Hacking Aviation Technology

aircraft-hacking-planes-in-flight-wifi-hacking-gao.jpg

Hard-core engineering industry professionals often believe that if information about how systems might be exploited is published, then the risk of these systems being exploited will increase. In contrast, most security researchers believe that responsibly disclosing security issues creates positive pressure on vendors to address these issues more effectively.

Aviation isn’t the only industry in this position. Energy, utilities, automotive, any industry where operational technology is being integrated, or replaced, with more IT components, experiences this conflict. These are generalizations, of course, and there are extremes on either side, but there’s a core, cultural difference in a response of ‘no one can access this component’ and ‘what happens when someone does?’
Industries that have a life-and-death impact are, understandably, particularly sensitive to this issue. Anywhere failure can actually kill people deserves some special consideration. In aviation, flight safety trumps information security, as it should, but as more and more attacks affect well known organizations, information security is gaining in visibility. There’s a growing recognition that cyber-attacks can have real-world consequences.
Despite this change in visibility, security researchers are concerned that if they demonstrate theoretical attacks on aircraft and aircraft systems, which include things like accessing some flight control systems via the in-flight entertainment system, rather than acknowledging the vulnerability and developing a plan to fix it, regulators and airlines will instead respond negatively and aggressively, with the intent to suppress the information.
This is a big problem because rather than acting on potential security threats to actively reduce risk, suppression ultimately drives criminal interest and increases risk. While this behaviour is often grounded in a desire to keep dangerous information out of criminal hands, other industries have come to realize that suppressing security research just results in less effective response and patching leaving systems more vulnerable to attack. An actively negative response generates more risk, not less.
The aviation industry relies heavily on technology, some of which is directly relevant to the safety of aircraft inflight and others directly impact the service, reputation and financial health of the industry. Despite the critical role technology plays in the safety of air travel, the aviation industry is still not equipped to handle many common cyber-attacks. Some of the challenge is technical, but much of it is cultural, as noted above.
While it might seem like the most obvious information security challenge to the aviation industry would be the increasing sophistication of attacks, the reality is that a lack of basic cyber security ‘best practices’ is an obvious next step in improving resilience and limiting risk. As more corporate IT systems and components make their way into traditionally closed aviation technology systems, they bring with them a number of security issues. These issues aren’t new to traditional IT, but they present new challenges when they are integrated with aging control systems.
The aviation industry involves more than just aircraft, of course. In addition to inflight safety, aviation as a whole now has to worry about how to collectively manage a growing number of security issues, which target adjacent parts of the business. Threats to air traffic control and reservation systems (GDS/CRS) are numerous. With the air traffic control systems, the primary concern is still flight safety, not financial fraud.
Because of the numerous cyber threats to the aviation industry, it is vital that the industry comes together to build adequate security defences. This effort will help detect and protect critical aviation infrastructure from potential cyber-attacks.
Effective aviation cyber security requires organizations to build accurate threat models, which will help define and describe the attacks that could compromise safety, or put customer data and financial information at risk. Accurate threat models are the first step toward building sufficient defence capabilities, and the process of creating these models starts by contemplating how systems can be breached and clearly identifying areas of the network most vulnerable to attack.
Information security researchers can play a key role in identifying these critical vulnerabilities, but only if the industry resists the urge to suppress research around potential cyber-attacks. Instead, aviation industry organizations should seek responsible partnerships with security researchers.
This isn’t a perfect solution, and doesn’t eliminate criminal elements, but most security researchers believe the best approach is responsible disclosure because it minimizes the risk associated with publication and maximizes the effectiveness of vendor response. This model has produced measurable reduction in security risks in other industries, and the potential to improve aviation security relatively quickly is significant.
Tripwire: http://bit.ly/1H9E0Yy

 

« Impact of New EU Data Legislation Not Widely Understood
Cyber War and Peace »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

SecuriThings

SecuriThings

SecuriThings is a User and Entity Behavioral Analytics (UEBA) solution for IoT security.

Israel National Cyber Directorate (INCD)

Israel National Cyber Directorate (INCD)

The Israel National Cyber Directorate is the national security and technological agency responsible for defending Israel’s national cyberspace and for establishing and advancing Israel’s cyber power.

Sikur

Sikur

Sikur have developed a communication platform that sets new boundaries for corporate privacy and security.

IT Jobs Watch

IT Jobs Watch

IT Jobs Watch provides a concise and accurate map of the prevailing IT job market conditions in the UK.

Krypsis

Krypsis

Krypsys is an information security company with a focus on helping you defend your information and data against emerging security threats.

Stanley Reid & Company (SRC)

Stanley Reid & Company (SRC)

Stanley Reid & Co is an Executive and Technical Search Firm serving the commercial market and the US Intelligence & Defense community. Our areas of expertise include Cybersecurity.

LAVAAT

LAVAAT

At LAAVAT, our goal is to make it easy for our customers to build secure IoT devices without a need to invest considerably in embedded security and cryptography expertise.

Creative Destruction Lab (CDL)

Creative Destruction Lab (CDL)

Creative Destruction Lab is a nonprofit organization that delivers an objectives-based program for massively scalable, seed-stage, science- and technology-based companies.

Protexxa

Protexxa

Protexxa is a B2B SaaS cybersecurity platform that leverages Artificial Intelligence to rapidly identify, evaluate, predict, and resolve cyber issues for employees.

Pvotal Technologies

Pvotal Technologies

Pvotal Technologies engineer complex, automated processes aligned with best AIOps, BizDevOps, DevSecOps, CloudOps, and ITOps practices.

AuthenticID

AuthenticID

Our mission at AuthenticID is to combat fraud worldwide and help businesses protect their enterprise and valuable data assets.

Blue Goat Cyber

Blue Goat Cyber

Blue Goat stands at the forefront of cybersecurity, particularly in medical device security and penetration testing.

Clango

Clango

Clango employs an identity-centric approach to optimizing your cybersecurity investment while minimizing risk.

Neo Auth

Neo Auth

Neo Auth is an identity and access management solution to help organizations optimize their cybersecurity processes.

SGS Brightsight

SGS Brightsight

SGS Brightsight is the largest independent security evaluation lab in the world, with ten recognised labs worldwide.

EpicCyber

EpicCyber

Since 2011, Epic Cyber has pioneered the integration of enterprise cloud technology.