Aviation industry seeks to unify cybersecurity practices

The aviation industry needs to unify its approach to cybersecurity to mitigate growing risks, says a new study released by the World Economic Forum (WEF). The “Pathways Towards a Cyber Resilient Aviation Industry” report encourages the definition of a common language, and collective practices and initiatives to increase cyber resilience across the aviation ecosystem.

Today, airlines, airports, and aircraft manufacturers take different approaches to combating cyber risks. Even in the face of initiatives such as the “Aviation Cybersecurity Strategy“, drawn up by the International Civil Aviation Organization (ICAO) in 2019 and resulting in the Cybersecurity Action Plan, published in November last year.

Developed in collaboration with Deloitte, the study is the fruit of Cyber Resilience in Aviation, an initiative coordinated by the WEF that has the collaboration of organizations and more than 50 companies in the industry. Key contributors include ICAO, NCSC, EASA, IATA, ACI, Eurocontrol, and UK CAA.

“The aviation industry has developed a strong history of security, resilience, and protection practices addressing physical threats and must integrate cyber risks into that security and resilience culture,” explains Georges De Moura, head of industry solutions at WEF’s Center for Cybersecurity.

Since the beginning of the Covid-19 pandemic, there has been an unprecedented global increase in cybercriminal activity. Phishing attacks have more than doubled compared to 2019 and, in some places, increased sixfold. There have also been a number of attempted cyberattacks on critical infrastructure, including airports, power grids, ports, and water and sewage facilities. Even hospitals that treat Covid-19 patients have been targeted, and the World Health Organization itself has reported an unprecedented increase in attacks on its networks.

Of particular concern is the fact that the aviation sector plays a vital role in transporting not only traditional people and cargo but also vaccines – which represents the greatest transportation challenge in its history. It is highly likely that aviation networks and other sectors associated with the vaccine distribution supply chain will be subject to a significant amount of adverse cyber activity in the coming months.

At the virtual event marking the report’s launch on April 14, ICAO Secretary General Fang Liu explored key cyber resilience priorities for aviation, noting that as the air transport sector continues to modernize and digitize, cyber risks are increasing for everyone: airports, airlines, and air navigation service providers, as well as other service providers.

In the opinion of said Chris Verdonck of Deloitte, the shadow of the SolarWinds hack illustrates very clearly that protection against unseen threats is as vital as physical security at airports. “Adopting a collaborative cyber resilience posture and building trust between cross-sector organizations, national and supranational authorities is the logical but challenging next step,” he says.

The goal is industry cyber resilience

According to the WEF, the report is a call to action for business leaders, regulators and policymakers, cybersecurity professionals, and technology vendors, with the goal of increasing the cyber resilience of the entire ecosystem.

Its organizers define cyber resilience as “the ability to anticipate, resist, recover from and adapt to adverse conditions, stresses, attacks or compromises on systems that use or are enabled by cyber resources.”

And while they recognize that every link in the ecosystem is determined to achieve higher levels of cyber resilience, they warn that their efforts are and will continue to be hampered by various technical and regulatory barriers. Overcoming these barriers will require a holistic, systematic, and collaborative approach by multiple actors in the public and private sectors.

The aviation industry is known to have a distinct cyber risk profile. Keeping air travel safe and efficient requires collecting personal and payment information from customers, making the industry a prime target for hackers. Computers also control critical functions throughout the operational chain, such as aircraft navigation, air traffic control systems, passenger booking, check-in, supply management.

It is imperative that airlines understand the potential for physical and financial damage from cyber-attacks. Short periods of downtime can lead to serious problems, with global repercussions. A number of exploits and attacks over the last decade have demonstrated that significant losses can be caused to physical assets when computer systems are compromised.

Given a large number of customers the aviation industry serves daily and the responsibility for passenger safety, a cyber incident is likely to attract significant government and media attention.

Regardless of the damage caused by a cyber incident, the company’s reputation will be affected, leaving it subject to substantial remediation costs, including expenses for IT expertise and remediation, as well as public relations expenses.