1
00:00:11,420 --> 00:00:18,460
Hello, and welcome to the Aerospace Village panel discussion on building communications across the aviation ecosystem.

2
00:00:18,460 --> 00:00:20,120
Hi, let me introduce myself.

3
00:00:20,120 --> 00:00:26,560
My name is Katie Trimble-Noble, and I'm the Director of Product Security Incident Response and Bug Bounty at Intel.

4
00:00:26,560 --> 00:00:36,820
So, I run the Bug Bounty program as well as researcher outreach and engagement, and I've been really in the ecosystem for many, many years.

5
00:00:36,820 --> 00:00:44,060
Prior to coming over to Intel, I worked for the Department of Homeland Security, where I was the Section Chief for Vulnerability Management and Coordination.

6
00:00:44,060 --> 00:00:47,280
So, I've been doing this for several years.

7
00:00:47,300 --> 00:00:51,760
Throughout my career, I've coordinated and disclosed over 20,000 cybersecurity vulnerabilities.

8
00:00:52,060 --> 00:00:54,560
So, I really want to jump in right now.

9
00:00:54,560 --> 00:00:59,020
We don't have a lot of time today, and I want to go ahead and introduce our panel.

10
00:00:59,020 --> 00:01:02,220
So, we're going to ask everybody to go through and introduce themselves.

11
00:01:05,010 --> 00:01:07,450
So, Randy, can we start with you?

12
00:01:08,370 --> 00:01:08,710
Yeah.

13
00:01:08,710 --> 00:01:10,890
Hi, I'm Randy Talley.

14
00:01:10,890 --> 00:01:16,830
I'm a Senior Advisor with DHS's Cybersecurity and Infrastructure Security Agency.

15
00:01:16,830 --> 00:01:37,490
I've been working in aviation for quite a while as a pilot doing aviation security for DHS and have been on the, excuse me, the Tri-Chair, the DHS Tri-Chair for the Aviation Cyber Initiative for the last two and a half years.

16
00:01:39,230 --> 00:01:40,350
Awesome.

17
00:01:40,350 --> 00:01:41,250
Sid?

18
00:01:42,770 --> 00:01:44,550
Hi, everyone.

19
00:01:44,550 --> 00:01:46,190
My name is Sid Geji.

20
00:01:47,030 --> 00:01:49,530
I work at FAA.

21
00:01:49,530 --> 00:01:54,450
I'm a manager within the Office of Information Security and Privacy.

22
00:01:54,930 --> 00:02:00,410
I've been with the agency about 14 years, and in a variety of different roles.

23
00:02:01,010 --> 00:02:08,630
And I serve as the Tri-Chair for the FAA on the Aviation Cyber Initiative for the past two and a half years as well.

24
00:02:08,930 --> 00:02:11,330
I am glad to be here.

25
00:02:11,330 --> 00:02:13,210
It's my first year at DEF CON.

26
00:02:13,630 --> 00:02:20,470
Lots of people in the room, you know, virtually, and I look forward to learning from you all.

27
00:02:20,830 --> 00:02:22,750
So, glad to be here.

28
00:02:23,570 --> 00:02:24,250
Yeah, thanks.

29
00:02:24,250 --> 00:02:24,910
Welcome, Sid.

30
00:02:24,910 --> 00:02:25,730
Welcome to DEF CON.

31
00:02:25,730 --> 00:02:27,550
I hope this experience is awesome for you.

32
00:02:27,550 --> 00:02:29,850
You get a little bit of a different flavor this year.

33
00:02:30,430 --> 00:02:31,550
So, John?

34
00:02:32,310 --> 00:02:33,830
Hi, my name is John Craig.

35
00:02:33,830 --> 00:02:38,630
I'm the Chief Engineer of Cabin Network and Security Systems at the Boeing Company.

36
00:02:38,630 --> 00:02:41,490
I've been there for around 34 years.

37
00:02:41,490 --> 00:02:50,850
I've worked in all sorts of systems groups on commercial airplanes, and my current role has me working all the cabin systems, the networks on the airplane.

38
00:02:50,910 --> 00:02:58,350
I work the development of the connectivity links, and I'm responsible for product security for commercial airplanes.

39
00:02:58,350 --> 00:03:07,630
I'm also the Chairman of the Aviation ISAC, and really like to encourage people to look up that organization.

40
00:03:07,630 --> 00:03:13,050
It provides a great sharing opportunity in aviation.

