EUROCONTROL is building more cost-effective, wide-ranging cyber resilience capabilities

There are, broadly, three levels of cyber threat: Statesponsored groups conducting cyber-attacks mostly for political reasons; cyber-crime organisations for financial reasons by for example stealing and reselling information, ransomware, impersonating aviation stakeholders to extract money from legitimate organisations through deception or blackmail, and “hacktivists”, activists wanting to disrupt the aviation industry for motivational reasons.

While state-sponsored actors are responsible for around 23% of overall cyber-attacks they so far did not tend to target ATM organisations which are recognised as essential safetyof-life services – according to the current shared records of incidents. Will this remain? But cyber criminals are another matter. Their methods are becoming more complex and difficult to detect. They have begun adapting their operations from directly stealing money to stealing data and finding multiple ways of exploiting its value. These range from bombarding contacts with emails and only stopping when a ransom has been paid to encrypting part of a network and threatening to keep it locked – or expose it – unless money is handed over.

In general, the COVID-19 pandemic has seen a significant increase in phishing especially using COVID-19 attractive themes (fraudulent attempts to obtain sensitive information or data, such as usernames, passwords and credit card details, by disguising oneself as a trustworthy entity in an electronic communication) and malware (software designed to cause damage to a computer, server, client or computer network) attacks. These have become particularly harmful as the increase in remote working has given criminals a greater opportunity to access digital information. With so many people working in new ways it is more difficult to detect intruders when new working practices are being introduced. Many organisations are focused on survival, rather than expanding cyber security, and this has made the criminals’ job even easier.

"Cost-effectiveness is becoming an increasingly important component of the Agency’s cyber security operations – which means acquiring core skills and programmes which can then be distributed across a range of aviation stakeholder groups. “We are purchasing services that we provide free to our customers because they fund us,” says Mana. “Buying one licensed service that we can provide freely to a range of customers can be 12 to 15 times more cost-effective than if each organisation were to purchase a single licence.

Most of this work takes place via the EATM-CERT, which works both proactively and reactively to prevent security breaches and then manage and recover from incidents when they do occur. But more long-term programmes are also being developed.

One strategically important programme is the development of a trust framework for public key infrastructure (PKI) programmes such as system-wide information management (SWIM), which provides users with a digital certificate guaranteeing the validity of source material and originators, a kind of digital passport for SWIM as well as other aviation data providers and users. This Connecting Europe Facility (CEF) co-funded project under SESAR Deployment Manager portfolio is led and coordinated by EUROCONTROL. Thirty stakeholders (air navigation service providers, airspace users, airports and the military) contribute to it.

“This solution will provide and develop the means to ensure interoperability while securing the exchange of information,” says Mana. “It will ensure that information is shared using a network which accepts data from trusted parties. We are working initially on SWIM services but eventually this solution will be provided for other aviation information purposes. For example, it could be used to ensure that each radar sensor is identified and authenticated.

AI-based technology, like all forms of digital systems, can provide multiple benefits and security challenges.

“If some guys want to corrupt the response by inserting fake data that will obviously influence the way the AI/machine learning system will behave,” says Mana. “The other challenge is how can you certify these kinds of systems? Because we are very much used to a functional approach where we can conduct a test which clearly shows what output will occur from any given input. AI/ machine learning operates in a different way. The response to a certain set of data today could be quite different in a year’s time, because the system will have learnt to react in a more optimal way. And that’s very difficult to certify.”