Ensuring the security of aviation and aerospace systems requires collaboration among a variety of experts, says Dr. P. Barry Butler, president of Embry-Riddle Aeronautical University, in a recent Aviation Week essay. Dr. Butler emphasizes the important role that higher education plays in facilitating such collaboration, conducting long-term research, and developing a workforce skilled in cyber resilience. The Eagle community can freely access this op-ed by logging on to ERNIE through the Hunt Library, and Aviation Week subscribers can access the essay posted below by logging on here.
By P. Barry Butler
Hackers targeted major airports, breaking into systems ranging from airline kiosks and baggage tracking to air traffic control and even avionics on planes in the air.
The team will work to root out the hackers, identify the problem, and make any necessary repairs.
Fortunately, this worst-case scenario happened during a Capture the Flag (CTF) competition held on the campus of Embry-Riddle Aeronautical University in Prescott, Arizona. The competition, held in April 2024, saw students from various institutions compete to devise the best defenses to mitigate a hypothetical attack.
Our nation’s aerospace systems are becoming increasingly complex as aircraft technology improves, more aircraft enter our airspace, and the space sector grows rapidly.
Making these systems resilient to real-world cyberattacks will require greater collaboration among a broad range of experts, including engineers, supply chain specialists, airport personnel, information technology workers, intelligence professionals, white hat hackers, government officials, pilots, etc. Additionally, higher education institutions and their faculty are critical to conducting long-term research and developing a workforce with cyber-resilience skills.
“By bringing together industry, government and academia, we can identify the growing challenges of aviation cybersecurity,” Arizona Sen. Mark Kelly said in a video message to participants at an Aviation Cybersecurity Workshop held on the Prescott campus.
With aircraft's new connectivity comes new vulnerabilities: “There are hundreds of boxes on a plane that have IP addresses, and that's a problem,” said Dr. Krishna Sampigetaya, director of the Cyberintelligence and Security department at Embry-Riddle University and a conference organizer.
Sampigetaya stressed that due to the risk of “zero-day attacks” and unforeseen vulnerabilities, aviation systems need to be cyber-resilient and operate safely even under attack, similar to how a pilot navigates through a storm.
Moreover, cyber attacks in aviation can be more insidious, targeting the operation of systems without appearing to affect their functionality – a prime example being the string of GPS spoofing incidents occurring near war zones, where fake signals have knocked aircraft navigation systems off course.
Protecting aviation systems is further complicated by a mixed-criticality environment that intertwines high- and low-risk systems.
Sampigetaya said Embry-Riddle's forum on aviation cybersecurity offers an opportunity to bring together IT professionals familiar with cybersecurity challenges with those traditionally responsible for aviation safety and security to communicate “the uniqueness of the aviation system.”
At a workshop held on the Prescott campus in April, experts shared best practices and examined emerging risks, such as those associated with autonomous systems and advanced air mobility. Speakers discussed pressing issues such as investigating the cyber-readiness of pilots and protecting space infrastructure, including the growing number of commercial satellites and rockets.
Companies are rightly concerned about leaking proprietary technology and the reputational risk of exposing vulnerabilities. This is where organizations like Embry-Riddle University's Center for Aerospace Resilient Systems (CARS) come into play. CARS is a university-wide research center that tackles critical challenges in aerospace systems, including cybersecurity. By collaborating with industry and government stakeholders on collaborative research projects, the center enhances information sharing and establishes a framework for anonymized, protected data.
CARS Executive Director Dan Diessner said visionary researchers have the advantage of being able to address big challenges and systemic dangers regardless of a company's specific structure.
There is also an urgent need for a pipeline of experts who can track down bad actors, conduct forensic investigations, and help improve aerospace systems to safely withstand cyberattacks.
The White House has prioritized developing a strong cybersecurity workforce to protect critical infrastructure, including aviation, and scholarship programs like those offered through the National Science Foundation (NSF) are key to this effort.
Meanwhile, the industry is providing students with a modern platform for practical training.
Another Capture the Flag competition took place at the Aviation Cyber Initiative (ACI) Cyber Rodeo held in February on the Embry-Riddle University campus in Daytona Beach, Florida, where student teams competed against industry professionals to respond to an aviation cyber emergency. The students hunched over computers and took control of flight simulators.
A team of cadets from the Air Force Reserve Officer Training Course, Detachment 028 on the Prescott campus, took first place. Team leader Cadet Carson Tucker will be an officer next year and will be one of our nation's newest Aerospace Cyber Defense Corps members.
“I'm excited to join the Air Force and utilize all of the skills I've honed in the cyber program,” he said.
P. Barry Butler is president of Embry-Riddle Aeronautical University.
Published in: Agency News | Security Intelligence & Safety
