Andy Boff is an aviation cybersecurity expert with over a decade's experience across the full lifecycle of system development and operation. His particular expertise is in resilience and distributed systems architecture. Andy is also the Secretary for EUROCAE's ED-201A sub-group working on the Aeronautical Information System Security (AISS) framework.
This blog is the first in a series which aims to provide clarity around aviation cybersecurity and how it supports and safeguards your operation.
Archimedes famously said "Give me a place to stand, and I shall move the Earth with it". The disruption to Gatwick airport just before Christmas, and again at Heathrow on the 8th January reminds us that the same is true when it comes to defending aviation from disruption and attacks. In Gatwick's case, the actions of a few had huge impact on the airport and travelling public, and had a huge cost in terms of the defensive response.
The advantage is currently on the side of the attackers – when defending our systems we have to consider and cover every possible avenue of attack. The attackers on the other hand, can focus their resources on their chosen approach.
As nobody has limitless resources to cover every possible defensive angle, we need to prioritise where we invest, so we make the best use of the resources we have. This is especially important when we consider that security is a key building block to delivering a safe operation.
With such an imbalance between attackers and defenders, how do we try and balance it back out? What can we do to give advantages to the defenders rather than the attackers?
First of all, we need to properly understand our risk exposure – and this can mean thinking out of the box and questioning our past assumptions. The good news is that the industry as a whole is realising this change in approach is needed, and discussions are already occurring at many levels to try and identify where there might be unexpected exposure.
Next we need to learn from those who have already gone through this transition – there are established frameworks for risk identification and management, such as the NIST CSF and the ISO 27000 series of standards and these are being augmented by aviation specific extensions and interpretations where needed.
The changes needed to properly handle structured and methodical cybersecurity approaches are very similar to the formal approach to implementing safety. The key difference with safety comes down to how the environment evolves. For safety, we normally expect evolution to occur due to the natural progression of technology.
Security evolution is much faster, predominantly because there is active research being done by attackers to undermine current defences, and the pace of technological advancement also means it's easy to overlook subtle ways that vulnerabilities can occur.
In my next blog I'll be considering the benefits of reactive and proactive security approaches, and when each is most effectively applied to protect your operation.
ATM Cybersecurity – what is ‘good enough’?
Revised EASA Basic Regulation – key takeaways for the ATM community
Lower Airspace: a boundary to aviation growth?
Integrated safety risk; time for an oil change!
Performance Management – time for a rethink?
Business continuity in an international ATM environment