Cybersecurity in the Cockpit and Beyond

What is more terrifying than piloting a plane at sixty thousand feet and discovering that you can no longer control the aircraft because the cockpit computer has been hacked?

To prevent such a situation, military and commercial aircraft manufacturers employ cybersecurity specialists who implement state-of-the-art security protocols and perform rigorous testing of their planes to ensure that such a scenario remains imaginary. However, the aerospace sector remains a prime target for cybercriminals worldwide.

The goal of a run-of-the-mill cybercriminal is not to bring down a plane. However, any damage a cybersecurity breach can cause can be significant. According to the National Business Aviation Association, “The end goal of a cyberattack is always the same: access to the user’s password, [which is] the key [of] admittance to both personal banking and corporate networks.”

Recovery from a personal cyberattack is no easy feat. Scott Augenbaum, a retired supervisory special agent in the Federal Bureau of Investigation’s (FBI’s) Cyber Division, noted, after interviewing nearly one thousand victims, that “almost ninety to ninety-five percent of the cybercriminals were located outside the [United States], usually in Russia, China, Philippines, Bangladesh, and West Africa. Once cybercriminals steal your money or your data, it’s nearly impossible to retrieve.” Augenbaum also stated that the likelihood of law enforcement agencies bringing those cybercriminals to justice is even smaller.

Similarly, cyberattacks in commercial aviation generally target customers’ personal information, such as passport details (e.g., date and place of birth) and credit card information. Attacks also cause disruptions in airline booking systems, leading to flight cancellations, delays, and lost revenue. It is estimated that a one-hour disruption in operations at a busy airport at peak time results in a loss of one million dollars in revenue.

In addition to aircraft, operations, and classified information, cyberattacks on military aircraft systems threaten national security. According to one aviation blog: “In an era defined by rapid technological advancements, the intersection of cyber warfare and military aviation has become increasingly critical in safeguarding airspace and maintaining operational superiority… Cyber warfare has emerged as a potent tool for state and non-state actors seeking to disrupt military operations, compromise sensitive information, and undermine national security. The aviation sector, reliant on interconnected networks and advanced avionics systems, is particularly vulnerable to cyberattacks targeting communication channels, navigation systems, and flight controls.”

Fortunately, U.S. military forces prepare for attacks on the cyber front just as they prepare for attacks in the air, on land, and at sea; they use robust cybersecurity tools such as firewalls, intrusion detection systems, and encryption protocols. In addition, military aviators go through rigorous cyber resilience training in “cyber hygiene,” threat detection, and incident response protocols. For example, in the U.S. Air Force, Cyber Warfare Operators sustain and enhance cyberspace capabilities to defend national interests from attack; they manage cyber and information warfare operations both on base and at deployed locations while overseeing multiple operations units. The Air Force also employs Intelligence Analysts, Airborne Cryptologic Linguists, Cyberspace Operations Officers, Warfighter Communications Operations Officers, and more.

How else can military and commercial organizations safeguard their aircraft from cyberattacks? A commercial aerospace manufacturer recommends five key actions:

1. Train your team. Employee awareness is the single most important element in a defense against cyber threats; understanding security threats and how to effectively protect your organization is paramount.
2. Audit your security processes. Assessing or auditing your security implementations helps ensure everything is in place to avoid a possible attack. The European Union Aviation Safety Agency and Federal Aviation Administration plan to implement new regulations in the coming years.
3. Secure your network. Typically, organizations consider firewalls, antimalware, antivirus, identity and access control, and other options as a layered approach to defense. A holistic approach should be preferred when using different types of IT security solutions to avoid creating hidden back doors, which could also compromise your entire IT network.
4. Create a Security Operations Center (SOC). SOC helps control, monitor, and detect any incoming threats to a system and respond to them in the most appropriate way. SOC goes hand in hand with a defined set of rules and response measures for each type of incident, which must be defined upfront and regularly revised to keep up with the evolving threats.
5. Set up a security framework. Documenting policies, procedures, and processes that revolve around the organization is key to ensuring consistency and structure. This framework becomes the guiding principle all stakeholders must follow and comply.

Along with the knowledge that cyberspace brings comes a vulnerability that must be acknowledged and minimized. By staying vigilant and proactive, Airmen will continue safeguarding critical aviation systems from cyber threats. More specifically, through continuous training; strict security processes, strategies, and technologies; and a commitment to cyber resilience, Airmen will continue to protect the nation’s data, aircraft, and security from the skies.