Aviation securityTSA Blackberries vulnerable
The Transportation Security Administration’s (TSA) Blackberry mobile devices are vulnerable to cybersecurity threats due to a backlog of security patches and their configurations; with these vulnerabilities, hackers could exploit unsecured wireless networks to monitor data transmissions, execute denial of service attacks, alter messages, or even impersonate legitimate users to steal sensitive data provided by airline passengers
TSA blackberries are inadequately patched and secured // Source: alkanze.com
A recent DHS Inspector General report found that the Transportation Security Administration’s (TSA) Blackberry mobile devices were vulnerable to cybersecurity threats due to a backlog of security patches and their configurations.
Investigators found that TSA had secured itself against most vulnerabilities using physical and logical security access controls, but according to the report, agents “identified high-risk vulnerabilities involving patch and configuration controls.”
The report went on to say, “Improvements are needed to enhance the security of wireless components to fully comply with the department’s information security policies and better protect TSA’s and Federal Air Marshal Service’s wireless infrastructure against potential risks, threats, and exploits.”
With these vulnerabilities, hackers could potentially exploit unsecured wireless networks to monitor data transmissions, examine the flow of communications between parties, execute denial of service attacks, alter messages, or even impersonate legitimate users to steal sensitive data provided by airline passengers.
To address these security gaps, the report recommended that TSA revise its patch management process to install software patches more frequently and to enforce security policy for those individuals who do not properly secure their wireless systems and devices.
In response to these findings, TSA immediately enacted the report’s recommendations.
“The OIG (Office of Inspector General) audit team did identify high-risk vulnerabilities involving patch and configuration controls on two of the four systems tested,” wrote TSA head John Pistole in a letter to the inspector general’s office.
“The OIG recommends, and TSA concurs, that improvements are needed to further enhance the security of wireless components and the back-end infrastructure, and to fully comply with the department’s information security policies. All of the identified findings have been addressed or corrected. The OIG’s efforts are appreciated and have resulted in the increased protection of wireless infrastructure against potential risks, threats, and exploits for both TSA” and the Federal Air Marshal Service, Pistole said.
