in Events

Aviation Africa 2018: Cyber security: Not if, but when

Posted 18 April 2018 · Add Comment

An airline’s greatest cyber-security threat may also be its most precious asset – its staff – according to panellists speaking at Aviation Africa in Cairo. Victoria Moores reports.

 

Hacking in to a company is no mean feat. The path of least resistance is often unsuspecting staff, who get caught out by cyber-security basics, such as password privacy or falling for phishing emails. This can lead to data theft, extortion, or worse, as national governments and criminals seek to exploit our 21st Century dependency on technology.

PGI managing director Brian Lord said employees are the easiest way into an organisation and the starting point for the most sophisticated attacks. “It is still the case that 80% of all global cyber attacks would have been stopped if human beings had been trained to operate properly,” he said.

Lord urged companies to improve basic training, run cyber-security incident exercises and carefully manage media fallout. “The damage of ineffective reporting carries just as much risk as the technical issues underpinning it,” he said.

Attackers use public fear and uncertainty stirred up by the media as a weapon in its own right, disabling and damaging the target company and tying up resources long after the technical problem is solved.

“The reaction to a disabling technical attack on an organisation is normally quite good. Where it falls down is their ability to manage that with the public, customers, shareholders and media. This is commercial damage; the technical damage is normally quite minimal.”

Aside from criminal attacks, countries are also developing their own cyber-attack capabilities and testing them. “This practice is happening all over the world,” Lord said. Unfortunately, airlines and airport are natural targets for both types of attack, because they form part of a country’s critical national infrastructure.

Simon Knechtli, who is executive director aerospace at insurance firm Willis Towers Watson, said the insurance industry is changing its approach to cyber threats and extending cover to include a network interruption option.

“There are only two types company: those that can be hacked and those that will be,” Knechtli said. “Don’t just refer us to the IT department. This is a business risk.”  

He estimated the average cost of a data breach at $3.6 million. This is only likely to increase with the introduction of new European rules that carry a 4% of global revenue penalty for data leaks. “That is really focusing the mind of aviation companies,” he said.

Knechtli agreed that the main vulnerability to cyber attacks is employee negligence. “90% is human error. The major risk to be dealt with first are your own employees.”

Like Lord, he said companies should have a strategic plan when it comes to cyber security, including staff training.

Industry IT specialist SITA has collected 10 years of aviation cyber-attack data, profiling the attackers and their intentions. Hackers make up 40% of the total, with 32% being motivated by financial gain, said SITA global lead of business management Ahmed Fawzi. “A very important part of protecting the business is to get users aware, so they don’t get exploited,” he said.

Airlines need an action strategy, said Fawzi, but that plan will need constant revision. “This is not a one-time process. It is a repeat process that has to be ongoing, making sure you are constantly in the game and not falling behind at any time.” Fawzi announced that SITA is about to start a cyber-security benchmarking study and invited conference delegates to join the project.

One area of the business that is particularly sensitive to breaches is business aviation, said Africa Satcom Direct (SD) business development director Brian Roos. With this in mind, SD is able to provide passengers with end-to-end encryption via a private network and detect in-flight cyber attacks in real-time. The company is so confident in its security levels that it guarantees against cyber-attack losses.

Cyber attacks could come at any point in the supply chain, for example using hub airport vulnerability to disrupt airline operations. This need for cooperation among aviation stakeholders triggered the creation of non-profit members organisation ISAC, which exchanges threat information among its airline, airframer and supplier members.

“There is a shared risk here,” ISAC executive director Aviation Jeffrey Troy said. “The whole supply chain needs to talk to each other.” The top concern that ISAC members voice during their regular calls and four annual meetings is regulatory compliance. 

Osprey Flight Solutions CEO Andrew Nicholson agreed that there is a benefit to sharing information. “Without proper information, you can’t do proper risk management because you can’t understand the risks,” he said. “It’s down to us, as an industry, to improve ways of sharing information and helping each other – that comes down to trust.”

This is where big data can be turned into a benefit. Pooled risk data can give a clearer picture of the threat, improving the efficiency of the response. 

“If every operator shared a tiny bit of data, the overall improvement to risk management would be immense. It’s about crowdsourcing information to create a bigger picture of what is going on. Scaling information in that way can be hugely powerful,” Nicholson said

While people were a common cause for cyber-risk concern, Nicholson said they are also part of the solution. “Human analysts play an extremely important part, because they can make links that computers can’t. It is about integration of humans and computers.”

PGI managing director Brian Lord

 

* required field

Post a comment

Other Stories
Latest News

More than 41 million passengers pass through South Africa’s main airports

The Aviation Barometer has released passenger traffic through Airports Company South Africa’s network of nine airports.

Cooperation is the key to a safer future for everyone

Airspace, safety and security are key issues for the Middle East and North Africa. The United Nations body for civil aviation, ICAO, has its regional headquarters in Cairo, where Alan Peaford met regional vice president, Mohamed Rahma.

Ethiopian holds autism awareness panel discussion ‘Flying with Autism’

Ethiopian Aviation Academy (EAA) conducted a half-day Autism Awareness panel discussion on May 11, 2018 at EAA Auditorium under the theme “Flying with Autism”.

Madagascar airports turn ‘green’

Combining sustainable development and a fresh business approach, the Malagasy airports development project is well under way with the new terminal building at Antananarivo-Ivato International Airport due to open early in 2020.

Ethiopian to start direct flights to Jakarta

Ethiopian Airlines will launch thrice weekly flights to Jakarta, Indonesia as of July 17, 2018.

Why drone use is different in Africa

The African unmanned aerial vehicle (UAV) market is interesting in comparison to other regions of the world, with less dominance on the military use of such technologies and more emphasis on the humanitarian benefits. Beth Stevenson

TAA SK0902311218
See us at
AAD2018 BTAirCargoAFA_BT220318210219