Documente Academic
Documente Profesional
Documente Cultură
August 2013
America must also face the rapidly growing threat from cyber-attacks . . . our enemies are also seeking the ability to sabotage our power grid, our financial institutions, our air traffic control systems. We cannot look back years from now and wonder why we did nothing in the face of real threats to our security and our economy. President Barack Obama, 2013 State of the Union Address
2. The need for a cybersecurity framework for aviation 3. Establishing a cybersecurity framework for aviation a. Establish common cyber standards for aviation systems Information technology standards Communications, Navigation, and Surveillance (CNS) and Air Traffic Management (ATM) Aircraft system design and production Airline operations Ground services Airport infrastructure Supply chain b. Establish a cybersecurity culture c. Understand the threat The threat actors and their intent Think about the unthinkable d. Understand the risk Create a risk/threat management methodology Understand the elements we need to protect. When your critical systems are attacked, do we understand the consequences? Understand how you protect these elements Understand the timeliness for responding to the threat e. Communicate the threats and assure situational awareness f. Provide incident response
g. Strengthen the defensive system h. Define design principles i. j. Define operational principles Conduct necessary research and development
k. Ensure that government and industry work together 4. Conclusions 5. Recommendations References Glossary Appendix A: Examples of standards used by aviation
Cyber Security in Civil Aviation, Centre for the Protection of National Infrastructure, August 2012, p. 2.
Summary Today, commercial jets span the globe with unprecedented safety and reliability. The same discipline that maintains this remarkable safety record must also be applied to better safeguard systems across the spectrum of aviation operations. As a result, it is critical that the global aviation community: (1) implement a common cybersecurity framework and implementation model to address evolving threats; (2) increase cooperation and focus within the aviation community, with the active participation of major industry players; (3) leverage, extend, and apply the existing industry best practices, response team, and research and education efforts under way; (4) bring the appropriate government agencies into the discussion; (5) begin building a roadmap by identifying near-, mid-, and long-term actions; and (6) establish a governmental and
Cyber Security in Civil Aviation, Centre for the Protection of National Infrastructure, August 2012, p. 2. Aviation: benefits beyond boarders, published by Air Transportation Action Group, dated March 13, 2012 4 Boeing study supporting TSA Risk Management Assessment Process 3 NY Times analysis of the long-term impact of 9/1, dated Sept. 8, 2011 5 NY Times analysis of the long-term impact of 9/1, dated Sept. 8, 2011
Federal Aviation Administration Fact Sheet Commercial Aviation Safety Team, dated December 11, 2011, http://www.faa.gov/news/fact_sheets/news_story.cfm?newsId=13257 7 White House Commission on Aviation Safety and Security, dated February 1997 8 National Civil Aviation Review Commission, Avoiding Aviation Gridlock and reducing the Accident Rate, dated December 1997 9 Ross Anderson, Why Information Security is Hard An Economic Perspective, http://www.acsac.org/2001/papers/
3) Establishing a cybersecurity framework for aviation Ensuring a secured aviation system and staying ahead of evolving ICT threats is a shared responsibility, involving governments, airlines, airports, and manufacturers. The following framework seeks to offer an approach to increasing the effectiveness of cybersecurity for aviation. The aviation community must also develop the vision, strategy, and goals to develop the framework into a comprehensive roadmap and plan for aviation. a. Establish common cyber standards for aviation systems b. Establish a cybersecurity culture c. Understand the threat d. Understand the risk e. Communicate the threats and assure situational awareness f. Provide incident response g. Strengthen the defensive system h. Define design principles i. Define operational principles j. Conduct necessary research and development k. Ensure that government and industry work together
10 11
Barbara van Schewick, Internet Architecture and Innovation, The MIT Press, 2010, page 1
Department of Defense Defense Science Board (DSB), Task Force on Resilient Military Systems and the Advanced Cyber, dated January 2013
UK Centre for the Protection of National Infrastructure (CPNI), Security in Civil Aviation, Date August 2012
12
5) Recommendations
The aviation community must pursue the following course of action in light of the evolving nature of cyber threats: implement common cybersecurity vision, strategy, goals, and framework to address evolving threats; increase the cooperation and focus within the aviation community, with the active participation of all major industry players; leverage, extend, and apply the existing industry best practices, the response team, and the research and education efforts under,way; bring the appropriate government agencies into the discussion; begin building a roadmap by identifying near-, mid-, and long-term actions; and establish a governmental and industry framework to coordinate national aviation cybersecurity strategies, policies, and plans. References 1. National Institute of Standards and Technology (NIST), Update on the Development of the Cybersecurity Framework, dated June 18, 2013, http://www.nist.gov/itl/cyberframework.cfm
Glossary ACARS Aircraft Communications Addressing and Reporting System A digital datalink system for transmission of short, relatively simple messages between aircraft and ground stations via radio or satellite. Air Traffic Management Commercial Aviation Safety Team A government and industry effort to reduce aviation fatalities through a data-driven risk management approach. Center for Education and Research in Information Assurance and Security Critical Infrastructure Partnership Advisory Council Communications, Navigation, and Surveillance Control OBjectives for Information and related Technology Commercial Off-The-Shelf European Organisation for Civil Aviation Equipment A European forum for resolving technical problems with electronic equipment for air transport. Information and communications technology Information Systems Audit and the Control Association International Organization for Standardization A developer of voluntary international standards for products, services, and best practices. Maintenance, Repair, and Overhaul A provider of required air carrier inspections, heavy maintenance and overhaul of airframes, power plants, and landing gear, and modifications. National Institute of Standards and Technology A non-regulatory federal agency within the U.S. Department of Commerce that develops technology, measurement, and standards. personally identifiable information (PII) RTCA, Inc. Previously known as Radio Technical Commission for Aeronautics until re-incorporation in 1991 as a not-for-profit corporation, RTCA is a U.S. volunteer organization that develops technical guidance for use by government regulatory authorities and by industry. Satellite Communication A system for transmission of data between aircraft and ground stations via satellite.
ATM CAST
NIST
PII RTCA
SATCOM
Appendix A: Examples of standards used by aviation Examples of the NIST and ISO standards used in aviation include: ISO/IEC 27000 Information security management systems ISO/IEC 27001 Information security management systems Requirements ISO/IEC 27002 Code of practice for information security management ISO/IEC 27003 Information security management system implementation guidance ISO/IEC 27004 Information security management Measurement ISO/IEC 27005 Information security risk management ISO/IEC 27006 Requirements for bodies providing audit and certification of information security management systems NIST Special Publication 800-53 Recommended Security Controls for Federal Information Systems and Organizations Standards that guide the development of cybersecurity measures in the CNS/ATM system include: DO-236 Security Assurance and Assessment Processes for Safety-related Aircraft Systems ICAO Annex 17- Security ICAO Document 9985- Air Traffic Management Security Manual Standards that guide the development of aircraft systems include: NIST SP800-30 Risk Management Guide for Information Technology Systems NIST SP800-53 Information Security NIST SP800-82 Guide to Industrial Control Systems (ICS) Security RTCA DO160 Environmental Conditions and Test Procedures for Airborne Equipment RTCA DO178 Software Considerations in Airborne Systems and Equipment Certification RTCA DO-254 Design Assurance Guidance for Airborne Electronic Hardware RTCA DO-233 Portable Electronic Devices Carried on Board Aircraft