminal projects to prevent disruption and degradation to their infrastructure. Here's what you need to know — and how Tenable can help.

The U.S. Transportation Security Administration (TSA) and the Federal Aviation Administration (FAA) are each taking steps to prioritize cybersecurity for the aviation sector. 

On March 7, 2023, the Transportation Security Administration (TSA) issued new cybersecurity requirements in response to ongoing threats against critical infrastructure, including the aviation sector. The FAA, meanwhile, is requiring airport terminal projects to incorporate cybersecurity into their plans to be eligible for the discretionary grant program which offers funds to airport terminal operators.

The new TSA rules require airport and aircraft operators to develop an approved implementation plan that describes measures they are taking to improve their cybersecurity resilience and prevent disruption and degradation to their operational technology (OT) and IT infrastructure. The rules also require organizations to proactively assess the effectiveness of these measures. The plans must:

  1. Develop network segmentation policies and controls to ensure that OT systems can continue to safely operate in the event that an IT system has been compromised, and vice versa;
  2. Create access control measures to secure and prevent unauthorized access to critical cyber systems;
  3. Implement continuous monitoring and detection policies and procedures to defend against, detect and respond to cybersecurity threats and anomalies that affect critical cyber system operations; and
  4. Reduce the risk of exploitation of unpatched systems through the application of security patches and updates for operating systems, applications, drivers and firmware on critical cyber systems in a timely manner using a risk-based methodology.

These new TSA rules provide specific cybersecurity requirements designed to prevent and defend against cyberthreats. Previously, TSA required airport and aircraft operators to take basic steps, such as reporting significant cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency (CISA), establishing a cybersecurity point of contact, developing and adopting a cybersecurity incident response plan and completing a cybersecurity vulnerability assessment.

Cybersecurity must be a consideration to receive FAA Airport Terminal Program funding

The FAA also prioritizes cybersecurity, stating that every aspect of its current strategy “considers ways to strengthen the agency’s overall approach to new technologies and actively engages in preventing future cybersecurity incidents.” In its FY 2023 Notice of Funding Opportunity for the Airport Terminal Program (ATP), the FAA is now requiring that applicants “must demonstrate … effort to consider and address physical and cyber security risks relevant to the transportation mode and type and scale of the project.” 

ATP is a competitive discretionary grant program that provides approximately $1 billion in grant funding annually for five years (fiscal years 2022-2026) to upgrade, modernize and rebuild airport terminals and airport-owned Airport Traffic Control Towers (ATCTs). The FAA recently awarded $1 billion in FY 2023 ATP grants to 99 airports across the country. A list of all of the FY 2023 ATP grantees is here.

Tenable OT Security enables airports and aircraft operators to identify and prioritize cyber vulnerabilities 

Security and compliance for airports, aircraft operators and airport terminal projects all need to start with visibility. By getting an inventory of IT and OT assets on their networks, users can see a complete picture of the assets and how they are interconnected. Tenable’s Vulnerability Priority Rating (VPR) scoring generates vulnerability and risk levels using intelligence gained for each asset on the OT network. Reports include detailed insights, along with mitigation suggestions. This enables authorized personnel to quickly identify the highest risk for priority remediation before attackers can exploit vulnerabilities. 

Tenable OT Security, previously known as Tenable.ot, offers comprehensive security tools and reports for IT and OT security personnel. With it, airport and aircraft operators gain unmatched visibility across IT/OT operations and deep situational awareness across all global sites and their respective assets — from Windows servers to PLC backplanes — in a single interface. Tenable provides complete visibility into your entire attack surface while measuring and controlling cyber risk across global OT and IT systems. 

Airports and aircraft operators can use Tenable OT Security to protect their industrial networks from cyberthreats.

How Tenable can help states meet the new TSA cybersecurity requirements

Check out the table below to see how Tenable can help airport and aircraft operators meet the exposure management requirements included in the TSA’s cybersecurity requirements.

REQUIREMENT NUMBER CYBERSECURITY PLAN REQUIREMENT TENABLE SOLUTION
1 Implement network segmentation policies and controls to ensure that the OT system can continue to safely operate in the event that an IT system has been compromised. Asset visibility in segmented OT networks: Segmenting a network limits how far an attack can spread by limiting access privileges. However, segmentation also limits visibility of devices. Tenable OT Security discovers how devices communicate and what protocols they leverage, providing a contextual asset inventory that is critical for securing an OT environment. Additionally, users can identify high risk IT assets an attacker would target and then prioritize actions to mitigate risk.
3 Implement continuous monitoring and detection policies and procedures to detect cybersecurity threats and connect anomalies that affect operations. Detect intrusions, anomalies and device configuration changes: Tenable OT Security leverages multiple detection methodologies to alert on threats coming from external and internal sources. It identifies changes made to controller configurations, even if done directly on the device by a human or malware. Tenable OT Security monitors for unauthorized changes and alerts key stakeholders. It provides extended information for a comprehensive audit trail, resulting in faster incident response and forensic investigations.
4 Reduce the risk of exploitation of unpatched systems through the application of security patches and updates for operating systems, applications, drivers and firmware on critical cyber systems in a timely manner using a risk-based methodology. Identify known exploits and mitigate risk:Tenable OT Security offers complete visibility, security and compliance enabling airports and aircraft operators to mitigate risk. Tenable OT Security uses CVSS scores as a standardized view of vulnerabilities across the environment. In addition, a Vulnerability Prioritization Rating (VPR) helps practitioners identify the high risk systems and vulnerabilities to focus on, making the best use of your security team’s time during a maintenance window.

(Source: Tenable, April 2023)

Register now for our webinar 'New TSA Aviation Cybersecurity Regulations Have Landed. How Do They Impact Your Airport or Airline? Get Advice from Tenable and Brock Solutionson May 18 at 2 pm ET.
 

Learn more



 

Related Articles

Cybersecurity News You Can Use

Enter your email and never miss timely alerts and security guidance from the experts at Tenable.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Try Tenable Web App Scanning

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable One Exposure Management platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Your Tenable Web App Scanning trial also includes Tenable Vulnerability Management and Tenable Lumin.

Buy Tenable Web App Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try Tenable Lumin

Visualize and explore your exposure management, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Your Tenable Lumin trial also includes Tenable Vulnerability Management and Tenable Web App Scanning.

Buy Tenable Lumin

Contact a Sales Representative to see how Tenable Lumin can help you gain insight across your entire organization and manage cyber risk.

Try Tenable Nessus Professional Free

FREE FOR 7 DAYS

Tenable Nessus is the most comprehensive vulnerability scanner on the market today.

NEW - Tenable Nessus Expert
Now Available

Nessus Expert adds even more features, including external attack surface scanning, and the ability to add domains and scan cloud infrastructure. Click here to Try Nessus Expert.

Fill out the form below to continue with a Nessus Pro Trial.

Buy Tenable Nessus Professional

Tenable Nessus is the most comprehensive vulnerability scanner on the market today. Tenable Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Select Your License

Buy a multi-year license and save.

Add Support and Training

Try Tenable Nessus Expert Free

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Tenable Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Tenable Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Select Your License

Buy a multi-year license and save more.

Add Support and Training