The cybersecurity risks facing the aviation sector extend beyond airplanes and the technology they depend on, but also threaten airports and their supply chain. This makes up an enormous, vulnerable ecosystem, ripe for the picking.
Massive Attack Surface
The potential attack surface that cybercriminals and scammers can exploit is massive, Aerospace Village chairman Steve Luczynski said. Not only are individual aircraft at risk, but several other critical systems for navigation, communication, and in-flight entertainment could also be compromised. Luczynski explained that aviation companies must take steps to safeguard the “control tower, navigation aids on the ground, airports themselves, plus manufacturers and their supply chains.” While espionage by nation states is one of the key challenges to aerospace technology, the threat of “sabotage or disruptive attacks” by state-backed hackers is even more pressing, FT wrote. Today, state-backed APT (Advanced Persistent Threat) groups have set their eyes on various critical sectors. A digitally transformed aerospace industry—meaning airplanes that are connected to computers on the ground—will be “much, much more vulnerable,” president of the Cyber Defense Agency, Sami Saydjari, told FT.
Exploits, Ransomware, and Scams
Espionage and disruptive attacks are far from the only cybersecurity problem the aerospace and defense industries need to worry about. Far worse is the possibility of ransomware attacks, which could spell catastrophe. Ransomware attacks can cripple even the toughest cybersecurity defenses. Threat actors that orchestrate these attacks, such as the REvil ransomware group, are on top of the most wanted lists of U.S. security agencies like the FBI and the Secret Service. “One could definitely anticipate seeing people do that in the aerospace community, holding aircraft for ransom. I think it’s coming,” Saydjari warned. Apart from ransomware attacks, there is spoofing—a scam where hackers would access a system via a phishing attack and impersonate a high-ranking official. “The nightmare scenario is a fake air traffic controller that tries to run people into each other,” University of Michigan aerospace engineering professor, Ella Marie Atkins, said.
AI, Backups, Planning, and Education
With numerous cyber threats and a vast attack surface for criminals to exploit, the aerospace industry is resorting to artificial intelligence (AI) and machine learning (ML) “to help monitor unusual behaviour and automatically defend against, or contain, attacks,” FT said. Chief executive of cybersecurity company Hadrian, Rogier Fischer, explained that adopting AI has other benefits in an industry where speed is everything. For example, it could be used to automate simple tasks, which would allow security engineers to focus on more complex issues, such as software exploits. Thales’ vice president of data protection, Todd Moore, echoed the assertion that aviation companies must improve their cyber defenses, and AI may be key to this. “The future of cyber attacks is likely to rely on autonomous intelligent cyber weapons and therefore an autonomous cyber defense is required which acts at the speed and scale of systems and attacks,” he said. “Deep industry cooperation,” planning, proper backups, technical risk assessments, and cybersecurity education for aerospace engineers are crucial for long-term security in the industry. In the future, cybercriminals could also harness quantum technology in their nefarious exploits. Aerospace companies would require cutting-edge encryption and other advanced security tools to stop such attacks. Aerospace specialists must anticipate and prepare for unprecedented attacks in the not-too-distant future. It is important to protect yourself and your devices from cyber threats when you’re at the airport. Connect to a Virtual Private Network (VPN) if you decide to use public Wi-Fi at the airport. This ensures your device does not end up as collateral damage in the aftermath of a cyberattack. To learn more about emerging technologies, check out our article on 5G and AI.
