I have had the pleasure of working on cybersecurity projects spanning multiple industries, and every industry brings new and interesting challenges to resolve. In all cases, I have found one of the best ways to learn about these industries is through active participation in industry groups and standards bodies. It is a melting pot of ideas that allows us all an opportunity to collaborate in ways that create equitable solutions.
I am very new to aviation. Today marks just over 2 months since I started working in aviation security. I have to say it has been overall a positive experience. I have been working in cybersecurity for nearly 2 decades now and my colleagues and I were not always well received. Security was an annoyance that people did not want to have to deal with. Getting a budget was always tough. It’s not perfect today, but it is definitely much better. Cyber security is a good line of work to be in, for sure.
Right now it is all about consuming a flood of information interspersed with moments of clarity. Airlines in particular are very interesting. As with any major organization today there is a rather large and sophisticated network of interconnected systems. At the core you have an enterprise system consisting of networked computers and devices and these systems create system logs and security logs and they are fed into a Security Information Event Manager (SIEM), which looks for things that are indicators of compromised security. These systems work in real time. They have been around for a while and have become the standard for network security management worldwide.
That is all good and well and fairly well understood. However now we have modern aircraft which are moving away from legacy aircraft data buses and taking advantage of common network communication standards including wireless connectivity beyond commercial data links.
Essentially most modern aircraft are e-enabled, which means that they incorporate networking, telemetry, data collection and remote administration wherever practical,which essentially makes aircraft flying networks. These systems do what networks do on the ground, meaning everything from communications to making decisions that are critical to flight safety. They communicate with ground systems, which are indeed part of the network, as well as the enterprise. These systems also have logs just like any other networks, including security logs. This is where things get a bit more complicated.
The enterprise network world has specific well understood log formats that an enterprise SIEM can digest. This is not the case with e-enabled aircraft. They have a mashup of some expected log types as well as bespoke formats not seen in enterprise IT or even other industrial control systems(ICS) environments, and each aircraft manufacturer has specific formats that have no overlap whatsoever between them, and even within a specific manufacturer different aircraft models can have different formats. WaveDash currently supports 7 aircraft models, meaning we can consume, harmonize, prioritize, and aggregate information for airlines that use those models. We can also do the same with connected ground systems. As far as we are aware today we are the only application that can do this, and as our airline customers bring on new aircraft and associated systems we adapt the software to consume those associated logs. This is, however, a multi step process. The logs have to be collected from the aircraft and then fed into the WaveDash application (after some preparation) and then it can be analyzed. Beyond that the log information has to be further processed and aggregated in order to feed it into the enterprise SIEM. We refer to the application as an E-enabled Systems Log Intelligence Aggregator or ESLIA.
This is a great first step, however the main issue with ESLIA is that the log data currently cannot be fed into the enterprise SIEM in real time. In some sense WaveDash ESLIA acts as a sort of mini-SIEM and in some sense it is a sort of SIEM middleware. What needs to happen is that aircraft system manufacturers need to implement a way to feed the log data from the myriad aircraft and ground systems to WaveDash ESLIA in real time so it can be processed and fed into the enterprise SIEM in real time. This is especially important today because AI is now simplifying and accelerating the way cyberattacks can occur.
Now if we can get the manufacturers to get on board with this WaveDash is ready to make it happen.
Leave a Reply