The aviation industry has been quick to adopt developments in digital technology to improve efficiency and the passenger experience. Much of that work has been carried out safely, but it does not make the systems completely secure.
Every opportunity to improve the customer experience or aircraft operations can also give attackers a way to exploit new or upgraded technology for personal or political gain. Attacks are becoming more frequent, and attackers more sophisticated. Without a coordinated response, an attack that cannot be contained quickly could have serious consequences for the industry and for safety.
The aviation systems exposed to these threats include:
- Aircraft IP flight networks
- Digital air traffic control (ATC) and traffic management systems
- Fly-by-wire systems
- Onboard interface devices
- Flight history servers
- Fleet and route planning systems
- Passenger reservation systems and frequent-flyer or loyalty programmes
- Ticket booking websites
Disruption to these systems can affect international operations, cause financial losses and compromise safety. Data breaches can also drive customers away, affect share prices, and lead to government investigations and lawsuits.
How can the aviation industry protect itself?
Cyber resilience is the ability to anticipate, detect, respond to and recover from cyber threats. For airlines, that means preparing for attacks and being able to adapt when they happen.
The areas I noted for building resilience were:
- Protect endpoints by securing access to network devices and systems.
- Protect aviation data in the cloud through third-party audits such as SOC 1 and SOC 2.
- Establish identity and access management (IAM) based on cryptographically protected multi-factor authentication for operators.
- Use end-to-end encryption for customer, passenger, employee and payment information.
- Encrypt real-time communication between aircraft and ground-based air traffic control systems.
- Assess aviation applications for vulnerabilities, including onboard and cockpit systems.
- Include threat intelligence and incident response to identify potential attackers early and respond to and contain threats.
Risk extends across the aviation supply chain. Detecting and responding to threats proactively also helps airlines deal with risks originating from other organisations in that chain.
Alongside that wider work, protecting customer and employee data is a first step: national identification details, passport information, payment information and other personally identifiable information (PII).
There are many kinds of attacks and many ways an attack can affect a person. The different scenarios need to be examined, especially those that could affect safety.