41
00:03:13,310 --> 00:03:14,250
Thanks.

42
00:03:14,810 --> 00:03:16,510
Yeah, welcome.

43
00:03:16,510 --> 00:03:17,410
Jen?

44
00:03:17,530 --> 00:03:18,650
Hi, I'm Jen Ellis.

45
00:03:18,650 --> 00:03:27,030
I'm the VP of Community and Public Affairs at Rapid7, and I am probably the least of the aviation experts on this panel.

46
00:03:27,030 --> 00:03:29,070
When I say probably, I mean definitely.

47
00:03:29,110 --> 00:03:45,670
But I represent the voice of, I think, the security research community, and my job is to think about how do you leverage security research and insight and expertise to create social change that makes a more secure, safer world.

48
00:03:46,750 --> 00:03:48,530
Awesome, awesome.

49
00:03:48,530 --> 00:03:49,570
Jeff?

50
00:03:51,670 --> 00:03:52,850
Hi, I'm Jeff Troy.

51
00:03:52,850 --> 00:03:54,710
I'm the President of the Aviation ISAC.

52
00:03:54,710 --> 00:03:57,130
I've been in that role for about three and a half years.

53
00:03:57,150 --> 00:03:59,210
I also work for General Electric.

54
00:03:59,210 --> 00:04:10,150
I'm on the staff of the CISO at General Electric Aviation, and I'm on the Board of Directors of the National Defense ISAC, so very engaged in the information sharing world.

55
00:04:10,510 --> 00:04:23,270
Prior to that, I was with the FBI for 25 years and left there in the cyber division, you know, working the cyber criminal and national security cases.

56
00:04:23,930 --> 00:04:25,750
Glad to be here, thanks.

57
00:04:25,810 --> 00:04:27,130
Yeah, happy to have you.

58
00:04:27,130 --> 00:04:27,930
Alan?

59
00:04:28,170 --> 00:04:39,370
Hi, I'm Al Burke, and I'm an Associate Deputy Director in the Air Force's Cyberspace Operations and Warfighter Communications, and I'm also the Department of Defense Chair for the Aviation Cyber Initiative.

60
00:04:39,370 --> 00:04:59,750
I come out of the airspace and missile defense operations community, and my primary focus in the ACI is on improving cybersecurity initiatives and resilience of derivative aviation capabilities where the DOD, interagency, and industry objectives intersect.

61
00:05:00,950 --> 00:05:02,330
Awesome, awesome.

62
00:05:02,330 --> 00:05:04,350
I'm excited to hear more about that later.

63
00:05:04,410 --> 00:05:16,890
So now that we've all kind of introduced ourselves and we have a good idea who we are and where we come from, you can see we have a just jam-packed panel full of awesome aviation cyber and researcher professionals here.

64
00:05:16,890 --> 00:05:18,030
So I'm really excited about it.

65
00:05:18,030 --> 00:05:19,790
Let's, let's really just jump right in here.

66
00:05:19,850 --> 00:05:34,830
So today, in this panel, we're going to talk a little bit about some current activities between government, industry, security, the security community, the responsible disclosure community, some information sharing, and some improved collaboration and coordination across the aviation sector.

67
00:05:34,830 --> 00:05:36,910
So really jam-packed.

68
00:05:36,910 --> 00:05:45,850
I want to step back just a little bit and explain and go through just a little bit of the groundwork on what the Aviation Cyber Initiative is.

69
00:05:45,850 --> 00:05:51,810
And so Randy, can you talk really briefly about what the Aviation Cyber Initiative is in the tri-chair?

70
00:05:52,650 --> 00:05:53,350
You're good.

71
00:05:53,350 --> 00:05:54,450
You'd love to.

72
00:05:54,450 --> 00:06:01,550
Aviation Cyber Initiative actually started probably around five years ago, the 2016 timeframe.

73
00:06:01,950 --> 00:06:06,050
It was, it was originally focused on, on aircraft only.

74
00:06:06,050 --> 00:06:13,710
There was some testing that our DHS S&T folks were doing and, and was, was of interest to everyone.

75
00:06:13,890 --> 00:06:22,430
And we've, we've taken that, and a lot of things has happened since that initial surge or testing, if you will.

76
00:06:22,430 --> 00:06:29,650
The National Strategy for Aviation Security was published by the White House about a year and a half ago.

77
00:06:29,650 --> 00:06:31,630
We're getting close to two years ago.

