The Transportation Security Administration (TSA) in the US has announced an emergency amendment to the security programs of certain TSA-regulated airports and aircraft operators.
The announcement seeks to implement the Biden administration’s National Cybersecurity Strategy which calls for building a more resilient national critical infrastructure.
“Protecting our nation’s transportation system is our highest priority and TSA will continue to work closely with industry stakeholders across all transportation modes to reduce cybersecurity risks and improve cyber resilience to support safe, secure, and efficient travel,” said TSA Administrator David Pekoske. “This amendment to the aviation security programs extends similar performance-based requirements that currently apply to other transportation system critical infrastructure.”
The TSA collaborated extensively with aviation partners to develop this amendment, which is designed to strengthen cybersecurity measures in the aviation sector and follows a similar announcement made in October 2022 for passenger and freight railroad carriers.
The TSA has taken this action due to the persistent cybersecurity threats against US critical infrastructure, particularly in the aviation sector.
In the fall of 2022, US airport websites suffered a cyberattack, and pro-Russian hacking groups listed multiple U.S. airports as targets.
In previous years, groups within China launched attacks on the website of Vietnam Airlines.
These incidents highlight the vulnerability of critical infrastructure to cyber threats and the need for increased cybersecurity measures to prevent disruption and degradation of infrastructure operations. The new amendment aims to improve the cybersecurity resilience of TSA-regulated entities and reduce the risk of cyber attacks against the transportation sector.
Ibrahim Memis, the Head of Cyber Security at BEUMER Group, asserts that the TSA amendment is an important milestone. He suggests that airports and their suppliers should acknowledge this development and take steps to enhance their cybersecurity resilience accordingly.
“This amendment by TSA sets an excellent example for other organizations, demonstrating that cybersecurity should be an ongoing and active aspect of operations,” says Ibrahim Memis. “It is not a one-time exercise but a continuous effort to monitor and assess risks and vulnerabilities and take appropriate actions to address them.”
According to Memis, both airports and their suppliers must continuously work together to ensure the security and resilience of critical infrastructure throughout the aviation industry’s supply chain.
“It’s crucial to implement the processes and policies you have established and maintain them continuously,” he says. “You need to regularly monitor and keep track of what’s happening, conduct lessons learned, and strive for continuous improvement within your organization. At BEUMER, cyber security is a strategic topic discussed at the top management level.”
Per Engelbrechtsen, Business Development Director at BEUMER Group, echoes that it is crucial for everyone involved to maintain a proactive approach to cybersecurity, constantly adapting to new threats rather than relying on static policies on paper.
“This highlights the significance of working with an organization whose primary responsibility is to ensure that cybersecurity is an ongoing and active aspect of operations,” says Per Engelbrechtsen. “Hackers are not deterred by documents and procedures.”
Ibrahim Memis emphasizes the significance of adopting an internationally recognized framework for Information Security Management System:
“Complying with an international standard means the organisation has a set of requirements for establishing, implementing, maintaining, and continually improving an information security management system. Compliance with an international standard helps organisations to identify, assess, and mitigate information security risks and provide assurance to customers and stakeholders that their information is protected”.
Overall, the TSA’s amendment aligns with several of the key requirements of the ISO 27001 standard, an internationally recognized framework for Information Security Management System (ISMS). It provides a systematic approach for organizations to manage and protect their sensitive information through a risk management process, helps organizations to identify, assess, and mitigate information security risks, and provides assurance to customers and stakeholders that their information is protected.
Ibrahim Memis views the alignment of the TSA amendment with ISO 27001 standards as a significant achievement. He recommends that airports and their suppliers recognize this progress and implement measures to strengthen their cybersecurity resilience accordingly.
“The TSA amendment focuses on fundamental cyber hygiene to establish a baseline level of security,” he says. “The ISO 27001 is widely regarded as the go-to global standard for most organizations, including BEUMER Group, which recently obtained certification”
The TSA amendment is designed to enhance cybersecurity measures in the aviation sector due to ongoing cybersecurity threats to critical US infrastructure, particularly in aviation.
To comply with the TSA’s new amendment, airports can follow the four major steps outlined in the announcement and align their compliance obligations with the ISO 27001 standard and work collaboratively with their suppliers to ensure the security and resilience of critical infrastructure.
“The TSA’s request aligns with standard designs for protecting organizations, technology, and products across regions,” says Ibrahim Memis. “Adapting to these best practices is already common practice, but now it’s becoming a legal obligation. Therefore, being ISO certified provides a solid basis for compliance with these evolving legal requirements.”
