Op-ed: FAA Outage Raises Questions on National Security Systems

On the evening of Jan. 10, 2023, problems arose with the Federal Aviation Administration (FAA) system that notifies pilots of hazards in the air and on the ground. FAA officials rebooted the system early the following morning, Jan. 11, just before 7:30 a.m., and ordered airlines to delay all departing flights. The pause in takeoffs was lifted around 9:00 a.m., by which time delays had cascaded through the system; by that afternoon, about 9,000 flights had been delayed, and 1,300 had been canceled [1].

The system that malfunctioned, NOTAM, or Notice to Air Missions, was created in 1947. NOTAM informs pilots about changes in airspace and at the airports – flights cannot take off if NOTAM is not operational [2]. According to a preliminary report from the FAA, the problem – and the subsequent shutdown – occurred because “some files were accidentally deleted while the staff was trying to connect synchronization between the live primary database and a backup database” [3]. 

The real issue exposed by this shutdown is that the FAA failed to follow their own guidelines and procedures. If the FAA did a risk analysis and assessment of the NOTAM system, it would have exposed the single point of failure that brought down a critical system. The NOTAM system is obviously a critical system because its failure brought down the whole commercial flight system in the U.S. and affected flights worldwide.

Hackers now know that they can find other areas in which a simple file change or database query can bring down the FAA’s systems and, as a result, ground our commercial fleet. FAA systems are not fail-safe.

The fact that this was able to happen within a system that could shut down air traffic across the United States should be surprising, but it isn’t because FAA systems are now shown as not fail-safe. The system in question is 75 years old, and there has been plenty of time in the evolution of the system to make it fail-safe. What happened to the FAA was just a bigger and more public example of what happens every day: organizations – government and business alike – rely on critical systems with no risk analysis, and many suffer for it. In a recent survey, 45% of respondents reported that they experience an outage with a high business impact about once a week, and 29% of those outages take an hour or more to correct. Another survey reports that the average cost of a significant IT outage is $6,912 per minute, or more than $400,000 per hour in large organizations [4].

In the Department of Defense (DoD), meanwhile, according to a recent report from the agency’s inspector general (IG), there are open cybersecurity recommendations dating as far back as 2012 still awaiting action. The IG report suggests that implementing open recommendations would be a big step in protecting this part of the nation’s security system. I agree, and as a longtime professional in the field, I’d like to offer a couple of suggestions.

One has to do with priorities: What’s the most important thing a particular system does? In the case of the FAA, I would guess that protecting aircraft and the people in and around them would be very close to the top. When you have a system component as essential as NOTAM, you should have a mirror system ready to take over in the case of, say, consultants accidentally deleting files. It must, by definition, be designed not to fail. (What the DoD might have that belongs in that category, I will leave to your imagination.)

My other related suggestion is the adoption of a cybersecurity system based on Zero Trust resource planning. Zero Trust’s job is to verify, on a constant basis, that at any given moment, the people, devices, and applications on a network are properly authorized to be there and to have a complete view of the organization’s overall risk position [5]. Network definition, application security, Zero Trust cybersecurity, risk assessment, and risk management are interrelated. If our government had been running on the basis of Zero Trust in January, it would have seen through a risk assessment that there was a single point of failure in NOTAM and would have been ready, if the file were corrupted, to switch over to a backup in real time and with no interruption.

We’re a long way from implementation of Zero Trust. Gartner, who studies this subject, says that although many organizations have implemented a Zero Trust model within their cybersecurity strategy, only 1% of companies meet the definition of true Zero Trust. There are a lot of challenges:

1. A slight flaw in the system architecture can make the entire model useless.
2. No product in the market can, by itself, make an enterprise Zero Trust. It has to be designed by the system’s engineers and architects.
3. Legacy enterprise systems and technologies may not adapt to the Zero Trust model because they have unsupported software infrastructure and hardware.
4. All Zero-Trust models require ongoing updates, maintenance, and regular audits. [6]

With all that said, I want to emphasize that the tools necessary to do all of these things – and to make cyberstructure much, much better (and in the end, much cheaper) – exist, and I encourage you to learn about them. In the meantime, blue skies, and here’s hoping none of your flights get canceled.

References

1. Chokshi, Niraj and Walker, Mark, 2023, “F.A.A. Outage Highlights Fragility of the Aviation System,” The New York Times, January 11, https://www.nytimes.com/2023/01/11/business/faa-flight-delays-outage.html.
2. Fazio, Patrick and Capitanini, Lisa, 2023, “What Is NOTAM? Here Are the Details about the Program That Led to a Shutdown of Flights Nationwide,” NBC Chicago, January 11, nbcchicago.com/news/local/what-is-notam-here-are-the-details-about-the-program-that-led-to-a-shutdown-of-flights-nationwide/3043175/.
3. “Staff ‘Accidentally’ Deleted Some Files Causing Outage and Grounding over 11,000 Flights: FAA.” WION, wionews.com/world/staff-accidentally-deleted-some-files-causing-outrage-that-grounded-over-11000-flights-faa-554293.
4. Golden, Pete, 2023, “FAA Outage: System Downtime Puts an Entire Industry on Hold,” APMdigest, January 18, https://www.apmdigest.com/faa-outage-system-downtime-puts-an-entire-industry-on-hold.
5. Choppa, William, 2023, “Zero Trust: The Phrase We All Need to Learn,” SMERCONISH, January 30, smerconish.com/exclusive-content/zero-trust-the-phrase-we-all-need-to-learn/.
6. “Only 1% of Companies Meet the Definition of Zero Trust,” 2023, Packetlabs, March 3, packetlabs.net/posts/1-percent-meet-the-definition-of-zero-trust/.