Advancing Cyber Resilience In Aviation: An Industry Analysis

1. Aviation Industry Contextin the Digital Age1.1Adoption of emerging technologies in the aviation industryToday, the aviation ecosystem benefits fromnew levels of digitalization and connectivity.Physical things and cyber systems are becomingincreasingly connected – from assets to peopleand data – by harnessing technologies includingbiometrics, artificial intelligence, machinelearning, autonomous vehicles, blockchain andthe industrial internet of things (IIoT).manufacturing and consumer.3 Airport facilityautomation is expected to deliver the fastestworldwide spending growth in 2017-20224.Furthermore, machine learning and artificialintelligence (AI) are becoming more sophisticatedand prevalent, with growing potential to amplifyexisting risks or create new ones, particularly asthe IIoT connects billions of devices.5Technological advances are creating tremendousopportunities for improved flight efficiency,customer service, security, safety operationsand passenger experience – both in the airand on the ground. The opportunities that IIoTcapabilities can generate for the aviation industryare unprecedented. They include operationalefficiencies such as tracking and connectingairport or airline assets with maintenance andinspection functions, facility management toidentify shortages or breakdowns in real time,and automation of cargo vehicles, food services,ramps and taxiways.2Yet along with the new heights of efficiencygained through increasing digitalization andconnectivity come new frontiers of vulnerability.Rapid cyber capability breakthroughs also createnew potential attack vectors at an equally fastpace, with researchers identifying cyber riskamong the top three risks facing the transportindustry globally.According to the International Data Corporation,transport ranks third among the industries thatwill spend the most on IIoT solutions, after1.2What is at stake?Aviation is a vital industry that contributessubstantially to economic development andimproved living conditions. According to theICAO, the 4.1 billion passengers transportedin 2017 are expected to grow to around 10billion by 2040. And according to IATA, 35% ofworld trade by value is transported by air cargo,equivalent to 6.4 trillion of goods. The role ofthe aviation industry in commerce, trade andtransport infrastructure makes it indispensable tothe global economy.Aviation forms part of Critical NationalInfrastructure (CNI) defined by the USDepartment of Homeland Security as“.whose assets, systems, and networks,whether physical or virtual, are considered so7The initiative to reinforce cyber resilience in theaviation sector builds on the Industrial Internetof Things Safety and Security Protocol, a codesigned framework of high-level governanceprinciples developed by over 20 companies,governments, organizations and universities,published by the World Economic Forum in April2018.6Advancing Cyber Resilience in Aviation: An Industry Analysisvital that their incapacitation or destruction wouldhave a debilitating effect on security, nationaleconomic security, national public health orsafety, or any combination thereof”7.One key characteristic of CNI also apparentin the aviation industry is the high level ofinterdependency between the various sectors ofactivity (airports, air navigation services, airlines,etc.), and interconnectivity with related systems(maintenance services, network connectivityservices, fuel distribution systems, etc.). Oneincident at any point in this value chain can havesevere consequences in other areas.8

