Adminstrative Procedures Act
In theory, the FAA and all other federal regulative agencies are governed by the Adminstrative Procedures Act in their rule-making process. This means that before they can enforce a new regulation, they must propose it by publishing it in the Federal Register with a time for public "notice and comment." During this period of time various industry groups (AOPA, ALPA, the airlines, etc) and interested individuals make comments, suggest changes, point out inconsistencies, discuss ramifications and consequences, etc. At the close of this time, the agency then draws up a final version of their new rule and has it codified in the Code of Federal Regulations.
That's how it is supposed to work - but there are always exceptions. The enabling legislation setting up the FAA and the annual appropriations legislation also give the FAA (and other federal agencies) new guidance and direction, and new interpretations of their scope and powers. With the current security environment, the FAA likely has power, or believes it has power, to take certain actions and impose certain rules without a period of notice and comment.
As a general rule, an individual cannot challenge an administrative rule until all adminstrative remedies have been tried and concluded. That means you cannot challenge a rule in federal court until you have complied with, and resolved, the administrative process (until you've lost out within the FAA).
It's more involved - but that's the process in a nutshell.