78
00:06:32,010 --> 00:06:35,950
And it specifically was a, was an update.

79
00:06:35,950 --> 00:06:37,370
The NSTAS needed to be updated.

80
00:06:37,370 --> 00:06:39,610
It was dated back to 2016.

81
00:06:39,610 --> 00:06:45,810
It was old and it didn't include anything about cybersecurity, nor did it include anything about UAS.

82
00:06:45,810 --> 00:06:50,090
So that was a big upgrade, if you will, for, for the NSTAS.

83
00:06:50,170 --> 00:07:02,870
It also defined the aviation ecosystem, which, which really helped us out and kind of defines the swim lanes, if you will, for, for aviation security.

84
00:07:03,030 --> 00:07:25,830
So, so those, those six swim lanes as defined include the aircraft, obviously, but also talks about airports, talks about airlines, airlift, airlift being the, the cargo derivative, derivative or equivalent of the airlines, talks about actors, which can mean anything from training to,

85
00:07:25,830 --> 00:07:28,270
to third-party vendors on an airport.

86
00:07:28,270 --> 00:07:30,310
It could, it could be anything has to do with people.

87
00:07:30,570 --> 00:07:36,990
And it goes into aviation management, which is all the infrastructure necessary to run the aviation environment.

88
00:07:37,030 --> 00:07:39,590
So, so all of those things are swim lanes.

89
00:07:39,590 --> 00:07:51,270
It's a little easier for us, the Aviation Cyber Initiative, to, to, to talk about this when you're talking about the various swim lanes as opposed to a big amorphous blob.

90
00:07:51,390 --> 00:07:54,370
So what is the ACI?

91
00:07:54,370 --> 00:07:57,170
Well, I've talked a little bit about it initially.

92
00:07:57,170 --> 00:08:07,690
A year ago, we were chartered by the Secretary of Homeland Security, the Secretary of Defense, and the Secretary of Transportation to, to be a tri-chaired organization.

93
00:08:07,810 --> 00:08:32,650
So I have my DOD colleague, Al, and Sid, my FAA colleague, and we lead this effort across the whole of government to include industry and to include anybody that's really looking at aviation cybersecurity, to pull them in and try to reduce our risks and increase our resiliency across,

94
00:08:32,650 --> 00:08:34,350
across aviation.

95
00:08:34,450 --> 00:08:37,230
So I'm, I'm very proud to participate in that.

96
00:08:37,230 --> 00:08:38,690
That gives you a little background.

97
00:08:38,690 --> 00:08:43,250
I don't want to get too much in, in depth in it, but I think that that should answer your question.

98
00:08:43,990 --> 00:08:45,030
Yeah, really good.

99
00:08:45,030 --> 00:08:45,890
Thank you.

100
00:08:46,030 --> 00:09:00,770
So I want to talk a little bit about some, a recent situation that I kind of really feel was a really good example of a watershed moment within the researcher aviation and public sector communities.

101
00:09:00,770 --> 00:09:02,930
So this happened about a year ago.

102
00:09:02,930 --> 00:09:09,370
And Jen, RapidSeven made a pretty, it's a pretty interesting disclosure on civil aviation last year.

103
00:09:09,370 --> 00:09:13,410
Can you walk us through that and kind of give us your perspective on the process?

104
00:09:13,410 --> 00:09:14,070
Yeah, sure.

105
00:09:14,070 --> 00:09:14,990
Absolutely.

106
00:09:15,130 --> 00:09:21,950
So we have a researcher, Patrick Kiley, who has done a lot around transportation in the past.

107
00:09:21,950 --> 00:09:25,310
He has done a lot specifically with automotive.

108
00:09:25,310 --> 00:09:31,330
He's also a pilot and he's building his plane as one does apparently.

109
00:09:32,010 --> 00:09:52,730
And so as part of his sort of, you know, passion and enthusiasm in this area, he was investigating various things and he heard about a technology used in small aircraft that is well known in the security community as being sort of quite trivial to exploit.

110
00:09:52,730 --> 00:09:55,090
So the technology is CAN bus.

111
00:09:55,150 --> 00:10:00,970
And he heard that it was being used as a way of sort of connecting avionics.

112
00:10:00,970 --> 00:10:05,670
And the avionics, you know, being the parts that control the plane, he was like, well, that sounds quite dangerous.

