What Are the New Transportation Security Administration (TSA) Requirements?

Access Control 

Access control is about more than just ‘guarding the gates’ to your organization with passwords. While they are important, it is also about knowing who ‘holds the keys’ and why they have access. Many organizations overlook this and give everyone the same amount of access, which can increase the likelihood of a breach. A better approach is to look at access control as having three areas: technical controls, administrative controls, and physical controls.  

Technical controls are the mechanisms and systems that directly manage access to an organization's technology infrastructure. These controls serve as the first line of defense in preventing unauthorized access to networks and systems. Through the use of identification and authentication methods, such as passwords, biometric scans, and security tokens, technical controls ensure that only authorized individuals can access sensitive information and critical systems. This layer of security is crucial in protecting against external threats and mitigating the risk of data breaches. 

Administrative controls focus on the governance of security policies and procedures within an organization. This area involves the establishment of rules, roles, and responsibilities regarding how access to information and resources is granted and managed. The challenge for many organizations lies in crafting clear, enforceable policies that dictate who has access to what resources and how that access is facilitated. Effective administrative controls include comprehensive documentation and policies that guide the implementation of security measures, facilitate auditing processes, and provide a basis for analyzing and improving security postures after an incident. 

Physical controls, often underestimated in their importance, are about the tangible measures taken to prevent unauthorized physical access to an organization's facilities and resources. This includes locks, security personnel, badge access systems, and surveillance cameras. In specific settings, like airports, physical controls might also involve protocols such as requiring escorts in certain areas to enhance security. These controls are essential in protecting physical assets, including servers, workstations, and sensitive documents from theft, vandalism, and unauthorized access. 

Together, these three types of controls create a robust security framework that addresses a wide range of vulnerabilities and threats. By integrating technical, administrative, and physical controls, organizations can establish a multi-layered defense strategy that protects against both digital and physical intrusions, ensuring the safety and integrity of their critical assets. 

Monitoring and Detection 

Monitoring and detection are essential in defending against cyber threats, particularly due to the unpredictable timing of cyber-attacks. Bad actors often launch attacks outside of standard working hours, targeting organizations during weekends and holidays when cybersecurity teams are less likely to be on guard. A strategic response to this challenge is the implementation of continuous monitoring. Deploying a managed detection and response (MDR) system ensures comprehensive surveillance and the proactive identification of suspicious activities across your network around the clock. 

The new TSA directive identifies monitoring and detection as its most comprehensive requirement, presenting significant challenges for airports. This aspect of cybersecurity encompasses several critical components, including the integration of security log analysis, the execution of digital forensics, and the capacity for rapid incident response. Despite the complexity and effort required to establish these capabilities, the investment is invaluable. Such vigilance enables airports to pre-emptively address cyber threats, safeguarding the organization before any real damage occurs. 

Moreover, the implementation of sophisticated monitoring and detection strategies offers profound benefits that significantly surpass the initial investment and effort. By establishing these advanced systems, airports can significantly enhance their cybersecurity posture. This not only ensures the protection of operations from the evolving landscape of cyber threats but also underpins the integrity and reliability of crucial infrastructure. This proactive stance is vital for minimizing potential disruptions and maintaining operational and safety standards. 

While adopting comprehensive monitoring and detection measures in line with TSA mandates may seem challenging, the long-term advantages make it a necessary endeavor. Such measures not only fortify airports against immediate threats but also contribute to a resilient cybersecurity framework capable of adapting to future challenges. This ensures ongoing protection against potential cyber incidents that could otherwise compromise both operations and safety. 

Patch Management 

When was the last time you updated your laptop or phone? Installing updates is something we often push back, delaying it until it is absolutely necessary. Unfortunately, this is often the case within the aviation sector. Network infrastructure, computers, and other devices within your network also require frequent updates to address security vulnerabilities before they can be exploited by bad actors.  

Ensuring that systems are patched and done so in a timely manner requires knowing what software and hardware are being used across the organization. Like monitoring and detection, this comes with its own set of challenges, including having accurate device inventory, testing potential updates to ensure that they do not create new vulnerabilities, and procedures to ensure updates are rolled out across the airport on a regular basis without resulting in downtime. 

Complying with the TSA Requirements 

For guidance on how to meet these requirements in your airport, see our latest webinar: How to Comply with the New TSA Cybersecurity Requirements. You can also get in touch with a member of our team, who will be able to advise you on where to get started.