When it comes to things that can connect to the Internet, you don’t get much bigger than a commercial airplane. But aircraft are rarely mentioned in the context of the Internet of Things.
The aviation industry probably doesn’t mind the lack of focus on the connectivity of its planes, considering the way that even solid research into the internet-related systems of planes can result in overblown headlines. Despite this inclination to hysteria, the success the air transport services have had in securing its various systems could provide valuable insight as safety-critical industries including transportation, and just about everything we do as a society, become even more dependent on computers.
“There’s a lot of intrinsic secrecy” within the aviation industry, Andrea Barisani acknowledged in his 2016 talk “Real-life experiences in avionics security assessment.” As a result, stories about the many “positive things being done under the curtains” when it comes to securing planes’ computer systems rarely get told.
Andrea is currently F-Secure’s Head of Hardware security and the founder of Inverse Path, a consultancy firm acquired by F-Secure in 2017 after more than a decade of groundbreaking work in hardware security, including one of the first talks on car hacking.
He has worked extensively within the aviation industry, though all of that work is protected by non-disclosure agreements that would take longer to read aloud than his 57:55 minute talk. But, in 2016, he gave a “comprehensive explanation” about how avionics’ security works.
“It takes a lot to put it in perspective,” he explained and then attempted to do just that.
The concern the public has about computers in the context of air travel makes sense, he noted, because there is a fear that that the “interaction between safety and security has not been accounted for.” While safety has been a concern for generations, security, especially cyber security, is a far newer concern.
But, he argues, aviation is a field where there’s two concerns have been addressed together for longer than any other. This success is built on an “almost obsessive attention into checking the connection between these two domains.”
The result of that attention is a system of four separate domains on an aircraft that is “more or less” standardized. And the way these domains are constructed determines how software and hardware designed to be used on these crafts.
The properly segregated design ensures the protection of the Aircraft Control Domain system, the most “safety sensitive” domain. Even airline systems are considered untrusted to the aircraft manufacturers, for a conservative security approach.
The Passenger Information & Entertainment Services domain can include Global System for Mobile Communications, Wi-Fi and in-flight entertainment.
The exchange of information between these domains is “unidirectional,” which means information only flows out of the more secured domain and not into it.
The “BYOD” domain of the plane that allows users to use their own devices is the “Passenger Owned Device Domain.” This domain is entirely segregated from the other domains.
The result of this design is that the more catastrophic the potential failure of these systems is, the more protections and redundancies exists and the less likely the system is to be interacted with. This mindset represents a concern for both safety and security beyond the common perception of the industry. This valuable experience informs Andrea’s team as they engineer and test security designs in other safety critical verticals, including automotive and industrial control systems.
Few cyber security experts possess Andrea’s considerable experience with both hardware and software.
Likewise few experts have the background of Hugo Teso, F-Secure’s Head of Aviation Services, who has been a commercial pilot for seventeen years. That know-how helped him recognize that “enabled airplanes” would require a new sort of expertise that he, as someone who also has a passion for cyber security, possessed. He’s part of a “special breed” of cyber security experts with deep avionics knowledge.
With the guidance of experts like Andrea and Hugo, F-Secure is launching Aviation Cyber Security Services, which is designed to help airlines and similar organizations protect their aircraft, infrastructure, data, and reputations.
Ideally this service will not only improve the security and safety of air travel but all forms of transportation.
Categories