Four Threats To Aviation Security – and Four Responses

From terrorist attacks to geopolitical posturing, if there is one industry that tends to find itself dragged onto the frontline of global security and cyber risks, it is aviation.

While flying has always been one of the safest ways to travel, thanks to its wide-ranging international regulatory frameworks, aviation incidents have an outsize impact on the public consciousness. From recent airport attacks in Brussels and Istanbul to the shooting down of MH17 over Ukraine, horrifying images are more powerful than reassuring statistics.

Emerging technologies, the changing character of war, a widening cast of actors and growing reliance on cyber are changing the nature of the threats – creating pressure on the industry to make sure it maintains its safety level, with the number of air travellers projected to nearly double in the next 20 years.

Here are four ways in which the likely evolution of the international security landscape over the coming years will affect aviation – and four recommendations for how the industry should react.

The threats

1. Technology is rapidly democratizing the ability to inflict large-scale damage. Attacks that would once have been within the purview of only a few major states are becoming conceivable for a much wider range of non-state actors and individuals.

2. The merging of cyber and physical creates new vulnerabilities. The democratized capacity to wreak large-scale havoc is closely related to the merging of the virtual world with the physical: increasingly, remote attacks can cause serious real-world disruptions.

Many systems in civilian aviation are potentially hackable: reservation systems, flight traffic management systems, access control management systems, departure control systems, passport control systems, cloud-based airline data storage, hazardous materials transportation management, cargo handling and shipping.

And that’s before we get to computers on aircraft – flight control systems, GPS-based navigation systems, fuel gauges and fuel consumption systems, maintenance computers, and so on. The potential points of cyber vulnerability in aviation are many and growing.

3. As computers do more, human skills erode. Alongside militaries and self-driving car makers – as brought into focus by the recent death of a Tesla driver using “Autopilot” mode – the aviation industry is grappling with the “paradox of automation”.

Automated systems are becoming able to handle more and more situations, meaning that humans need to step in only when something unusual and unexpected occurs. But when humans have less opportunity to practise and hone their skills, they become less and less capable of reacting quickly and appropriately in crisis conditions.

Increasingly, researchers are realising that the most vulnerable points in many systems are those at which humans interact with automated procedures.

4. Aviation remains a high-value target. Whether between nation states or also involving non-state actors, modern conflicts are increasingly not confined to conventional battlefields – they tend to spill over into civilian domains.

As civilian aviation is so critical to the smooth functioning of economies – and as aviation-related incidents have such an impact on the media, especially with new technologies enabling the rapid spread of information and misinformation – it is likely to remain an enticing target for attackers who want to cause maximum disruption.

The recommendations

1. Too much compliance can be a bad thing. There is still a tendency to focus safety efforts on compliance with existing regulations. However, as regulations tend to take time to reflect awareness of new vulnerabilities, this can lead to evolving threats being overlooked, impairing preparedness.

2. Companies should think like attackers, not defenders. The best way to prepare for tomorrow’s attacks, rather than merely prevent a repeat of yesterday’s, is to think like an attacker.

In the cyber domain, much of the industry could still do much more to work with “white hackers”, who can help them identify and re-frame their understanding of vulnerabilities.

In the physical space, too much still hinges on experiences and not enough on scenarios. Often the response to one attack is to change security procedures in a way that merely shifts the vulnerability. Adding another security checkpoint doesn’t help if it creates queues before the checkpoint which are vulnerable to an Istanbul- or Brussels-type attack.

This is not a new observation. A 2003 study by RAND on ”Designing Airports for Security” found that reducing baggage drop waits from 15 minutes to one minute could halve casualties in a bomb attack. But much more attention is still typically paid to tightening security checks than reducing the crowding that can happen before them.

3. Cooperation on security concerns, in the physical and cyber domain, makes everyone stronger. Individual companies need to avoid seeing their own resilience against attacks as a source of comparative advantage: that creates the potential for individuals with malicious intent to shop around for the weakest link, and any successful attack undermines the sector as a whole.

While aviation players are typically aware of the need to share their discoveries on previously unknown vulnerabilities and best practices for dealing with them, especially in the cyber domain, there is nonetheless a need for better mechanisms to facilitate this collaboration.

4. We need to rethink border security for the digital age. Although attacks can increasingly be mounted remotely, aviation safety is still improved by better knowledge about passengers – and the current approach to cross-border movement is decidedly 20th century.

Much more could be done to manage risks while also creating a more seamless travel experience through facilitating what some have coined a “global trusted traveller programme” to expedite secure cross-border movements, establishing standards on the sharing and use of data, traveller analytics and border controls – for example, ensuring speedy and universal flagging of travel documents reported as lost or stolen. This could also be an important part of the process of addressing the challenges above.

The travel industry overall, and the aviation industry in particular, is at a crossroad. With security concerns intensifying, the security of flying increasingly depends on cross-industry and multistakeholder dialogues and collaboration to tackle new and shared vulnerabilities.

Anja Kaspersen is Head of International Security, World Economic Forum

WEF

« NATO & Pentagon Want Bitcoin Technology
The Global War of Narratives and the Role of Social Media »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Civica

Civica

Civica provides cloud-based managed IT services, hosting and outsourcing.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

National Cyber Security Agency (NACSA) - Malaysia

National Cyber Security Agency (NACSA) - Malaysia

NACSA is the leading government agency in Malaysia responsible for the development and implementation of national cyber security management policie and strategies.

RIGCERT

RIGCERT

RIGCERT provides training, audit and certification services for multiple fields including Information Security.

Gradcracker

Gradcracker

Gradcracker is THE careers website for Science, Technology (including Cybersecurity), Engineering and Maths university students in the UK.

GlobalPass

GlobalPass

Covering 200+ countries with 78 000 databases, GlobalPass provides sophisticated facial biometrics verification and deep screening, delivering peace of mind to every client.

spiderSilk

spiderSilk

spiderSilk is a Dubai-based cybersecurity firm, specializing in simulating the most advanced cyber offenses on your technology so you can build your best security defenses.

AUTOCRYPT

AUTOCRYPT

AUTOCRYPT is a mobility security provider dedicated to the safety of future transportation

RiskXchange

RiskXchange

RiskXchange's cybersecurity risk rating solution helps businesses solve complex cybersecurity and compliance challenges by providing a 360-degree view of your cybersecurity posture.

DartPoints

DartPoints

DartPoints helps bridge the digital divide by delivering cloud, colocation, managed services + edge infrastructure.

CCX Technologies

CCX Technologies

CCX Technologies design and develop a wide range of cybersecurity and testing solutions for the aviation, and military and government markets.

Carahsoft Technology Corp

Carahsoft Technology Corp

Carahsoft Technology is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets.

OneZero Solutions

OneZero Solutions

OneZero specialize in cybersecurity operations, information assurance, computer network operations, solutions engineering, and project management.

Evolver

Evolver

Evolver delivers technology services and solutions that improve security, promote innovation, and maximize operational efficiency in support of government and commercial customers.

OneStep Group

OneStep Group

OneStep Group are a leading Australian provider of information and communications technology (ICT) services, connecting businesses through technology solutions and support.

Cool Waters Cyber

Cool Waters Cyber

Cool Waters Cyber manage cyber security governance, risk and compliance.