113
00:10:05,670 --> 00:10:11,410
And he was well aware that a few years back there had been a lot of noise made around about CAN bus in automotive.

114
00:10:11,730 --> 00:10:14,490
And there'd been very widespread discussion in the automotive industry.

115
00:10:14,490 --> 00:10:22,770
And as a result, many automotive organizations either moved away from using CAN bus or introduced additional mitigations and protections.

116
00:10:23,370 --> 00:10:27,810
He had not heard of such a discussion in the aviation space.

117
00:10:27,810 --> 00:10:41,090
And actually on talking to more people who work in aviation, he found that, you know, generally security people seem to believe it was an issue, but said that they were having trouble in having this be talked about at the right levels and get enough attention to really make a change.

118
00:10:41,370 --> 00:10:43,810
So he did some research on that.

119
00:10:43,810 --> 00:10:52,810
And our goal with the research from the beginning was never to sort of shame a particular vendor or embarrass a vendor.

120
00:10:52,810 --> 00:10:58,590
This wasn't a, we're going to take a specific vendor system and uncover new vulnerabilities.

121
00:10:58,590 --> 00:11:02,390
It's much more of an architectural issue and a known issue.

122
00:11:02,390 --> 00:11:16,210
So the goal was to look at a few different systems, verify that CAN bus was in fact being used, and then talk about why that's an issue on a sort of strategic level and try and stimulate some discussion in the aviation community around it.

123
00:11:16,810 --> 00:11:24,970
As a result, and also because we were dealing with aviation and, you know, we recognize that aviation is a different space.

124
00:11:24,970 --> 00:11:29,450
It, you know, there is a sort of life and death element when you're talking about things to do with aviation.

125
00:11:29,870 --> 00:11:32,810
We were very cautious with how we approached it.

126
00:11:33,090 --> 00:11:41,470
Our typical disclosure process, which is documented and on the internet, is normally a sort of 60-day process, sometimes a bit longer.

127
00:11:41,470 --> 00:11:43,290
This process took a year and a half.

128
00:11:43,290 --> 00:11:45,710
And the reason was two things.

129
00:11:45,710 --> 00:11:49,090
One, we very much did not want to cause hysteria.

130
00:11:49,090 --> 00:11:55,830
You know, as somebody who flies a lot, I know how easy it is to get spooked on this stuff.

131
00:11:55,830 --> 00:12:05,930
And I, so we wanted to be very thoughtful with the approach that we took and we wanted to be very balanced and as neutral as possible.

132
00:12:06,010 --> 00:12:09,010
And the second thing is that we really did want to try and stimulate this discussion.

133
00:12:09,010 --> 00:12:10,290
That was our goal.

134
00:12:10,290 --> 00:12:20,210
So we wanted to try and involve as many people to participate in that process as possible and really sort of like immerse the community as much as we could.

135
00:12:21,370 --> 00:12:24,210
It was a somewhat mixed process.

136
00:12:24,390 --> 00:12:37,950
You know, there's not a lot of tried and true ways of doing this in aviation, even for an organization like Rapid7, who have done a lot of vulnerability disclosure, a lot of vulnerability research over the years.

137
00:12:37,950 --> 00:12:44,070
Aviation, you know, every sector is a little different and aviation is certainly also a little different.

138
00:12:44,590 --> 00:12:57,710
And what we found was that generally , people, including many of the people on this call, were very, very generous with their time and their insight, their expertise.

139
00:12:57,710 --> 00:13:02,530
So we had a lot of people who were willing to talk to us, which was great, because we were worried at the beginning that that wouldn't be the case.

140
00:13:03,010 --> 00:13:21,830
But we also found that there was a bit of a flavor in the discussion that came across of, you know, people sort of pointing out that we weren't aviation experts and that physical security would take care of this and that, you know, we weren't understanding how pilots work.

141
00:13:21,830 --> 00:13:31,630
Now, here's the thing, is certainly I'm not an aviation expert and I was very glad to have input and have expertise from people who really are immersed in the space.

142
00:13:31,630 --> 00:13:33,550
It was a great learning for me.

143
00:13:33,850 --> 00:13:46,770
But in general, I think anybody who works in cybersecurity is always going to be a little leery of any sector that really leans hard on physical security as a response to cybersecurity challenges.

144
00:13:46,870 --> 00:14:03,790
And while we were very aware, always very aware and acknowledged in the report that physical access was required to exploit this system, we're also very aware that these systems stay in place for a very long time and that motivated attackers will find ways,

145
00:14:03,790 --> 00:14:13,110
particularly when you're talking about smaller aircraft, which might not have quite the same degree of physical protection that, you know, sort of larger commercial aircraft might.

