TSA’s weak IT access controls increased likelihood of ‘catastrophic damage,’ watchdog finds

The Transportation Security Administration suffered from several access control oversights, per an audit of its protocols, documentation and management that was conducted by the Department of Homeland Security’s Office of Inspector General.

Although some access controls were present, the OIG found that TSA did not secure privileged accounts, nor did the DHS component perform annual reviews to assess account access. TSA also did not consistently disable account access for separated employees. 

“TSA’s approximately 60,000 employees require secure and reliable information technology (IT) to screen passengers; detect explosives and other dangerous items at airports; and work with partners to secure roadways, railroad tracks, and pipelines,” the auditors said in the report published earlier this week. 

“Due to its critical mission, TSA’s systems and networks are high-visibility targets for attackers who aim to disrupt mission-essential operations or steal sensitive information,” they added. 

The watchdog said the identified vulnerabilities could allow threat actors to compromise TSA’s network, access sensitive information and cause “serious or catastrophic damage to operations and assets.” The vulnerabilities, per the report, were the result of staff shortages, resource constraints and time limitations, as well as inadequate policies. 

TSA had made some progress since the audit completed. 

The DHS component has evaluated permissions associated with privileged accounts and implemented a monthly review of access controls. It is also developing a formal process to ensure IT can rescind access after employees leave their role in a more timely fashion. 

The latest OIG report is the fifth access controls audit that the watchdog has conducted for DHS components. Customs and Border Protection had similarly neglected necessary IT access controls but is working on remediation efforts, according to findings published last month. The other audits dated back to 2024 and earlier.