Archive For The “Cyber-Security” Category

Premium #330 – Connectivity keeps improving

By |

We have been tracking demand for aircraft connectivity for some time.  There are several news stories that further underscore the point that demand for connectivity seems to have no upper limit.

  • Icelandair will equip its 737 MAX fleet with ViaSat connectivity. The system will connect aircraft to the ViaSat-2 Ka-band satellite network over North America and the Atlantic, switching to ViaSat and Eutelsat’s Ka-band KA-SAT network over Europe.
  • Gogo business aviation unveiled a suite of smart cabin systems, SCS Elite and SCS Media, which are a highly integrated cabin, IFE and voice solutions that can be personalized to fit the specific needs of passengers on board a given flight.
  • Bombardier announced it is offering Ka-band technology on new Challenger 650 aircraft. The Ka-band high-speed internet system, the industry’s fastest in-flight Wi-Fi connectivity with worldwide coverage, is also being offered as a retrofit on in-service Challenger 604, Challenger 605 and Challenger 650 aircraft.

These data points must be seen in context.  It’s not just airlines.  Any operator is going to seek ways to add its aircraft to their existing IT infrastructure.  This concept may not have been pioneered by Embraer, but to our knowledge, they were the first to articulate it.

Icelandair already has a unique connectivity option on its 757s, it uses two systems.  Moving to the ViaSat solution the airline is following the choice at American.  ViaSat claims it does not have any bandwidth capacity constraints because of Ka.  Gogo has its 2Ku solution which it claims can match or beat the Ka.  The fact that operators have the choice of 2Ku or Ka is a tremendous improvement over what existed even just two years ago.

The Gogo solution being offered to business jets demonstrates that operators of even small aircraft desire the “always on” connectivity.  Bombardier’s selection of Ka underscores Gogo’s announcement.  Once again, we have operators being able to choose from the two approaches.

On a visit to Embraer, we were shown their approach to aircraft health management.  The system is impressive to an outsider.  But it must be truly special if a customer has added its non-Embraer aircraft to this system!

We have mentioned before the growing importance of connectivity at another airline deep into this solution, Norwegian.  Passengers receive this connectivity for free.  Norwegian utilizes the GEE solution which also uses the Ku system.  GEE’s solution uses Ku because it is said to be lower cost than Ka.  We reported on the Ka vs Ku battle in 2016.  Although dated 2013, here is another useful guide to this issue.  The chart below summarizes the tradeoff between these two.

Regardless of where one ends up in the debate about connectivity, we can be reasonably certain of a few things: satellite is the way forward, e-Enabled aircraft will demand connectivity to upload and download data in-flight and passengers are going to expect “always on” connectivity.  Even Southwest Airlines boasts about its “gate to gate” connectivity, even though while your bags fly free, your data connectivity is not.

Another source of connectivity is Honeywell, which offered this amusing video.

Connectivity is now a “nose to tail” issue.  Everything about an aircraft benefits from connectivity.  MRO and Flight Ops are able to monitor an aircraft and undertake proactive measures to keep it in service.  Flight Ops can communicate with the flight crew at much lower cost than using ACARS.  This decision support is not seen as important until it becomes critical.  Flights can be disrupted by many issues, and low-cost communications enables improved content and context.  Airlines, for example, can dispose of satellite phones.   There are even issues of tracking aircraft, which post-MH270, are obvious.  Then there are the more obvious cabin impacts with e-commerce in real-time and passenger entertainment.  While we do not spend much time on passenger experience, it is clear that given the increasingly uncomfortable airline cabins in economy and no frills classes, anything that transports the mind elsewhere is a benefit.

SITA offers a useful guide to how their solutions impact airlines and connectivity.  As we move towards modern ATC and see e-Enablement given full expression, the connectivity issue will come into full bloom.

Read more »

Premium #226 – Farnborough 2016 Was Far from Boring – If you Knew Where to Look

By |

Welcome to AirInsight Premium content. This page is only available to active members.

Already a member?

Interested in becoming a member?

Read more »

Preliminary Agreement on Airliner Cyber Security Standards

By |

Please start here.  This is huge news.  Readers know that we have a significant interest in this subject.  We have been concerned with the issue of cyber security as it potentially can impact the air travel process.  Air travel is increasingly IT driven.  We have seen what IT disruptions at American Airlines and United Airlines brought about last year.  Whether these events were cyber related or not.

Any step by the industry to move on securing their systems is to be cheered.  The threat no longer has to actually enter the aircraft physically if it can enter digitally.

Clearly even as the industry develops standards, it is important to understand what happens next. First once these standards are published, they become vulnerable.  Second, cyber security requires ongoing, continuous improvements.  Given the dependence on IT (and this will never decline), CFOs have to simply get used to CIOs always needing more resources.  It’s just going to be like that. Big Data is a reality and is one of the juiciest targets.

Protecting the GPS signals as the WSJ story describes is obviously a great and good thing.

