Scribd
Upload
28 views14 pages

Cybersecurity in ATM: Challenges & Solutions

The document discusses cyber security risks for air navigation service (ANS) systems. It notes that traditional ANS network architectures are becoming more vulnerable as they increasingly connect to external networks using SWIM (System Wide Information Management) and cloud-based solutions. This exposes them to cyber attacks which could corrupt air traffic data and cause safety issues. It identifies legacy equipment, lack of training, and interconnected non-ANS systems as contributing to vulnerabilities. The document recommends implementing minimum security baselines, dedicated cyber security training, effective security implementation, and continuous monitoring to help mitigate these risks.

Uploaded by

Ser Ma
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
28 views14 pages

Cybersecurity in ATM: Challenges & Solutions

The document discusses cyber security risks for air navigation service (ANS) systems. It notes that traditional ANS network architectures are becoming more vulnerable as they increasingly connect to external networks using SWIM (System Wide Information Management) and cloud-based solutions. This exposes them to cyber attacks which could corrupt air traffic data and cause safety issues. It identifies legacy equipment, lack of training, and interconnected non-ANS systems as contributing to vulnerabilities. The document recommends implementing minimum security baselines, dedicated cyber security training, effective security implementation, and continuous monitoring to help mitigate these risks.

Uploaded by

Ser Ma
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Cyber security in ATM - Is it sink or SWIM

An ANSP’s perspective.

Greg Kurten
Director of CNS – UAE General Civil Aviation Authority
Cybersecurity and resilience Symposium - Amman- Jordan, 15-17 October 2019 2
Our traditional “trust” model…

VoIP/E1

OLDI
Local International
IPVPN IPVPN

OMAE ACC

Local IP-VPN also has OLDI


International also has VOIP

Cybersecurity and resilience Symposium - Amman- Jordan, 15-17 October 2019 3


SWIM = “Exposure to the elements”…

VoIP/E1

OLDI
Local OMAE ACC International
IPVPN IPVPN

Internet

Trusted Users

Cybersecurity and resilience Symposium - Amman- Jordan, 15-17 October 2019 4


ANS systems vulnerability…

Cybersecurity and resilience Symposium - Amman- Jordan, 15-17 October 2019 5


Why are ANS systems vulnerable?
• Legacy equipment
• Increased operational demands for SWIM connectivity
• Lack of Training
• Vulnerability of Critical inter-connected non-CNS systems
• Cloud based solutions
• Limited guidance on ANS related cyber regulations
• Staffing

Cybersecurity and resilience Symposium - Amman- Jordan, 15-17 October 2019 6


Or are we the biggest problem?

Cybersecurity and resilience Symposium - Amman- Jordan, 15-17 October 2019 7


Consequences of a successful cyber attack
• Credible data corruption:
ATFM slot allocation manipulation
ADS-B/ADS-C spoofed data
AMAN tactical manipulation
GNSS spoofing

• Loss of revenue

• Reputational damage

• Loss of life

Cybersecurity and resilience Symposium - Amman- Jordan, 15-17 October 2019 8


What can be done to mitigate these risks

Cybersecurity and resilience Symposium - Amman- Jordan, 15-17 October 2019 9


ANS Related Cyber Guidelines - Minimum Security Baselines (MSB’s)…

• Application security
• Firewall security
• Linux security
• Router security
• Switch security
• Third party data sharing and vendor access
• Web application firewall security
Cybersecurity and resilience Symposium - Amman- Jordan, 15-17 October 2019 10
Dedicated ANS cyber security training…

Cybersecurity and resilience Symposium - Amman- Jordan, 15-17 October 2019 11


Effective implementation…

Cybersecurity and resilience Symposium - Amman- Jordan, 15-17 October 2019 12


Continuous monitoring…

Cybersecurity and resilience Symposium - Amman- Jordan, 15-17 October 2019 13

You might also like