The probability and impact of a cyberattack ondifferent parts of the aviation domain may vary.For instance, airports may be more vulnerableto a cyberattack than airlines, and unmannedaircraft systems (UAS) present new threats andchallenges. Drones will operate differently fromtraditional manned aircraft and will be connectedto what is called UAS Traffic Management (UTM).The drone will be connected to that platformby a form of radiofrequency spectrum and willlikely operate off devices such as a pilot-incommand’s cell phone. This presents manypotential cybersecurity challenges, such as adrone’s camera being hacked, that have yet tobe addressed by the industry via a standard.“Technology and digitization not only bring manyadvantages, but also risks associated withthe challenge of finding and managing cybervulnerabilities across complex, internationaloperations from airports, aircraft operators, AirTraffic Management, and supply chain”.9 Ashighlighted by IATA , this complexity makes theaviation industry vulnerable to hidden cyber risksand ever-increasing threats. The airline industry isan attractive target for many cyber threat actorswith diverse motives, ranging from financialgain to causing disruptions and harm, as wellas unintentional motives related to human error,which are often the cause of incidents.10Due to their complexity, cyberattacks on CNImay be more difficult to detect and control andmay generate cascading effects resulting ineconomic loss, industrial disruption and, in somecases, human casualties.11 When applied toCNI that drives economic and social progress,the impact could be severe in the absence ofadequate cybersecurity and resilience measuresand capabilities.According to IATA, “the combined rapidevolution of; technology, vulnerabilities, threatsand adversary motives is occurring againsta background of international complexity ofcybersecurity regulations, complex supply chainand insufficiently understood cyber risks acrossall segments of the aviation industry”.12 Moreover,cyber resilience poses a unique challenge forgovernment regulation of businesses, as theprocess for certifying and enforcing good securitypractices can be too resource-intensive andcostly for governments to address on their own.The consequences of any major failure couldcarry direct public safety and national securityimplications and costs. Additionally, as newdigital capabilities arise, balancing commercialinterests with sound risk management will beeven more critical to avoid significant harm topublic order, confidence and trust.Not all stakeholders are prepared for thepotential risk and liability that may be broughton by new technologies. The complexity of theaviation ecosystem, with its many stakeholders,makes understanding the new nature of riskparticularly challenging and highlights the stronglink between digital identity management, trustand safety of operations. It also indicates theimportance of identifying which aspects of theaviation ecosystem require priority attention andresources above others. The aviation industrytoday is realizing a future in which drones deliverpackages to the doorstep and a daily commutemeans flying over traffic. As industry andgovernment work together on strong policy andregulations, industry consensus standards willbring us closer to that future.Building Cyber Resilience in the Aviation Sector8

1.3Need for global collaboration to enhance cyber resilience in aviationThe aviation industry sits within a broadergeopolitical landscape that includesintergovernmental policies, security concerns,national interests, economics and society.Reaching industry alignment on meeting thechallenges of new technology adoption musttake these factors into account.Without a common understanding and approachto emerging threats, industry players maystruggle – and even fail – to come up witheffective cyber resilience measures for theaviation industry.To foster public-private collaboration anddialogue across the industry, the WorldEconomic Forum has launched an initiativeon Building Cyber Resilience in the AviationIndustry13, which aims to define and addresssome of the salient systemic challengesconfronting this industry through:– Increasing awareness and understandingof cyber risks relative to the adoption ofemerging technologies, and the impact oncritical systems– Fostering collaboration across the aviationindustry to define a common understandingand approach to risk management that isholistic, risk-based and aligned across thedifferent entities of the aviation industryecosystem– Helping aviation stakeholders in makinginformed – and more effective – decisionsrelated to cyber risks– Developing an industry-wide approach tocyber resilience with a multistakeholdercommunity in alignment and collaborationwith the ICAO Secretariat Study Group onCybersecurity (SSGC), industry associationsand national authorities– Creating market incentives to prioritize capitalinvestment for cybersecurity and resilienceTo advance and help build cyber resilience inthe aviation industry, the Forum has mobilizeda community of experts and key stakeholdersfrom international organizations (InternationalCivil Aviation Organization, Organization ofAmerican States, Eurocontrol), governmententities (European Aviation Safety Agency, UKCivil Aviation Authority, Israel National Cyber9Advancing Cyber Resilience in Aviation: An Industry AnalysisDirectorate, UK National Cyber Security Centre),private-sector organizations (aviation, ICT andinsurance sectors) and trade associations(International Air Transport Association, AirportCouncil International and the Industrial InternetConsortium) to identify challenges and initiativesspearheaded by various government andindustry entities to enable the development of analigned global approach.ICAO, the industry and national authorities arecurrently leading many initiatives seeking toprotect critical systems against cyberattacks.Likewise, there is recognition among communityexperts and stakeholders of:1. The need to increase understanding andawareness of cybersecurity risks in thisindustry2. The need for global synchronization of aviationcyber resilience efforts3. The interest in gaining a commonunderstanding, and application, of riskmanagement practicesThe goal of this community is to help promote asecure and resilient aviation ecosystem, enablingparticipants to transfer their industry learningsand best practices across all segments of theaviation industry that operate critical systems.

