The Transportation Security Administration (TSA) has some “high-risk vulnerabilities” when it comes to implementing patch and configuration controls for its wireless networks and devices but “overall” the security of these systems and devices is effective, the Department of Homeland Security (DHS) Inspector General (IG) says in a new report.
“We did not detect any high-risk vulnerabilities on its wireless network infrastructure or rogue or unauthorized wireless networks or devices attributed to TSA or the Federal Air Marshal Service,” says the report, Improvements in Patch and Configuration Management Controls Can Better Protect TSA’s Wireless Network and Devices (OIG-11-99). A redacted version of the report was released yesterday.
“In addition, an intrusion detection system has been implemented to monitor wireless activity,” the report says. “Further, FAMS has actively worked to secure its infrastructure from the risks associated with wireless and Bluetooth devices.”
As for the high-risk vulnerabilities associated with patch and configuration controls, the report says “Improvements are needed to enhance the security of wireless components to fully comply with the department’s information security policies and better protect TSA’s and the Federal Air Marshal Service’s wireless infrastructure against potential risks, threats and exploits.”
The IG’s recommendations include making sure that security patches are put in place in a timely manner and to revise the management process for patching network security so that they can be deployed more quickly.
In conducting its audit the IG used special scanning hardware and software to detect signal leakage, find rogue access points or unauthorized wireless networks at selected facilities.