{"id":35506,"date":"2019-11-18T12:01:46","date_gmt":"2019-11-18T11:01:46","guid":{"rendered":"https:\/\/www.intelligentcio.com\/eu\/2019\/11\/18\/cybersecurity-and-aviation-combatting-the-key-threats\/"},"modified":"2021-04-20T09:24:46","modified_gmt":"2021-04-20T08:24:46","slug":"cybersecurity-and-aviation-combatting-the-key-threats","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/eu\/2019\/11\/18\/cybersecurity-and-aviation-combatting-the-key-threats\/","title":{"rendered":"Cybersecurity and aviation: Combatting the key threats"},"content":{"rendered":"\n

The aviation sector is being increasingly digitised which, while providing numerous benefits for consumers and passengers, also introduces new risks and makes the industry a hot target for cybercriminals. Industry experts from Thycotic and Attivo Networks tell us about some of the key threats, how the industry is rising to the challenge and offer best practice advice for CISOs on how to bolster their defences. <\/em><\/p>\n\n\n\n

Airlines and airports spent a record US$50 billion in 2018 on IT to support improvements to the passenger journey and are now beginning to enjoy the benefit of that investment. <\/p>\n\n\n\n

Figures published by SITA for the first time show\nthat this investment has resulted in a significant improvement in both the\nsatisfaction levels for passengers and average processing time.<\/p>\n\n\n\n

The SITA 2019 Air Transport IT Insights<\/em><\/a> shows that 60% of airline CIOs recorded up to a 20% year-on-year\nimprovement in passenger satisfaction. During the same period, 45% of them\nrecorded up to 20% improvement in the rate of passengers processed. <\/p>\n\n\n\n

The benefits of digitisation are clear to see \u2013 improved customer\nsatisfaction and overall efficiencies. But it also introduces new risks and,\nlike every other vertical, CISOs in the aviation industry are having to step up\ntheir cybersecurity measures.<\/p>\n\n\n\n

Joe Carson, Chief Security Scientist and Advisory CISO at Thycotic, and Chris Roberts, Chief Security\nStrategist, Attivo Networks, have provided insight about some of the key\nthreats and how they are being combatted. <\/p>\n\n\n\n

What are some of the unique\ncyberthreats to the aviation sector and why? <\/strong><\/p>\n\n\n\n

Joe Carson, Chief Security Scientist and\nAdvisory CISO, Thycotic (JC): <\/strong>The aviation industry is at risk to many unique cyberattacks that\ncan put human lives and even global stability at serious risk. Our\nsociety is largely dependent on the aviation industry to keep us connected and\nthe world moving and any threat to that industry puts our way of life at\nserious risk. The modern aviation industry is heavily dependent on technology\nand software that is at risk to cyberattacks, which could disrupt flight\nsystems making aircrafts fall from the sky or force pilots to make premature\nlandings.  <\/p>\n\n\n\n

We\nhave seen recent events on what could happen when software bugs combined with\nsensors that have no backups can result in pilots fighting with flight controls\nsuch as the recent issues with Boeing 737 Max. Other risks which I see as\nthe major threats are those that could impact airports such as disrupting\nsafety systems, baggage handling or logistics and schedules. Since\nairports are more open and connected, they are exposed to more threats. <\/p>\n\n\n\n

Most\nattacks to date on the aviation industry have been financial fraud related such\nas business email compromise and invoice fraud or cyberattacks that impacted\nbooking systems and loyalty rewards programs stealing millions of airmiles from\ncustomers.<\/p>\n\n\n\n

Chris Roberts, Chief Security Strategist, Attivo Networks (CR): <\/strong>Unlike many other industries the airline sector still depends on everyday use of decades-old bespoke proprietary systems. Air-ground communications systems \u2013 such as the Aircraft Communications Addressing and Reporting System (ACARS) \u2013 are gradually being interconnected to allow them to be controlled remotely via the Internet. As they do this air traffic operators are keenly aware that doing so increases the risk that outsiders could access onboard systems. <\/p>\n\n\n\n

How is the aviation sector rising to\nthe challenge of combatting these threats?<\/strong><\/p>\n\n\n\n

JC: <\/strong>The aviation industry\nhas always risen to the challenges since the industry heavily relies on safety\nas its primary priority. When systems become more connected online,\ncybersecurity is no longer just an IT security issue \u2013 it then becomes a safety\nissue \u2013 and that is why aviation organisations treat cyberattacks as such a\nhigh priority. However sometimes shortcuts do occur such as using critical\ncommunication equipment onboard aircraft for payments and this increases the\nthreats and risks.<\/p>\n\n\n\n

