Master of Aviation Cybersecurity

As cyber attacks become more frequent at all levels, the commercial aviation industry is gearing up to respond accordingly. Commercial Aviation and Cyber Security: A Critical Intersection is a timely contribution to those responsible for keeping aircraft and infrastructure safe. It covers areas of vital interest such as aircraft communications, next-gen air transportation systems, the impact of the Internet of Things (IoT), regulations, the efforts being developed by the Federal Aviation Administration (FAA), and other regulatory bodies. The book also collects important information on the best practices already adopted by other industries such as utilities, defense and the National Highway Traffic Safety Administration in the US. It equally addresses risk management, response plans to cyber attacks, managing supply chains and their cyber- security flaws, personnel training, and the sharing of information among industry players. Commercial Aviation and Cyber Security: A Critical Intersection looks at possible future scenarios and how to respond to ever-growing cyber threats, how standards development will help combat this issue, listing the recommendations proposed by international agencies.

GAO was asked to review the FAA's oversight of avionics cybersecurity issues. The objectives of this review were to (1) describe key cybersecurity risks to avionics systems and their potential effects, (2) determine the extent to which FAA oversees the implementation of cybersecurity controls that address identified risks in avionics systems, and (3) assess the extent to which FAA coordinates internally and with other government and industry entities to identify and address cybersecurity risks to avionics systems. To do so, GAO reviewed information on key cybersecurity risks to avionics systems, as reported by major industry representatives as well as key elements of an effective oversight program, and compared FAA's process for overseeing the implementation of cybersecurity controls in avionics systems with these program elements. GAO also reviewed agency documentation and interviewed agency and industry representatives to assess FAA's coordination efforts to address the identified risks.

As the aviation and space sectors become ever more connected to cyberspace and reliant on related technology, they become more vulnerable to potential cyberattacks. As a result, cybersecurity is a growing concern that all stakeholders in both sectors must consider. In this forward-looking book, which is the first comprehensive analysis of the relevant facets of cybersecurity in the aviation and space sectors, the authors explore the vast spectrum of relevant international and European Union (EU) law, with specific attention to associated risks, existing legal provisions and the potential development of new rules. Beginning with an overview of the different types of malicious cyber operations, the book proceeds to set the terminological landscape relevant to its core theme. It takes a top-down approach by first analysing general international and EU law related to cybersecurity, then moving to the more specific aspects of the aviation and space sectors, including telecommunications. Finally, the salient features of these analyses are combined with the practical realities in the relevant industries, giving due regard to legal and regulatory initiatives, industry standards and best practices.

This book looks at the current state of commercial aviation and cyber security, how information technology and its attractiveness to cyber attacks is affecting it, and the way supply chains have become a vital part of the industry’s cyber-security strategy. More than ever before, commercial aviation relies on information and communications technology. Some examples of this include the use of e-tickets by passengers, electronic flight bags by pilots, wireless web access in flight, not to mention the thousands of sensors throughout the aircraft constantly gathering and sharing data with the crew on the ground.

The aviation industry is faced with a complex and critical challenge to carefully balance costs with evolving business imperatives, customer demands, and safety standards. The increasing use of new technologies in the movement towards automation has yielded efficiencies and enhanced the customer experience. Yet, it has also inadvertently created vulnerabilities for exploitation. As a central component of commerce, trade, and transportation infrastructure, the aviation industry is indispensable to the global economy. The consequences of failure would carry direct public safety and national security implications.

The objective of this report is to capture and understand the diversity of perspectives on aviation cybersecurity. The range of opinions and perspectives became apparent in the 2017 report, Aviation Cybersecurity-Finding Lift, Minimizing Drag. This report builds on the challenges raised two years ago to explore these diverse perspectives have changed in teh intervening time. The digital attack surface the aviation sector presents to its adversaries continues to grow in such a way that both managing risk and gaining insight on it remain difficult. With emerging technologies like machine learning fifth-generation (5G) telecommunications seeing wider adoption -- alongside electric vertical takeoff and landing (eVTOL), autonomous aircraft, and increased use of space -- aviation-cybersecurity risk management is on the cusp of becoming more complex.

While the Federal Aviation Administration (FAA) has taken steps to protect its air traffic control systems from cyber-based and other threats, significant security control weaknesses remain, threatening the agency's ability to ensure the safe and uninterrupted operation of the national airspace system (NAS). These include weaknesses in controls intended to prevent, limit, and detect unauthorised access to computer resources, such as controls for protecting system boundaries, identifying and authenticating users, authorising users to access systems, encrypting sensitive data, and auditing and monitoring activity on FAA's systems. Additionally, shortcomings in boundary protection controls between less-secure systems and the operational NAS environment increase the risk from these weaknesses. The objective of this book is to evaluate the extent to which FAA has effectively implemented information security controls to protect its air traffic control systems. This book also identifies the cybersecurity challenges facing FAA as it shifts to the NextGen ATC system and how FAA has begun addressing those challenges; and assesses the extent to which FAA and its contractors, in the acquisition of NextGen programs, have followed federal guidelines for incorporating cybersecurity controls.

GAO was asked to review FAA's cybersecurity efforts. This report (1) identifies the cybersecurity challenges facing FAA as it shifts to the NextGen ATC system and how FAA has begun addressing those challenges, and (2) assesses the extent to which FAA and its contractors, in the acquisition of NextGen programs, have followed federal guidelines for incorporating cybersecurity controls. GAO reviewed FAA cybersecurity policies and procedures and federal guidelines, and interviewed FAA officials, aviation industry stakeholders, and 15 select cybersecurity experts based on their work and recommendations by other experts.