Cybersecurity challenged by legacy systems, labor shortages

Increased digitalization, legacy systems, a lack of cohesive regulations and a shortage of talent: These are the top challenges in aviation cybersecurity . The goal of cybersecurity is to make “flight operations, surveillance, maintenance, ground and anything that touches safety, security, air worthiness and, of course, all the underlying functions system … cyber-resilient,” IATA Assistant Director of Aviation Cybersecurity Manon Gaudet said at an IATA webinar Thursday. [caption id="attachment_57136404" align="alignnone" width="1024"] (Photo/IATA)[/caption] More technology, more risk Cybersecurity is crucial now that so many systems are automated and digitally integrated . “As aviation becomes more and more connected, the attack surface for potential cyberthreats expands by introducing additional entry points for cyberattackers, who are continuously adapting their tactics and techniques, as we can see, to exploit vulnerabilities in the aviation infrastructure, making it crucial to address vulnerabilities proactively,” Dorian Pantea , director of cybersecurity advisory and assurance at Air Canada , said at the webinar. The increased use of third-party software suppliers also increases the risk of cyberattack, Pantea said. “We also need to consider that there are still a lot of legacy systems in use in the industry,” he said. “This poses a significant risk and concern. The systems, when they were designed, were designed without considering the advanced cyberthreats that we face today, which makes them more susceptible to attacks. The lack of regular updates, patching and maintenance for the systems further increases the risk.” Some legacy systems have been in place for decades. “They just are so critical to the operation that they can’t be messed with, they’re not changed,” Bryan Brown , senior cybersecurity engineer — aircraft for Atlas Air , said in the webinar. “And then you’ve got aircraft that are new, aircraft [that] are increasingly adopting more IT.” Regulations lag Panelists agreed that cybersecurity regulations must be wide-reaching and harmonized. “Many airlines operate in different jurisdictions around the world,” Pantea said. “And that creates complexities and gaps in terms of abiding by the regulations that are being developed or in effect, from provincial regulations to country regulations for aviation to regulations specific to cybersecurity or to safety.” Stakeholders are also hesitant to share information about their systems, making it difficult to draft regulations, Brown said. [caption id="attachment_57136402" align="alignnone" width="1024"] (Photo/IATA)[/caption] Even without standards and regulations in place, webinar panelists urged stakeholders to undertake risk assessments . “At the end of the day — and absence of regulation — you can start with that risk assessment,” William Harvey , head of cybersecurity assurance and compliance at IAG Tech , said at the webinar. “There’s no harm in taking a risk-driven rather than regulation-driven approach.” Regulators often take a risk-driven approach when drafting regulations, he said. Lack of talent Pantea attributed the lack of aviation cybersecurity talent partly to the complexity of aviation systems and partly to high demand for cybersecurity talent in other industries. “It is vital and crucial for aviation organizations to invest in cybersecurity training programs, to collaborate with academic institutions, and to attract and retain top talent with competitive compensation as well as career development opportunities,” Pantea said. “Internships are essential and are giving students the opportunity to understand what is the industry about and to learn some of the aspects of cybersecurity for the aviation industry,” he continued. “We also try to participate in as many competitions as possible and to invite students to those competitions.” Companies can also look within for cybersecurity talent, Pantea said. Companies can identify employees in other departments and train them in cybersecurity; this way, the individual is already well-versed in company systems and operations. Cybersecurity resources IATA launched a domestic partnership program in 2021 to facilitate aviation discussions among cybersecurity experts. The IATA Operational Safety Audit program also offers guidance. [caption id="attachment_57136403" align="alignnone" width="1024"] (Photo/IATA)[/caption] IATA offers a cybersecurity library , which launched this year and includes risk assessment and supply chain oversight guidance material, and the 3CTX Open Forum , a biannual, by-invitation workshop on cybersecurity. “The overall goal is basically to bring cybersecurity experts closer to the civil aviation industry and to increase the respective knowledge of the of the civil aviation ecosystem,” Mariusz Pyzynski , assistant manager of aviation cybersecurity at IATA, said at the webinar. The past three 3CTX Open Forums covered supply chain, risk assessment innovation, and incident and crisis management. “The threat landscape is always evolving and moving so fast that we need to plan for the unknown,” Gaudet said. Join Air Cargo Next for the upcoming webinar , “What’s new in digital cargo systems,” on Tuesday, June 13, at 11 a.m. ET. F or more information on the webinar and to register , click here.

Cybersecurity challenged by legacy systems, labor shortages

Stakeholders urged to implement risk assessments

Air cargo market decline slows in April, IATA finds

Economic downturn won’t affect freight long term, expert says

Related Posts

Cyber Aviation Global Forum to explore advancing cybersecurity risks in aviation

Fraunhofer looks to bring autonomous tech to air cargo

More data scientists needed for increasingly digital industry

Economic downturn won’t affect freight long term, expert says

Stay informed with our newsletters

Cargo Facts Connect Podcast

Follow Us

Welcome Back!

Retrieve your password