146
00:14:13,110 --> 00:14:16,970
And so, there was a little bit of that.

147
00:14:16,970 --> 00:14:26,810
And I think Patrick probably felt a little bit affronted every time he got told that he didn't know how pilots worked, since he may not be a commercial pilot, but, you know, he has flown planes.

148
00:14:26,810 --> 00:14:30,090
So, it was good to get the feedback.

149
00:14:30,090 --> 00:14:35,510
We were super grateful to have the ears and to have the feedback.

150
00:14:35,510 --> 00:14:38,130
And we certainly wanted to challenge our own assumptions.

151
00:14:38,630 --> 00:14:55,710
But what we did learn through the way is that, yes, it's always, with any Coordinated Vulnerability Disclosure, and we are big advocates for Coordinated Vulnerability Disclosure, it is critical and key to build empathy, to listen actively, to take on board feedback and to challenge your own assumptions,

152
00:14:55,710 --> 00:14:57,210
and to try and build trust.

153
00:14:57,210 --> 00:14:59,850
Like, I think, above all, trust is where you want to get to.

154
00:15:00,270 --> 00:15:09,750
But you also have to know when to hold the line on your, like, yes, challenge your own assumptions, but hold your line once you've done that and you've verified that your findings are as you think they are.

155
00:15:09,750 --> 00:15:11,970
So, it was a good learning process for us.

156
00:15:11,970 --> 00:15:14,970
And I think, in the end, the disclosure went well.

157
00:15:14,970 --> 00:15:22,910
One thing, just before I wrap, that I'll say is I think part of the reason the disclosure went so well was because of the role that DHS CISA played.

158
00:15:23,010 --> 00:15:44,650
I think that having the Vulnerability Management Center part of CISA, which Katie was kind of running out of time, having you guys independently verify the research findings and then decide that it was a significant enough issue to put out your own alert to coincide with our report,

159
00:15:44,650 --> 00:15:47,410
that, to me, was a pretty big deal.

160
00:15:47,410 --> 00:15:49,550
It was actually kind of a game changer, I think.

161
00:15:50,910 --> 00:15:56,330
I can't say whether we would have bowed to pressure if that had not been the case, but I'm certainly very grateful that we didn't have to make that choice.

162
00:15:56,330 --> 00:15:57,210
So, thank you.

163
00:15:57,430 --> 00:16:02,750
And thank you to everyone else on the call who helped educate us along the way and gave us their time and their feedback.

164
00:16:03,810 --> 00:16:06,690
Yeah, it's definitely a complicated situation.

165
00:16:06,690 --> 00:16:15,870
I think a lot of times it's difficult when you think about every sector is different and, you know, your ICS systems, your embedded systems, your safety systems, they're very complex.

166
00:16:15,870 --> 00:16:26,550
And doing that coordination up and down the hardware stack is a little different than you would necessarily see in, say, a digital services sort of platform or in a general, typical, traditional software platform.

167
00:16:26,550 --> 00:16:29,430
So, it's definitely learning, I think, for everyone.

168
00:16:29,430 --> 00:16:31,810
And there are some ups and downs in that.

169
00:16:32,110 --> 00:16:38,330
And I think that when you look at it, you have to take it for... we're going to look at climate versus weather.

170
00:16:38,330 --> 00:16:41,390
You know, if we look at one each individual disclosure, it's pretty tough.

171
00:16:41,390 --> 00:16:43,410
But in the end, we learned a lot.

172
00:16:43,410 --> 00:16:47,490
So, Randy, can you talk a little bit about... DHS got involved in this disclosure.

173
00:16:47,490 --> 00:16:53,290
Can you talk a little bit about how DHS got involved in this disclosure and what role DHS took?

174
00:16:54,390 --> 00:16:54,950
Sure.

175
00:16:54,950 --> 00:16:59,310
Yeah, we have the Vulnerability Disclosure Program that DHS runs.

176
00:16:59,310 --> 00:17:00,350
Great group of folks.

177
00:17:00,350 --> 00:17:06,510
As a matter of fact, I think Jay Angus is going to have a panel at the Aerospace Village on Vulnerability Disclosure.

178
00:17:06,650 --> 00:17:09,370
So, I invite you to go and listen to that.

