Most people who buy cybersecurity cannot define what they're trying to protect because they don't know exactly what it is. Is it nuclear launch codes or a cookie recipe? If I ask, how many computers do you have? They might say we have about a hundred thousand. It could be more, or it could be less.
RIEGELSVILLE, Pa. (PRWEB) February 13, 2023
On January 11, 2023, the FAA issued a nationwide ground stop (GS) at approximately 7:30 am that lasted until 9 am EST.(1) A GS is a Traffic Management Initiative triggered by Air Traffic Control requiring aircraft to remain on the ground and is initiated as a result of severe weather, equipment failure, or catastrophic event.(2) The latter possibility created its share of panic among travelers and the media, which hadn’t seen such drastic measures since 9/11. So, what happened? According to the FAA, the GS was caused by an overnight outage of the Notice to Air Missions (NOTAM) system, which provides critical safety information to airports and flight crews to prevent air disasters.(3) Walt Szablowski, Founder and Executive Chairman of Eracent, which has provided complete visibility into its large enterprise clients’ networks for over two decades observes, “the fact that it was only one file that was corrupted and it managed to ground all the flights in the nation, and there was no readily accessible backup in place is a huge issue. It's one file, and the hackers didn't hack it; figuratively speaking, the FAA ‘hacked’ it!”
According to FlightAware's flight tracking website, more than 10,000 flights were delayed, and over 1,300 were canceled,(1) costing the airlines billions of dollars.(4) The FAA issued a statement that contract personnel unintentionally deleted files while working to correct synchronization between the live primary and backup databases, adding that they had found no evidence of a cyberattack or malicious intent.(5) The concept of ‘unintentionally’ deleted files by such a mammoth computer network run by the FAA raises more than a few questions about the efficacy of a government agency’s software fail-safe measures not only to prevent human error but also to guard against cybersecurity breaches.
‘Trust but verify’ is at the core of the Zero Trust security model. The Department of Homeland Security (DHS) and the Cybersecurity and Infrastructure Security Agency (CISA) are scrutinizing legacy government cybersecurity programs and moving toward Zero Trust Architecture,(6) a philosophy that abolishes trust or confidence in all components of the cybersecurity supply chain relationships by always assuming the existence of internal and external threats to the network.(7)
Szablowski states, “most people who buy cybersecurity cannot define what they're trying to protect because they don't know exactly what it is. Is it nuclear launch codes or a cookie recipe? If I ask, how many computers do you have? They might say we have about a hundred thousand. It could be more, or it could be less.” He continues, “at Eracent, our whole focus has always been on defining the network. How big is the network? What's on the network? What software is on the network? What are you trying to protect?”
While the FAA vehemently assured the nation that there was no evidence of a cyberattack on the day in question,(8) that hasn’t stopped the general public or news organizations from speculating if it might have been. Either way, whether it is a system failure or a cyberattack, Szablowski emphasizes, “you don’t just go out and buy a bunch of tools to fix it. And there are plenty of cybersecurity companies that will oblige with a bunch of expensive tools without knowing or caring about what is at stake, and ultimately, those tools won’t work.”
Szablowski notes, "most companies don’t actually expect their security software to work. And when it does fail, they move on to the next tool, and the next tool, and the next tool. And now they’ve bought so many that they've lost control over all the tools.” The FAA debacle ostensibly resulted from a keystroke error. This may be an oversimplification, but in essence, that’s what it was. The trust was broken from one program to another, resulting in an indictment of government oversight.
Eracent’s ClearArmor Zero Trust Resource Planning (ZTRP) is a comprehensive framework management process that supports and expedites the implementation of a Zero Trust Architecture initiative. ZTRP distills the theoretical implementation of Zero Trust into a structured and auditable process. It brings together all networks and endpoints, along with their components, software applications, organizational data, policies, and audit and risk analysis.
If the government already had a Zero Trust system in place, they would have recognized that there was this single point of vulnerability in the NOTAM system. Zero Trust’s high-availability architecture would have implemented the necessary controls to seamlessly switch over to the backup system, in real-time, without interruption.(9)
Szablowski concludes, “most cybersecurity companies are tool vendors. The industry doesn't need more tools — they need the right process. Eracent discovers the data, defines the network, and then on top of that, puts in the processes — and has all the systems you need to effectively put these processes in place.”
About Eracent
Walt Szablowski is the Founder and Executive Chairman of Eracent and serves as Chair of Eracent’s subsidiaries (Eracent SP ZOO, Warsaw, Poland; Eracent Private LTD in Bangalore, India; and Eracent Brazil). Eracent helps its customers meet the challenges of managing IT network assets, software licenses and cybersecurity in today’s complex and evolving IT environments. Eracent’s enterprise clients save significantly on their annual software spend, reduce their audit and security risks, and establish more efficient asset management processes. Eracent’s client base includes some of the world’s largest corporate and government networks and IT environments — the USPS, VISA, US Airforce, British Ministry of Defense — and dozens of Fortune 500 companies rely on Eracent solutions to manage and protect their networks. Visit https://eracent.com/
References:
1. Person, David Shepardson, R. K. S. (2023, January 12). Airlines hope for return to normal Thursday after FAA outage snarls U.S. travel. Reuters. Retrieved February 1, 2023, from reuters.com/business/aerospace-defense/us-faa-says-flight-personnel-alert-system-not-processing-updates-after-outage-2023-01-11/
2. Ground stop (GS): NBAA - National Business Aviation Association. NBAA. (n.d.). Retrieved February 1, 2023, from nbaa.org/aircraft-operations/airspace/tfm/tools-used-for-traffic-flow-management/ground-stop-gs/#:~:text=A%20Ground%20Stop%20(GS)%20is,most%20restrictive%20of%20the%20TMIs
3. Whitmore, G. (2023, January 13). FAA grounded flights. here's what happened and what travelers can do. Forbes. Retrieved February 1, 2023, from forbes.com/sites/geoffwhitmore/2023/01/11/faa-grounded-flights-heres-what-happened-and-what-travelers-can-do/?sh=3a3a6791745d
4. Habeshian, S. (2023, January 20). FAA: Outage caused by contract workers unintentionally deleting files. Axios. Retrieved February 1, 2023, from axios.com/2023/01/20/faa-outage-workers-files
5. FAA Notam Statement. FAA NOTAM Statement | Federal Aviation Administration. (n.d.). Retrieved February 1, 2023, from.faa.gov/newsroom/faa-notam-statement
6. Zero trust maturity model. Cybersecurity and Infrastructure Security Agency CISA. (n.d.). Retrieved February 1, 2023, from cisa.gov/zero-trust-maturity-model
7. Integrating zero trust in the Cyber Supply Chain Security | IEEE ... (n.d.). Retrieved February 1, 2023, from ieeexplore.ieee.org/abstract/document/9626299/
8. Wallace, D., Tomlinson, L. Y. (2023, January 12). FAA outage: White House says 'no evidence of cyber attack,' Biden briefed on grounded flights. Fox News. Retrieved February 1, 2023, from foxnews.com/politics/faa-outage-white-house-says-no-evidence-cyber-attack-biden-briefed-grounded-flights/
9. Herrick, A. (2023, January 30). Zero trust: The phrase we all need to learn. SMERCONISH. Retrieved February 1, 2023, from smerconish.com/exclusive-content/zero-trust-the-phrase-we-all-need-to-learn/