But there is another possibly even juicer target.  Before we explain this, remember how hackers were able to break into the US Federal Reserve?  There have been continuous attempts to hack banks.  Last February hackers stole $81m from Bangladesh’s account with the Federal Reserve Bank of New York.

The world’s airlines have a club called The International Airline Transport Association (IATA).  This organization performs all sorts of industry tasks.  One of the most fundamental is that of clearing house.  If you were impressed by the Bangladesh hack at $81m (and nobody has been caught), try this for size: IATA’s clearing house handled $54.3billion in billing transactions in 2015. Hacking IATA’s clearing house would be on any hacker’s Top Ten list. 

Coming back to the industry’s heightened cyber security profile.  Protecting GPS signals are an excellent start.  But there are  many other items the industry needs to protect.  We hope the committee established becomes a permanent fixture because it has a lot of work to accomplish.  Most importantly, we hope the industry can stay ahead of the threats.

Read more »

2015 EFB Survey Report

By |

Our fourth annual EFB survey report will be available from Monday January 18.  The 34 page report (PDF) includes six sections (Airline Operations, Connectivity, Business Case Drivers, Future Planning, Cyber Security, Tablet EFBs) with 46 charts and a foreword by IATA. The survey has input from 80 airlines, making it one of the broadest sources on this subject.

If you are interested in getting your electronic copy on Monday please email us.

We are also offering clients access to the survey data (without airline identifications). The data set is from surveys undertaken in 2012, 2013, 2014 and 2015.   The data is in Excel format and enables unlimited analyses.  If you are interested in this option, please use the email link above to contact us.  Delivery is available now.

Read more »

Yes, YOU will be Hacked

By |

If your firm is somewhere in the aerospace supply chain, a computer hack is coming.  It looks like there a pattern is forming.  First, a group of Chinese hackers stole a huge trove of US data from the US Office of Personnel Management.  That was followed by  United Airlines and health insurer Anthem being hacked.  The United hack has a special value.  Not enough?  How about this – Chinese hackers just hacked Sabre, the largest GDS system and a key supplier to American Airlines.

As pointed out in the link to The Washington Post article, this massive trove of data can be (is being) aggregated.   The new owners of the data can pinpoint specific people of interest and then, using insight from the assembled data, develop a highly targeted campaign to exert influence on these people.  We are, understandably, being deliberately vague here.  China, of course, denies anything to do with these hacks.  So who these China-based hackers are is unclear.  We cannot be sure why this data is being stolen.  Are the hackers state actors?  It’s not easy to tell, it seems.  Both the Americans and Chinese are officially being opaque.

If indeed the pattern is acquiring data to develop a reasonably accurate digital picture of people – what kind of usefulness would such a profile have?  Since the data has not, as yet, been made available for sale on the deep web, apparently, the value of the extensive data mining remains unclear.  However, being one of the people whose data was stolen has to be singularly unpleasant, especially when considering what might be aggregated and utilized to potentially create an alternate identity or be set up as a target to compromise.

Concern within the US is now starting to match concern outside the US by foreign states about US-sourced data breaches.  The US Government, as revealed by Edward Snowden, is not innocent in this regard, and retaliation is to be expected.  But private parties may not be as “hardened” against cyber-threats as government agencies.  Regardless of who is doing the breaching, it is crucial for firms (especially in the aerospace related supply chain; link 1, link 2) to immediately increase IT budgets and deploy state of the art cyber-security.

Stealing data is only a first step.  Once computer systems are compromised, hackers can do a lot more harm than merely copy files.  Commercial aviation rests on one bedrock belief – safety is priority #1.  Given how dependent every organization has become on IT, a compromised IT system is going to negatively impact that priority.  What could a Stuxnet-like virus do inside the aerospace supply chain?

Your company is going to face a hack attack if it touches the aerospace supply chain.  It may have already been attacked, with “sleeping bots” (watch this zero days video) waiting to awaken, that you might not know about it.  Cold wars are about disruption, whether economically or politically, and to create havoc whenever possible.  Our increasing dependency on computers has created a new class of economic warfare based on disruption, and causing additional problems wherever possible.  In a capitalist society, the largest targets, apart from government, are the corporations we depend on, and particularly the transportation infrastructure.

From airlines and ATC to e-Enabled aircraft, electronic flight bags, MRO facilities and even the industry supply chain, enemies will probe until they find the weakest link, which they will then exploit.  You cannot afford to be the weakest link.

Read more »

Premium #182 – An Update on Cyber-Security

By |

Cyber-security is a very hot topic. A week does not go by without some large and important entity being hacked. This impressive array of entities included the NYSE, United Airlines and the US Government, all within in the same week. This does not give anyone a sense of comfort and safety. And the news is getting worse.

The United hack we now learn has been traced.   That traced leads back to China – of course. Please follow the link to see just how significant the Chinese hack was.

For our readers, the most relevant story will be the United Airlines hack. Bloomberg states “Among the cache of data stolen from United are manifests.” While the airline has believes there is no connection between the hack and a July 8 systems failure that halted flights for two hours. United also did not rule out a possible, tangential connection to a systems outage on June 2.

