Written by staff writer.
Aviation is a target-rich industry for cybercriminals, with private and state-sponsored crime syndicates increasingly attempting to disrupt it. However, airlines are well aware of the threat and are fighting back with the full backing of regulatory agencies and governments.
Malicious actors like the aviation industry. It is high profile, complex, and cyber attacks have an outsized impact. Earlier this month, attackers shut down the public-facing website and app of Scandinavian Airlines (SAS) for almost 24 hours as part of a ransomware attack. Cybercriminals have attacked that airline several times already this year.
Airlines are responding to incidents like this by developing increasingly solid cyber defences, and the regulatory agencies behind the airlines have put frameworks and minimum standards into place to facilitate this.
The Qantas Group, including the budget carrier Jetstar, says it is constantly improving its cyber capabilities. “We operate in an environment of ever-evolving cyber threats, where external attackers are always adopting more sophisticated techniques. Protection from these attacks is key.”
The United States-based Atlas Air wet leases Boeing 747 freighters to Qantas. Brian Brown, a senior cyber security engineer at Atlas, told an International Air Transport Association (IATA) forum last week that airlines must manage many cyber security challenges. However, one of the biggest is protecting legacy systems embedded in airlines but potentially vulnerable to attack.
“They (legacy systems) have been around for a long time, sometimes decades. They are so critical to the organization that they cannot be messed with or changed, and it’s in the back office. Then you’ve got new aircraft that are increasingly adopting more IT into this.”
Because of the essential nature of the legacy systems in many airlines, operators have added on to them over the years rather than replace them. Brown says this is potentially problematic from a cybersecurity point of view.
“Is anyone looking at it (the practice of adding on to legacy systems) from the perspective of cyber and saying, do we have adequate controls to protect these systems and how critical are they?”
IATA, a trade body representing over 300 airlines, including Qantas and Virgin Australia, says cyber security is essential to maintaining safe, secure, and resilient operations across the industry and is a top priority.
Technology and digitization bring many advantages to aviation, but at the same time, creates challenges in managing cyber vulnerabilities in this complex environment,” the Canada headquatered organization says. “The airline industry is an attractive target for cyber threat actors with a multitude of motivations, ranging from stealing value in data or money to causing disruptions and harm.”
The proliferation of digital solutions in the airline industry, so often tacked onto those not-so-nimble legacy systems, is opening the door the cybercriminals. The Qantas Group says its operations, which now include over 300 aircraft, depends on the smooth transfer of data between systems and networks. The groupsays it works with employees, vendors, and other third parties to keep its operations secure from cyber attacks, adding that there is an ongoing investment in resources to improve the processes and technologies to help keep the airline secure.
