TSA Logistics - Revision history

Tom: /* Programs */

2025-09-25T01:08:58Z

‎Programs

Tom: /* Programs */

2025-09-25T01:07:55Z

‎Programs

Tom: /* Towards Resilience */

2022-05-13T20:38:04Z

‎Towards Resilience

Tom: /* Solutions */

2022-05-13T20:18:34Z

‎Solutions

Tom: /* Solutions */

2022-05-13T20:16:36Z

‎Solutions

Tom: /* Solutions */

2022-05-13T20:12:31Z

‎Solutions

Tom: /* Goas1 */

2022-05-13T20:04:23Z

‎Goas1

Tom: /* Solutions */

2022-05-13T20:03:16Z

‎Solutions

Tom: /* Solutions */

2022-05-13T20:02:09Z

‎Solutions

Tom: /* Programs */

2022-05-13T20:01:24Z

‎Programs

@@ Line 16: / Line 16: @@
 ==Programs==
-* 2025-09-24 [https://sam.gov/workspace/contract/opp/7793046186a94cc188ee3177d930c234/view Seamless Identity Automation (SIA) Broad Agency Announcement (BAA)] sue 2025-10-05
+* 2025-09-24 [https://sam.gov/workspace/contract/opp/7793046186a94cc188ee3177d930c234/view Seamless Identity Automation (SIA) Broad Agency Announcement (BAA)] sue 2025-10-05  improve its understanding of existing electronic access control, combined with automated identity verification capabilities to identify vendors capable of providing rapidly deployable systems for assessment in live airport environments in accordance with the schedule below, and in Section 5D of Attachment A, at no cost to the Government.
 * Security in supply chain is concerned primarily with resilience. (Section 3.4)
 * “Benefits and Needs for an Integrated Approach to Cyber-Physical Security for Transportation” <ref>. Zimmerman and M. G. Dinning (November 2017) “Benefits and Needs for an Integrated Approach to Cyber-Physical Security for Transportation,” In Transportation Systems Resilience: Preparation, Recovery, and Adaptation, Transportation Research Circular E-C226, Transportation Systems Resilience Section, Standing Committee on the Logistics of Disaster Response and Business Continuity, Standing Committee on Emergency Evacuations, Standing Committee on Critical Transportation Infrastructure Protection, Transportation Research Board, Washington, DC: National Academies Transportation Research Board, pp. 15-21. http://onlinepubs.trb.org/onlinepubs/circulars/ec226.pdf</ref> "Physical security system technologies and designs must include cybersecurity protections similar to those used in other IT systems and be '''monitored for intrusions''' as other IT networks are. Organizations need to treat physical security technologies as part of their IT networks, and ensure that cybersecurity is part of system design, management, and operations."

@@ Line 16: / Line 16: @@
 ==Programs==
 * Security in supply chain is concerned primarily with resilience. (Section 3.4)
 * “Benefits and Needs for an Integrated Approach to Cyber-Physical Security for Transportation” <ref>. Zimmerman and M. G. Dinning (November 2017) “Benefits and Needs for an Integrated Approach to Cyber-Physical Security for Transportation,” In Transportation Systems Resilience: Preparation, Recovery, and Adaptation, Transportation Research Circular E-C226, Transportation Systems Resilience Section, Standing Committee on the Logistics of Disaster Response and Business Continuity, Standing Committee on Emergency Evacuations, Standing Committee on Critical Transportation Infrastructure Protection, Transportation Research Board, Washington, DC: National Academies Transportation Research Board, pp. 15-21. http://onlinepubs.trb.org/onlinepubs/circulars/ec226.pdf</ref> "Physical security system technologies and designs must include cybersecurity protections similar to those used in other IT systems and be '''monitored for intrusions''' as other IT networks are. Organizations need to treat physical security technologies as part of their IT networks, and ensure that cybersecurity is part of system design, management, and operations."

@@ Line 27: / Line 27: @@
 ===Towards Resilience===
-A resilient system continues to run even when unexpected events occur. This requires monitoring the results in the field and not a reliance on reports that may be years old.
+* A resilient system continues to run even when unexpected events occur. This requires monitoring the results in the field and not a reliance on reports that may be years old. Unlike existing solutions that depend on the source to report problems, including cybersecurity problems, resilient solutions need to examine the threat landscape continuously to determine when and where new exploits are discovered.
 ==References==
 [[Category: Use Case]]

@@ Line 27: / Line 27: @@
 ===Towards Resilience===
-A resilient system continues to run even when unexpected events occur. This requires monitoring the results in the field and not a reliance on reports that many be years old.
+A resilient system continues to run even when unexpected events occur. This requires monitoring the results in the field and not a reliance on reports that may be years old.
 ==References==
 [[Category: Use Case]]

@@ Line 24: / Line 24: @@
 * Major platform that handle data for consumers also have large security departments that scan the data in their domain that includes their customers.
 * External scans for intrusions are limited to a very few companies, like [https://www.vericlouds.com/ VeriClouds.com].
-* A [https://apps.dtic.mil/sti/pdfs/ADA617799.pdfreport by RAND for the Air Force] described cybersecurity for the supply chain as starting at the design phase and followed through till the part was shipped. This completely ignore threats that are initiated long after the design is long complete and support systems must still function to keep the equipment running.
+* A [https://apps.dtic.mil/sti/pdfs/ADA617799.pdf report by RAND for the Air Force] described cybersecurity for the supply chain as starting at the design phase and followed through till the part was shipped. This completely ignore threats that are initiated long after the design is long complete and support systems must still function to keep the equipment running.
 ==References==
 [[Category: Use Case]]

@@ Line 8: / Line 8: @@
 ** The goal was to bring more of our supply and production capacity in the United States, rather than outsourced abroad.
-==Goas1==
+==Goals==
 * 21 Support public and private sharing of cyber-incident data to enhance supply chain cybersecurity, including providing supply chain stakeholders' access to cybersecurity tools and education that allow them to improve their cybersecurity posture in concert with partners and freight facilities. (CISA, DOE, DoD)
 * 22 Develop a National Transportation System Security and Resilience Plan. USDOT and the Department of Homeland Security (DHS) should work with States to identify major natural- and human-caused threats to the transportation system’s performance, define institutional structures for planning for and responding to disruptions, and identify mitigation strategies in a national plan. This will include studying the need for Federal funding to support security infrastructure development.

@@ Line 20: / Line 20: @@
 ==Solutions==
-* Like the DoD the DHS defines Intrusion Detection Systems (IDS) to operate within a data processing domain. In other words, it is the responsibility of the data processor to find all problems. See, for example the [https://www.tsa.gov/for-industry/surface-transportation-cybersecurity-toolkit Surface Transportation Cybersecurity Toolkit], which mostly points the private companies back to reports published by CISA.
+* Like the DoD the DHS defines Intrusion Detection Systems (IDS) to operate within a data processing domain. In other words, it is the responsibility of the data processor to find all problems. See, for example the [https://www.tsa.gov/for-industry/surface-transportation-cybersecurity-toolkit Surface Transportation Cybersecurity Toolkit], mostly point the private companies back to reports published by CISA.
 * The reporting of intrusions to CERT or CVE are somewhat random occurrences, many are from security firms that scan for intrusions externally.
 * Major platform that handle data for consumers also have large security departments that scan the data in their domain that includes their customers.