FAA Lacks Sufficient Security Controls and Contingency Planning for Its DroneZone System

Submitting OIG:

Report Description:

What We Looked At In 2012, Congress directed the Federal Aviation Administration (FAA) to develop a plan for the safe integration of unmanned aircraft systems (UAS)—also known as drones—into the National Airspace System. As part of its integration and oversight of UAS, FAA compiles data in its UAS registration service—known as FAA DroneZone—as well as in its Low Altitude Authorization and Notification Capability (LAANC), an automated system that authorizes registered UAS users to fly their drones near airports. Both DroneZone and LAANC are cloud-based systems that contain sensitive data provided by the general public, including personally identifiable information (PII). We initiated this audit to determine whether FAA’s UAS registration system has the proper security controls and recovery procedures in place. Our audit objectives were to (1) assess the effectiveness of FAA’s UAS registration system security controls, including controls to protect PII, and (2) determine whether FAA’s contingency planning limits the effects caused by the loss of DroneZone during disruptions of service. What We Found FAA has not effectively ensured that DroneZone and LAANC have adequate security—including privacy—controls. For example, FAA has continued to authorize DroneZone operations without conducting a comprehensive assessment of its security controls since it first began to operate the system in 2015. In addition, FAA’s inadequate monitoring of security controls and use of unauthorized cloud systems increases the risk of the systems being compromised. Furthermore, FAA could not demonstrate that 24 of 26 privacy controls were assessed to protect 1.5 million DroneZone users’ PII. We also found that FAA’s contingency planning does not adequately limit the effects caused by a potential disruption of services. Finally, FAA does not have sufficient controls for handling backups and off-site storage to ensure continuous operations and maintain data availability. Our Recommendations FAA concurred with all 13 of our recommendations to improve the security of the DroneZone and LAANC systems and privacy of user information.

Date Issued:

Wednesday, April 15, 2020

Agency Reviewed / Investigated:

Department of Transportation

Submitting OIG-Specific Report Number:

IT2020027

Component, if applicable:

Federal Aviation Administration

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Additional Details Link:

https://www.oig.dot.gov/library-item/37830

Recommendation Number	Recommendation Status	Significant Recommendation	Additional Details
2	Open	Yes	https://www.oig.dot.gov/library-item/37830
Update the security assessment documents for DroneZone and LAANC to reflect the results of all security controls (e.g., common, hybrid, and system-specific) for selection, implementation, and assessing, per DOT requirements.
5	Open	Yes	https://www.oig.dot.gov/library-item/37830
Develop Standard Operating Procedures for the use of common and hybrid controls to include at a minimum: a.) System owners must review the cloud provider Control Implementation Summary report to verify and document what controls are the customer's versus the cloud provider's. b.) System owners must review monthly cloud provider POA&Ms and develop a risk mitigation strategy or compensating controls to address any identified vulnerabilities that may impact its system cybersecurity posture. c.) System owners must coordinate with FAA common/hybrid control providers to verify the controls' actual implementation status and document them accurately in the appropriate security document.
9	Open	Yes	https://www.oig.dot.gov/library-item/37830
Develop and implement a process for testing DroneZone information systems for contingency planning, to include business impact analysis continuity of operations plans, business continuity plans, disaster recovery plans, and Information System Contingency Planning (ISCP).
10	Open	Yes	https://www.oig.dot.gov/library-item/37830
Develop a process to annually document FAA security officials communicating all contingency planning development, planning, and recovery activities to all stakeholders and executive management prior to authorizing officials making risk-based decisions.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

Open

Yes

https://www.oig.dot.gov/library-item/37830

Update the security assessment documents for DroneZone and LAANC to reflect the results of all security controls (e.g., common, hybrid, and system-specific) for selection, implementation, and assessing, per DOT requirements.

Open

Yes

https://www.oig.dot.gov/library-item/37830

Develop Standard Operating Procedures for the use of common and hybrid controls to include at a minimum: a.) System owners must review the cloud provider Control Implementation Summary report to verify and document what controls are the customer's versus the cloud provider's. b.) System owners must review monthly cloud provider POA&Ms and develop a risk mitigation strategy or compensating controls to address any identified vulnerabilities that may impact its system cybersecurity posture. c.) System owners must coordinate with FAA common/hybrid control providers to verify the controls' actual implementation status and document them accurately in the appropriate security document.