GUEST ESSAY: Where we stand on mitigating software risks associated with fly-by-wire jetliners – Source: www.lastwatchdog.com

By Vance Hilderman

The threat of bad actors hacking into airplane systems mid-flight has become a major concern for airlines and operators worldwide.

Related: Pushing the fly-by-wire envelope

This is especially true because systems are more interconnected and use more complex commercial software than ever before, meaning a vulnerability in one system could lead to a malicious actor gaining access to more important systems.

Here’s what you should know about the risks, what aviation is doing to address those risks, and how to overcome them.

It is difficult to deny that cyberthreats are a risk to planes. Back in 2015, a security researcher decided to make that very point when he claimed to have hacked a plane, accessed the thrust system, and made it fly higher than intended.

Thankfully, the incident ended safely (or perhaps was unproven), but it clearly highlighted a need for stiffer security measures, particularly as all experts agree avionics system complexity and growing use of onboard software updates increases cyber-security risks .

Risks delineated

Still, there have been many other incidents since. In 2019, a cybersecurity firm demonstrated security risks that could allow an attacker to disrupt engine readings and altitude on an aircraft. There was another warning from the U.S. Government Accountability Office in 2020 about increasing risk due to connected aircraft technology developments.

More recently, there were seven noteworthy attacks on airlines in just one month last year. And those incidents may only be increasing. This is why aviation has recently mandated all new aviation systems comply with DO-326A (called ED-202A in Europe), which is a required standard all new aircraft and systems follow.

There are three factors that I could see presenting an even greater risk going forward. Number one is increasingly connected systems; number two is onboard Wi-Fi; and number three is the use of commercial software, including artificial intelligence in aircraft.

Hilderman

Many components and systems within an aircraft can exchange data and communicate with each other or with the external internet. Unfortunately, the interconnectivity of systems creates potential entry points for cyber threats, as a vulnerability in one component could provide an avenue for unauthorized access or malicious activities throughout the aircraft’s network.

One increasingly common measure, which is partially effective at mitigating connected system risk is “AFDX” (Aviation Full Duplex Ethernet), which is specialized hardware/software communication hardware and software protocols that minimize vulnerabilities. AFDX improves security through compliance with the aforementioned DO-326A and also DO-178C.

Software gaps

Similarly, the availability of onboard Wi-Fi services has become increasingly common in commercial aircraft so passengers can stay connected to the internet even during a long flight. However, onboard Wi-Fi networks, if not adequately secured, can provide a gateway for cyber attackers.

So watch out for weak encryption protocols, insufficient network segregation, or insecure user authentication mechanisms. Measures like network segmentation, intrusion detection systems, and frequent security updates can help airlines ensure Wi-Fi doesn’t put the flight at risk.

And finally, just imagine how much more dangerous a hack becomes once a plane uses regular consumer software for entertainment, scheduling, tracking maintenance records, or is controlled through artificial intelligence and there’s limited or no oversight from a human pilot in the cockpit.

While this isn’t necessarily a big issue today since completely pilotless aircraft won’t be taking flight for a good while yet, such a hack could enable bad actors to control or potentially even bring down a plane.

Fortunately, there are ways to address the risks. You may have noticed that you haven’t heard of a plane that’s been taken over during flight by a successful hack in the past few years, despite the fact that airlines are common targets of attacks.

Level of mitigation

It is safe to say you won’t hear of a plane crashing due to a cyber attack in the near future either. That doesn’t mean there aren’t cyberthreats out there. It just means that, up to now, cybersecurity engineers and safety regulations have been remarkably successful at staying ahead of threats.

For example, as noted previously there’s the ED-202A guidelines in Europe and DO-326A in the U.S., collectively known as the “Airworthiness Security Process Specification.” While these standards were first published in 2010, they have since been updated for newer threats and became the only Acceptable Means of Compliance (AMC) for airborne avionics systems in 2018 and now mandatory since 2022.

This means that all avionics engineers had to ensure software on board planes was compliant and carefully tested for vulnerabilities and safety risks per DO-326A or ED-202A, no excuses, no alternatives.

In addition, the International Civil Aviation Organization published the Aviation Cybersecurity Strategy in 2019, offering recommended cyber attack prevention and response procedures. And to this day, authorities continue to update cybersecurity regulations and safety testing.

So regulatory authorities are doing their part, and airlines have been working to follow suit. Some companies have been known to reward anyone who can discover and report a possible vulnerability in certain ground systems, websites, or scheduling systems. American Airlines also has a cybersecurity and data security training program for all team members.

There are plenty of good examples to follow for beefing up security, and thanks to the strong regulatory guidelines, you can be reasonably confident that your plane won’t get taken over by a hacker during your next flight.

About the essayist: Vance Hilderman, CEO of AFuzion, is a renowned aviation expert with extensive experience in engineering reports and safety-critical compliance. Vance would be happy to provide a non-promotional article on the cyber security risks facing airlines today and strategies to ensure safety in commercial aircraft.

August 29th, 2023 | Guest Blog Post | Top Stories