Four Threats To Aviation Security – and Four Responses

From terrorist attacks to geopolitical posturing, if there is one industry that tends to find itself dragged onto the frontline of global security and cyber risks, it is aviation.

While flying has always been one of the safest ways to travel, thanks to its wide-ranging international regulatory frameworks, aviation incidents have an outsize impact on the public consciousness. From recent airport attacks in Brussels and Istanbul to the shooting down of MH17 over Ukraine, horrifying images are more powerful than reassuring statistics.

Emerging technologies, the changing character of war, a widening cast of actors and growing reliance on cyber are changing the nature of the threats – creating pressure on the industry to make sure it maintains its safety level, with the number of air travellers projected to nearly double in the next 20 years.

Here are four ways in which the likely evolution of the international security landscape over the coming years will affect aviation – and four recommendations for how the industry should react.

The threats

1. Technology is rapidly democratizing the ability to inflict large-scale damage. Attacks that would once have been within the purview of only a few major states are becoming conceivable for a much wider range of non-state actors and individuals.

2. The merging of cyber and physical creates new vulnerabilities. The democratized capacity to wreak large-scale havoc is closely related to the merging of the virtual world with the physical: increasingly, remote attacks can cause serious real-world disruptions.

Many systems in civilian aviation are potentially hackable: reservation systems, flight traffic management systems, access control management systems, departure control systems, passport control systems, cloud-based airline data storage, hazardous materials transportation management, cargo handling and shipping.

And that’s before we get to computers on aircraft – flight control systems, GPS-based navigation systems, fuel gauges and fuel consumption systems, maintenance computers, and so on. The potential points of cyber vulnerability in aviation are many and growing.

3. As computers do more, human skills erode. Alongside militaries and self-driving car makers – as brought into focus by the recent death of a Tesla driver using “Autopilot” mode – the aviation industry is grappling with the “paradox of automation”.

Automated systems are becoming able to handle more and more situations, meaning that humans need to step in only when something unusual and unexpected occurs. But when humans have less opportunity to practise and hone their skills, they become less and less capable of reacting quickly and appropriately in crisis conditions.

Increasingly, researchers are realising that the most vulnerable points in many systems are those at which humans interact with automated procedures.

4. Aviation remains a high-value target. Whether between nation states or also involving non-state actors, modern conflicts are increasingly not confined to conventional battlefields – they tend to spill over into civilian domains.

As civilian aviation is so critical to the smooth functioning of economies – and as aviation-related incidents have such an impact on the media, especially with new technologies enabling the rapid spread of information and misinformation – it is likely to remain an enticing target for attackers who want to cause maximum disruption.

The recommendations

1. Too much compliance can be a bad thing. There is still a tendency to focus safety efforts on compliance with existing regulations. However, as regulations tend to take time to reflect awareness of new vulnerabilities, this can lead to evolving threats being overlooked, impairing preparedness.

2. Companies should think like attackers, not defenders. The best way to prepare for tomorrow’s attacks, rather than merely prevent a repeat of yesterday’s, is to think like an attacker.

In the cyber domain, much of the industry could still do much more to work with “white hackers”, who can help them identify and re-frame their understanding of vulnerabilities.

In the physical space, too much still hinges on experiences and not enough on scenarios. Often the response to one attack is to change security procedures in a way that merely shifts the vulnerability. Adding another security checkpoint doesn’t help if it creates queues before the checkpoint which are vulnerable to an Istanbul- or Brussels-type attack.

This is not a new observation. A 2003 study by RAND on ”Designing Airports for Security” found that reducing baggage drop waits from 15 minutes to one minute could halve casualties in a bomb attack. But much more attention is still typically paid to tightening security checks than reducing the crowding that can happen before them.

3. Cooperation on security concerns, in the physical and cyber domain, makes everyone stronger. Individual companies need to avoid seeing their own resilience against attacks as a source of comparative advantage: that creates the potential for individuals with malicious intent to shop around for the weakest link, and any successful attack undermines the sector as a whole.

While aviation players are typically aware of the need to share their discoveries on previously unknown vulnerabilities and best practices for dealing with them, especially in the cyber domain, there is nonetheless a need for better mechanisms to facilitate this collaboration.

4. We need to rethink border security for the digital age. Although attacks can increasingly be mounted remotely, aviation safety is still improved by better knowledge about passengers – and the current approach to cross-border movement is decidedly 20th century.

Much more could be done to manage risks while also creating a more seamless travel experience through facilitating what some have coined a “global trusted traveller programme” to expedite secure cross-border movements, establishing standards on the sharing and use of data, traveller analytics and border controls – for example, ensuring speedy and universal flagging of travel documents reported as lost or stolen. This could also be an important part of the process of addressing the challenges above.

The travel industry overall, and the aviation industry in particular, is at a crossroad. With security concerns intensifying, the security of flying increasingly depends on cross-industry and multistakeholder dialogues and collaboration to tackle new and shared vulnerabilities.

Anja Kaspersen is Head of International Security, World Economic Forum

WEF

« NATO & Pentagon Want Bitcoin Technology
The Global War of Narratives and the Role of Social Media »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

E-Tech

E-Tech

E-Tech has been providing system support and information technology consulting services including Internet and Network Security assessments.

Infineon Technologies

Infineon Technologies

Infineon is a leader in semiconductor solutions for a huge range of applications including automation, smart systems and security for the Internet of Things.

Be Cyber Aware At Sea

Be Cyber Aware At Sea

Be Cyber Aware At Sea is a global maritime and offshore industry initiative to raise awareness and educate crew members and the offshore workforce.

ThreatAdvice

ThreatAdvice

ThreatAdvice is a provider of cybersecurity education, awareness and threat intelligence.

Aiuken Cybersecurity

Aiuken Cybersecurity

Aiuken is an international IT Security company, focused on communications and IT technologies, specialised in Security and Cloud Services solutions with high added value.

SevenShift

SevenShift

SevenShift is a security consulting firm with a wealth of experience in the worlds of Cybersecurity and Internet of Things (IoT).

SmartContractAudits.com

SmartContractAudits.com

SmartContractAudits.com is the leading platform for finding companies providing smart contract auditing services.

Tines

Tines

The Tines security automation platform helps security teams automate manual tasks, making them more effective and efficient.

Blockchain Solutions

Blockchain Solutions

Blockchain Solutions Limited is a technological One Stop Solution provider, for Blockchain technology.

iSolutions

iSolutions

iSolutions is an official reseller and engineering company of leading products and solutions for cybersecurity and information protection, optimization, visualization and control of applications

Australian Cyber Collaboration Centre (Aus3C)

Australian Cyber Collaboration Centre (Aus3C)

The Australian Cyber Collaboration Centre (Aus3C) is committed to building cyber capacity and securing Australia's digital landscape.

Blue Cedar

Blue Cedar

Blue Cedar's mobile app security integration platform secures and accelerates mobile app deployment for enterprises and government organizations around the world.

e-Careers

e-Careers

e-Careers is an edtech institution that provides industry recognised courses and up-skilling solutions to individuals and organisations.

Trackd

Trackd

At trackd, we’re re-imaging vulnerability remediation for the benefit of the entire cyber security community. Automating Vulnerability Remediation without the Fear of Disruption.

Grypho5

Grypho5

Grypho5 offers managed packages to protect where threat actors strike most. We defend your infrastructure dynamically, leaving you to focus on other priorities.

Fusion5

Fusion5

Fusion5 is a leading ANZ Business Services and IT Solutions provider. Our customers trust us to make their potential reality by providing advisory, IT project deployment, and managed services.