2. Aviation Industry Analysis2.1Global risk insightsThe second most frequently cited risk in theWorld Economic Forum Global Risks Report201914, was the pairing of cyberattacks withcritical information infrastructure breakdown.The potential vulnerability of critical technologicalinfrastructure has increasingly become a nationalsecurity concern. The report highlighted thatthe disruption of operations and infrastructureresulting from cyberattacks ranked among thetop five global systemic risks.Figure 1 clearly shows the sensitivity to cyberrisk among aviation industry respondents.Peers in the transportation industry prioritize“Increased security threat from cyber anddata privacy breaches” higher than theaviation industry. This suggests that aviationparticipants find it challenging to balance cyberalongside other risks in a particularly complexoperational environment as digitalization andinterconnectedness become the new norm.Figure 1 – Transportation Risk IndexAirRankTransportation sector1Increased security threat fromcyber and data-privacy breachesFailure of critical IT systemsCompetition/anti-trust law scrutinyassociated with M&A activity2Failure of critical IT systemsCompetition/anti-trust lawscrutiny associated with M&AactivityChange in seasonal demand,leading to shortfall or oversupplyof transport (utilization/capacity)affecting prices3Dependence on third-partysuppliersDependence on third-partysuppliersFailure of critical IT systems4Third-party security vulnerabilitydigital supply chain resilienceInability to keep up with paceof change and technologicaladvancementExtreme weather events/naturaldisasters, epidemics and armedconflicts5Competition/anti-trust lawscrutiny associated with M&AactivityOver-dependence on nationalinfrastructureIncreased security threat fromcyber and data-privacy breaches(All industrial capabilities providing flightabove the ground, including space)AirportsSource: Willis Towers Watson2.2Key insights from industry stakeholdersThe impact is seen broadly across theindustry, with operational disruption and legalconsequences becoming more widespread, andall areas of the aviation industry experiencinglosses in the last year.15 Noting the risks thatcyber threats pose for the aviation industry,including potential safety risks, industrystakeholders are developing cyber-resiliencestrategies to mitigate these effects and to protectcritical assets and functions.Aviation stakeholders must assess the threatsagainst which they want to defend the industry,establish the design principles and controlobjectives accordingly, implement effectivecontrols and keep them up to date. A recentsurvey conducted under the initiative (alsoreferred as “the survey”) examined how somemembers of the aviation industry view cyberrisks, threats and vulnerabilities relevant tothe sector. The findings shared here arerepresentative of the surveyed communityand while they have been validated by furtherresearch, they are not exhaustive. The objectiveof capturing and publishing these findings is toraise awareness among key aviation stakeholdersas a first step to mobilizing collective action toaddress systemic challenges.Building Cyber Resilience in the Aviation Sector10

2.3ThreatsCyber threats generally refer to attempts tocompromise the confidentiality, integrity oravailability of systems, networks or informationusing a data communications pathway anddiverse vectors to compromise their target.This access can be directed from within anorganization by trusted users, often inadvertently,or from remote locations by unknown personsusing the Internet. Threats, and more importantlyAdvanced Persistent Threats, come from threatactors such as hostile governments, advancedcyber criminals, terrorist groups, disgruntledemployees, malicious intruders, or hacktivistgroups.16 Historically, industrial control systemshad a focus on availability and not confidentialityand/or integrity as those networks were typicallynot connected to the internet. This is changingrapidly as these systems are being connected toless secure networks and systems and could beexposed to cyberattacks targeting the weakersystems.nation state offensive capabilities17, able todisrupt or destroy critical national infrastructure,combined with continuing geopolitical instabilityand the ongoing evolution of organized crime18present a significant challenge for increasinglyinter-connected and data-reliant industries suchas aviation.The survey analysis raises a shared concernabout the ability to respond to the cyber risks.Specifically, the role of human behaviour asa potential threat, the increasing adoptionof open or shared technology platforms andthe emergence of new technologies acrossaviation operations, combined with businesstransformation and talent shortages, areincreasing the exposure to cyber threats (Figure2).Renewed concern over human behaviour asboth a threat and vulnerability is apparent acrossmultiple sectors with 87% of executives aroundthe world citing untrained staff as the greatestcyber risk to their business.19Furthermore, the threat landscape is continuallychanging, and new attack vectors are createdat an equally fast pace. The emergence of newFigure 2 – Perceived impact of emerging issues to the aviation industryHuman behaviourAdoption of open platforms, APIsand cloud based servicesSupply of cybersecurity talent / war for IT talentAdoption of new technologies suchas AI, IIoT and blockchainSpeed of internal digital transformation of businessConnectivity between industry participantsCreation of digitally-enabled products,services and customer interfacesIncreasing connectivity and use of mobile technologyRegulatory changes and heightened government securityIncrease in global operationsGrowth through acquisitions, jointventures and partnershipsExpanded supply chain of vendors, suppliers, etc.Heightened customer and public concernsReinventing workplace and collaborativeenvironments of the futureAvailability of cybersecurity insurance011Advancing Cyber Resilience in Aviation: An Industry Analysis123Weighted Threat Impact Score45