CR: <\/strong>The\nintroduction of increased Internet connectivity brings opportunities for\nelevated revenue streams and operation savings to the aviation sector. At the\nsame time passengers and industry regulators will expect ever more robust\ncybersecurity measures to protect the information they exchange and access through\naircraft in the sky. The answer to the rising challenges for providers of\nin-flight communication services \u2013 some of which are constrained by the\narchitecture and physical limitations of their networks \u2013 is to build increased\nsecurity layers around these more capable networks.<\/p>\n\n\n\n

Can you outline any use cases of how\ntechnology is being used to mitigate threats? <\/strong><\/p>\n\n\n\n

JC: <\/strong>One main area of\ntechnology being continuously improved is that ADS-B (Automatic Dependent\nSurveillance \u2013 Broadcast) which is used for safety. However, in the past, since\nit was using radio frequency, it was not encrypted and could have been\nmonitored or, worse, the data could be poisoned. However recent improvements have\nfocused around securing and better protecting critical safety systems by\ndecreasing risks such as spoofing, data poisoning and hacking.<\/p>\n\n\n\n

CR:\n<\/strong>In-flight communication services, both for the entertainment of the\ngeneral passenger and the efficiency of the business traveller, face steady\ngrowth in demand that is certain to increase as passengers insist on the\nability to do more and to do it faster while aloft. That demand will only\nincrease further as airlines and other aircraft operators seek greater access\nto operational and systems data from their flights while they are in the air,\nin order to improve the cost-effectiveness of their own operations as well as\nthe in-flight experience of passengers.<\/p>\n\n\n\n

Would you offer any best practice\nadvice for dealing with threats in this industry?<\/strong><\/p>\n\n\n\n

JC: <\/strong>The aviation industry,\nwhile advancing quickly and continuously improving services, must not forget\nthe basics and cybersecurity best practices. These are sometimes overlooked and,\nin most situations, cybercriminals will look for the easiest, cheapest and\nstealthiest way to gain access to critical systems and this means abusing human\ntrust. <\/p>\n\n\n\n

With deep fakes on the increase, this\nexposes the aviation industry to new cyberthreats that could put the industry\nat serious risk. Strong identity and access management with privileged access\nsecurity is a must to ensure only authenticated users have access to critical\nsystems. Multifactor authentication must be enabled and used for all privileged\naccess.<\/p>\n\n\n\n

CR:\n<\/strong>The aviation industry should start to shift\nfrom the traditional security stack to a more proactive stance. Additionally, they must move to an assumed-breach posture. This means\nfocusing less on deflecting an attack and more on using tools that allow them\nto assess their detection, deception and data integrity options.<\/p>\n\n\n\n

Are there any trends or future\ntrends that CISOs working in the sector should prepare for? <\/strong><\/p>\n\n\n\n

CR:<\/strong> Two trends with the potential to introduce new cyberthreat vectors to the aviation sector stem from the availability of Internet-enabled systems on board airplanes. First, is the increasing presence of Internet accessible passenger Infotainment systems. Second, is the presence of Internet of Things devices used for predictive maintenance and near real time reporting of operational components in the aircraft.<\/p>\n","protected":false},"excerpt":{"rendered":"

The aviation sector is being increasingly digitised which, while providing numerous benefits for consumers and passengers, also introduces new risks and makes the industry a hot target for cybercriminals. Industry experts from Thycotic and Attivo Networks tell us about some of the key threats, how the industry is rising to the challenge and offer best […]<\/p>\n","protected":false},"author":28,"featured_media":49390,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[193,57,93],"tags":[12320,13909,10617,9938,12824,13910,10619],"class_list":["post-35506","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-aviation","category-enterprise-security","category-top-stories","tag-airport","tag-attivo-networks","tag-chief-security-scientist-and-advisory-ciso","tag-chief-security-strategist","tag-chris-roberts","tag-joe-carson","tag-thycotic"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/35506","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/users\/28"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/comments?post=35506"}],"version-history":[{"count":2,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/35506\/revisions"}],"predecessor-version":[{"id":35520,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/35506\/revisions\/35520"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media\/49390"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media?parent=35506"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/categories?post=35506"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/tags?post=35506"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}