Since the Wright brothers' first flight, the aviation industry has been advancing at an unprecedented rate. But it has always been a step behind other sectors in some areas, for safety and security reasons. Engineers are only allowed to apply well-matured technologies thoroughly trialed in different industries. Civil aviation, especially from the IT and IT security perspective, is a bit like Debian among the Linux operating systems. It does not always include all the latest inventions, but it aims to be safe and very stable in return. One can understand that, given the nature of what aircraft do. Flying poses enough thrill in itself!
This is precisely what the attitude of the aviation industry is towards the adoption of modern computers and especially computer networks. TCP/IP-based networks only began widespread adoption in the past decade or so. However, technology advances and matures much faster nowadays, so there’s a lot to keep up with if an airline wants to remain relevant and provide all the fancy e-services in the never-ending battle for customers.
As a side note, it reminds me of how Industrial Control Systems worked and, in many cases, still work. They used to run their networks in silos with their protocols and so on, yet they are slowly getting interconnected to the corporate network, posing unseen security risks.
Civil aviation - a new domain for cyber security threats
In the past, aircraft designers relied on bespoke aviation databases to interconnect and link flight-critical avionics systems. TCP/IP technology was primarily utilized to facilitate passenger information and entertainment systems, kept physically and logically separate from the flight-critical avionics systems. However, modern aircraft designs now incorporate an Ethernet network as the primary backbone for the aircraft, connecting flight-critical avionics, passenger information, and entertainment systems, making the present-day aircraft a standalone airborne computer domain. This interconnected network presents new security challenges for the plane, potentially leading to system failures and intentional malicious attacks.
The takeover of IP-based networks on aircraft does not only affect new planes; retrofitting of new equipment on older planes is also common.
With the new interconnected networks, the concept of the so-called e-Enabled aircraft was born.
Aircraft cybersecurity
Aircraft with interconnected systems are susceptible to vulnerabilities for various reasons. One concern is the potential security issues that may arise from tampering with critical flight data through wireless devices that are onboard. Unauthorized individuals with malicious intent and access to technology and malware could compromise aircraft networks, leading to system failures and posing significant safety risks.
Additionally, the extensive use of TCP by various popular applications on the internet, such as email, file transfer protocol, secure shell, peer-to-peer file sharing, and streaming media applications, increases the probability of security concerns. E-Enabled aircraft are particularly vulnerable to misuse and attacks, which may include the following:
-
Infection of aircraft systems through malicious software (malware).
-
Exploiting onboard wireless connectivity to gain unauthorized access to aircraft system interfaces.
-
Denial-of-service attacks targeting wireless interfaces and safety-critical systems.
-
Passive attacks such as eavesdropping and traffic analysis.
-
Active attacks like masquerading and replay attacks.
Even though these modern changes introduce new security risks, they will inevitably be implemented in the long run. The concern is valid. There is a potential to compromise aircraft networks. The consequences of that need no explanation.
Compliance mandates in the airline industry
New regulations, such as the FAA’s (Federal Aviation Administration) ANSP (Aircraft Network Security Program), were introduced to cover the adoption of new network technologies and the interconnection within previously separated networks. Unlike the previous ARINC regulation, the new ANSP includes mandates to follow on the aircraft’s IP-based networks. ANSP aims to mitigate security risks and aid the airworthiness of aircraft. Compliance with this ANSP is mandatory for all e-Enabled aircraft to ensure operational readiness and continuous airworthiness.
In addition to the compliance mandates that tackle the security aspects of the aircraft, other compliance mandates come into play when thinking about interconnected IT systems. One of these is PCI DSS (Payment Card Industry Data Security Standard) compliance, which is required to secure onboard card payments. Meeting these standards allows them to do business with credit and debit card companies and process these companies' transactions.
The importance of logs
The collection of logs, which document and preserve system activities, plays a vital role in adhering to security regulations and upholding the well-being of passengers, airline crew, and ground support personnel involved in the industry. By examining logs, airlines can effectively uncover and address potential security breaches, identify irregularities or unauthorized attempts at access, and acquire valuable knowledge about the airline’s infrastructure. Implementing appropriate measures for log collection, administration, and analysis bolsters the overall security stance and facilitates proactive steps to mitigate threats, safeguarding the robustness and reliability of aviation systems.