Bringing down a global airline has massive disruptive impacts. The trickle down impact reaches far and wide – as cancelled flights cause passengers to not be where they need to be and difficulty re-booking those displaced. The loss of productivity is substantial. Operationally, flight crews also may run afoul of time limits and often can’t be replaced easily because they are located are in places they were not expected to be.

What this case illustrates is what can happen in a post 9/11 world – where you don’t have to destroy people and equipment – to make a point. Business today depends on computerization and, truthfully, without computers we can’t accomplish key tasks.

Cyber-security threats are one thing. But negative impacts from IT do not have to be malicious. In April of this year, American Airlines saw 70 flights delayed because of an EFB software update issue, in which the system didn’t know how to handle two charts, one effective through the next day and the other effective the day after. Even inadvertent system errors cause difficulties.

In discussing the cyber-security problem faced by commercial aviation with industry participants it quickly becomes clear how significant this issue is. Take, for example, an aircraft manufacturer. We live in a world where parts and pieces come from across the globe. Some vendors are small firms with 50 or fewer employees making a specific part. If an attack is planned and a perpetrator wants to take as long as possible to go unnoticed, such a small firm is the place to begin. Infect their network and, sooner or later, a virus or some other Trojan can work its way upstream. Almost certainly the IT infection will be able to travel far and wide before it hits a cyber-screening. There is also the possibility of viral transfers using USB drives, which probably the easiest way to infect a network.   Most cyber infections we understand come from within a network – and a USB drive is perfect for that. The key is keeping threats out of aircraft, flight control computers, air traffic control, and other systems so that things continue to function normally.

We’ve heard much about the benefits, but little about the risks of the “Internet of Things”. Commercial aviation is rapidly moving towards e-Enabled aircraft, essentially IT devices that communicate. The result is an enormous amount of data flowing to and from aircraft. Since hackers love to foul-up data, this is a manifest area of concern. What is the industry going to do to ensure this data flow has a prophylactic? In addition – whose data is it? Does the airline own the data? Or perhaps an OEM? How about the lessor? Industry needs to know where the responsibility lies.  Insurance companies want to know this because they are also at risk.

We foresee new capabilities emerging within the next two years devoted to protecting commercial aviation and its growing data flows. These capabilities will be both strategic and tactical.

On a tactical level every firm in the supply chain will have to deploy cyber-security to protect its network. This protection will have to meet a certain standard likely to be set by the OEM at the top of the supply chain. In fact it is likely that to stay in the supply chain the OEM will dictate the solution to be deployed to ensure consist standards all the way through the supply chain.   How this cost will be recovered is unclear. Smaller suppliers may find this way more expensive than they can afford or recover in a satisfactory time frame. It is likely to get messy. But one infected sensor or computer could put an aircraft at risk.

On a strategic level the supply chains are going to have to regularly deploy simulated cyber-security “war games” to test their networks. United Airlines recently did something like this and rewarded hackers with miles for travel when they found holes in its network. But that hasn’t stopped problems.

Because threats to large IT systems (whether at an airline with global site network nodes, or an OEM with global suppliers acting as network nodes) will continuously evolve, the cyber solution will also have to continuously refine and evolve. Given the vulnerability of IT systems and the dependence on them, every firm in the commercial aviation business may soon need substantially larger IT budgets. There really is nothing that can be done about this threat that will avoid having to pay for better security software, tools, processes and procedures. The alternative is too disruptive to risk.

Major players in the industry have begun to address many of these issues, quietly and behind the scenes. There have been attacks that have been thwarted, and a couple of near misses as well. While the industry has begun to pay attention to the issue, the response is fragmented, uncoordinated, and hasn’t yet closed all of the potential holes in e-enabled aircraft systems.

Fortunately, the need for more attention is coming at a time when fuel costs have dropped, allowing airlines to afford the initial upgrades they need to put in place. But the firms in the OEM supply chains have massive backlogs to work through and may not have the funding to handle this because their cash flow depends on deliveries. Improving cyber-security while satisfying OEM requirements for lower costs could place an additional strain on the supply chain that produces e-Enabled components.

New tools are being developed to address these issues, including software that can detect potentially malicious code and prevent its installation on computers. But between the aircraft and the ground, there are a lot of computers and a lot of access points to protect.

Of course, the airplane isn’t the only potential source for an attack. Infrastructure, like air traffic control systems, real-time weather feeds and any element that impacts airline operations can also be at risk. Today, we don’t have a comprehensive framework to fully address these issues.

The solution, of course, is for the industry to develop a comprehensive framework before an unfortunate event occurs. In October we are co-hosting a cyber-security conference over one and ½ days in Washington DC. Additional details may be found here. This event will bring together experts from industry and government in a closed-door session to determine how we can better address the emerging threats on air transportation and the economy.

Solving cyber-security issues won’t be easy. But it begins with awareness – of the threat, of the potential impact, and of the risk mitigation and countermeasures that are available, both technologically and managerially, to combat them.

Read more »