Cyber Security was on the agenda at something called the "
2015 Global Connected Aircraft Summit"
I - and many other avionics engineers practising in Continuing Airworthiness Management - are concerned by the rush to add Internet connectivity to commercial operations. In flight entertainment has until recently, never shared the aircraft data distribution networks. These systems operated in splendid isolation - sometimes not very well. Now we are beginning to see public internet data mingling with flight critical data in on-board distribution systems. Can no-one see the problem with that?
Especially since it isn't necessary for the safe operation of the aircraft. If an internet connection is to be added to an aircraft, a proper
physical firewall between that network and the operational communications network is essential - internet communication must be through a completely separate transceiver and on-board data distribution system.
Then there is Controller-Pilot Datalink or CPDLC, designed to reduce pilot-ATC work loads and improve separation. This is fine in theory and the way it is
intended to operate, but in practice it allows automatic ATC data transmission directly into the Flight Management Computers. Can the ground based ATC networks be kept secure ? Given that there are people out there with malicious intentions, who the hell thought linking insecure ground networks to automatic flight systems was a good idea?
The whole idea of placing airborne cyber security in the hands of IT security organizations is foolhardy. They can't keep our bank accounts or medical records secure so why we would expect them to keep our flight operations safe is a mystery. The integrity of avionics systems must be kept out of the hands of people who have little or no understanding of how avioncs systems work.