Critical aspects of log collection include:
-
Maintenance and Compliance: Logs document maintenance activities, ensuring compliance with regulations and facilitating routine maintenance scheduling.
-
Flight Operations: Logs record essential flight details, aiding in flight planning, performance analysis, and regulatory compliance.
-
Safety and Incident Analysis: Logs provide valuable data for analyzing incidents and accidents and improving safety protocols.
-
Regulatory Compliance: Log collection helps meet stringent regulatory requirements, such as maintaining specific logs for defined periods.
-
Performance Monitoring and Analysis: Logs enable assessing aircraft performance, optimizing operations and decision-making.
-
Audit and Documentation: Logs are critical documentation for audits, inspections, and regulatory reviews.
Log collection supports maintenance, compliance, flight operations, safety analysis, regulatory requirements, performance monitoring, and audit purposes in the aviation industry.
How to face the challenges
We can conclude that logs, log collection, and log analysis play a paramount role in aviation security, just like in any other industry. But to ensure you appropriately manage your log data, you need a log collection solution. Sure, but what solution? What does it need to do? What features will it need to have? To better answer these questions, let’s put some requirements together so we can have the overall picture:
-
It must be a well-established, trusted, mature software solution that has proven its versatility in other industries, preferably with a proven record in the aviation industry.
-
A single solution must work for all types of devices, sources, and log formats without compromise.
-
Compatibility with the newly used TCP/IP networks on e-Enabled aircraft.
-
Low resource usage, especially suited to low-power devices used on aircraft.
-
Native support for collecting AD and DNS logs, which are required by PCI compliance mandates for onboard payments.
-
Support for a wide range of operating systems, which is crucial for an aircraft’s heterogeneous environments.
-
Support for encrypted data transfer for enhanced security.
-
Can route log data to multiple destinations. For example, one for immediate analysis and another for long-term storage to have an unaltered history of the log data.
Well, a short but thorough list of characteristics.
Why NXLog, and why others have opted for NXLog?
With the never-ending advancement of technology and the never-ending race to remain competitive in a dynamic environment, airlines need a solution they can trust to do the job so they can focus on what they know best: civil aviation.
NXLog Enterprise Edition is a superior alternative to any other log collection solution. Its faster log processing, data enrichment, advanced filtering, and multicasting capabilities are only a few benefits you will get when you opt for our flagship log collection solution. What might initially appear to be an additional expense can be the start of a wise investment strategy for throttling the long-term operational costs of another "solution".
NXLog is a versatile and feature-rich solution that can tackle the most challenging log collection scenarios. It is an answer to all your log collection questions.
NXLog has proven itself not only in similar industries but also chosen by major airlines and aircraft manufacturers worldwide. Its flexibility and low resource consumption are unmatched in the industry.
Our documentation includes detailed, step-by-step deployment instructions for all platforms, an extensive configuration section, and over 100 integration guides with real-world configuration samples to get you started. In addition, find in-depth technical documentation in the NXLog EE Reference Manual.
If you haven’t already considered it, download a free NXLog Enterprise Edition trial and try it yourself. Once you’ve mastered the basics, creating complex configurations will become second nature.
Conclusion
Considering the criticality of securing aviation systems and the risks involved, taking measures to protect such environments is only logical. The aviation industry is yet to experience a significant, era-defining cybersecurity hack, but the risk is greater than ever. And, with the implementation of advanced computer networks, it will continuously grow.
This blog post highlighted the vulnerabilities that could expose the aviation industry and aircraft to an attack. These vulnerabilities prove that implementing a robust security policy that caters to all facets of civil aviation has become increasingly important.
We also elaborated on the importance of log collection and how a comprehensive solution can help ensure the safe operation of the involved parties and the airworthiness of aircraft.
Finally, we touched on how NXLog, as a proven solution, can help airlines cover the operational requirements of advanced networks.