2.4RisksWorld Economic Forum research onUnderstanding Systemic Cyber Risk20 explainedthat “systemic risk is inherently different fromnon-systemic risk in that the consequencesare more widespread – systemic risk is therisk of ‘breakdowns in an entire system, asopposed to breakdowns in individual parts andcomponents’ – and more complex as multiplevariables, connections, dependencies andinterdependencies result in cascading, oftenunexpected, consequences”. The industrychallenges associated with systemic risk areconsequently also increasingly interconnected,widespread and complex.In addition to the risk insights disclosed by thesurvey, the following challenges were prioritizedby initiative aviation community membersmeeting in November 2019:1. Highly interconnected/interdependent supplychain2. Global synchronization of aviation cyberresilience efforts / initiatives3. Developing an aviation cyber resilience cultureacross the entire industry4. Building coherent understanding ofcybersecurity risk across safety, physicalsecurity and enterprise5. Aviation cybersecurity workforce development6. Increasing objectivity and transparency ofaviation security riskTechniques used during risk assessment impactthe ability to evaluate the extent of risk associatedwith an organization’s perceived threats. Whenasked about the assessment techniques used,nearly 75% of survey participants reported usingqualitative techniques, with the remainder usingsemi-quantitative techniques such as assigningfinancial exposure values in risk register.As industry risk-management practices becomemore mature, a more quantitative approach torisk management may be introduced, to betterunderstand the risks associated with thesethreats and to build a more resilient industry.Entity level risksHuman factorOperations technologycontrol weaknessInformation technologycontrol weaknessLimitation in communications withboars and stakeholders, or withinthe industryOperational andprocess failureIneffective governance andprioritization of risks and controlsAdoption of emergingtechnologies such as IIoT012345 6 7Risk level8910Source: Initiative survey results, Willis Towers WatsonSector level risksInformation technologycontrol weaknessHuman factorWhile industry-wide survey participantshighlighted connectivity and technology change,individual organizations considered the humanfactor to be the primary risk concern for them.Awareness of this risk factor has increased, yetthere still is an industry need to further develop acomprehensive cyber culture.As Willis Towers Watson and ESI Thought Labemphasized in 2019, “Leaders in cybersecurityare devoting significant resources towardsprotecting IT and risk functions within theirorganizations against external threats, butemployee processes and training as well ascorporate culture play a more integral role thanmany realize.”21Operations technologycontrol weaknessIneffective governance andprioritization of risks and controlsOperational andprocess failureAdoption of emergingtechnologies such as IIoTLimitation in communications withboars and stakeholders, or withinthe industry012345 6 7Risk level8910Source: Initiative survey results, Willis Towers WatsonBuilding Cyber Resilience in the Aviation Sector12

2.5VulnerabilitiesVulnerability can be understood as “weaknessin an information system, system securityprocedures, internal controls, or implementationthat could be exploited or triggered by a threatactor”.22Most participant organizations were willing toshare the type of incident(s) incurred withinthe previous 12 months. This knowledge andthe practice of sharing breach informationhelps provide a basis for identifying where keyvulnerabilities lie. By understanding the incidentsthat have occurred, the industry is able torecognize where attackers are targeting and canbegin building more resilient controls.Most interestingly, human vulnerabilities weremost commonly cited, with most participantsreporting incidents emerged from s

1. Aviation Industry Context in the Digital Age 7 1.1 Adoption of emerging technologies in the aviation industry 7 1.2 What is at stake? 7 1.3 Need for global collaboration to enhance cyber resilience in aviation 9 2. Aviation Industry Analysis 10 2.1 Global risk insights 10 2.2 Key insights from industry stakeholders 10 2.3 Threats 11