179
00:17:10,090 --> 00:17:11,310
Great, great folks.

180
00:17:11,310 --> 00:17:18,370
They approached me... great folks, including you, Katie... approached me and said, hey, I've got an aviation thing.

181
00:17:18,370 --> 00:17:20,710
I need to get it to you.

182
00:17:20,710 --> 00:17:25,170
I need you to understand we need to know kind of where we go from here.

183
00:17:26,090 --> 00:17:29,910
So, I was able to get the briefing from Rapid7.

184
00:17:30,250 --> 00:17:34,770
Actually got to read their final draft report, if you will.

185
00:17:35,570 --> 00:17:38,950
And you have to realize in aviation, aviation is a big thing.

186
00:17:38,950 --> 00:17:53,610
So, I've got a big background in aviation, but the CAN bus, where it's installed, you know, different aircraft vendors, it's a huge thing to try to go, yeah, I got this.

187
00:17:53,650 --> 00:17:55,790
So, how important is it?

188
00:17:55,790 --> 00:17:58,830
Well, it did require physical access.

189
00:17:58,830 --> 00:18:01,250
So, I can stand down a little bit from that.

190
00:18:01,250 --> 00:18:03,590
I think everybody understood that.

191
00:18:03,850 --> 00:18:08,730
But, you know, what... how does it affect commercial aviation?

192
00:18:08,730 --> 00:18:15,090
How does it affect small aircraft or the general aviation folks?

193
00:18:15,250 --> 00:18:18,790
So, I said, look, we need to get it to two places.

194
00:18:18,790 --> 00:18:20,270
We need to get to the FAA.

195
00:18:20,270 --> 00:18:21,210
They're the regulator.

196
00:18:21,210 --> 00:18:26,610
They should be aware of this because they need to make a risk assessment if it's a big thing.

197
00:18:26,750 --> 00:18:28,890
We also need to get it to the Aviation ISAC.

198
00:18:28,890 --> 00:18:32,350
Aviation ISAC has their members.

199
00:18:32,350 --> 00:18:43,390
They can quickly get it out to aircraft manufacturers and actually the folks who are building systems and determine, hey, what can I do with this?

200
00:18:43,390 --> 00:18:46,690
Or what should I be doing with this in the future?

201
00:18:47,130 --> 00:18:57,290
I think this was the first time since the ACI has been stood up that we've had a vulnerability disclosure come to me.

202
00:18:57,490 --> 00:19:00,450
It's not the last time, but it was the first time.

203
00:19:00,450 --> 00:19:03,050
It was handled very well, I think, by Rapid 7.

204
00:19:03,050 --> 00:19:13,730
I think they understood going in, you know, the physical access aspect was a big deal, the acknowledgement of that.

205
00:19:13,730 --> 00:19:15,530
It wasn't the skies falling.

206
00:19:15,530 --> 00:19:20,290
It was, hey, this is an issue and we need to address it.

207
00:19:20,290 --> 00:19:22,270
And I love that part of it.

208
00:19:23,190 --> 00:19:30,930
I know our VDP folks, the vulnerability disclosure folks, were very interested in, hey, look, we need to send out an advisory.

209
00:19:31,050 --> 00:19:34,310
It's going to mirror what we did on the cars years ago.

210
00:19:34,310 --> 00:19:38,350
And it's also going to say, hey, it does require physical access.

211
00:19:38,350 --> 00:19:50,230
So then once again, not the skies falling, we found a vulnerability, but this is something you should be aware of when you're architecting a system.

212
00:19:50,630 --> 00:19:54,530
So it was very good for me.

213
00:19:54,530 --> 00:19:58,790
I enjoyed getting involved in it to this level.

214
00:19:58,790 --> 00:20:07,090
And then, you know, the focus for that vulnerability disclosure is, can we get, you know, how do we approach a mitigation?

215
00:20:07,090 --> 00:20:10,250
If we found a vulnerability, how do we approach a mitigation?

216
00:20:10,470 --> 00:20:15,450
How do we close that down and make the system more safe and secure?

217
00:20:15,450 --> 00:20:18,070
And I think we achieved that in this particular case.

218
00:20:20,750 --> 00:20:21,510
Great.

219
00:20:21,630 --> 00:20:24,390
Yeah, we go back to that physical security.

220
00:20:24,390 --> 00:20:37,730
And I think overwhelmingly, one of the big things that was very different from, say, this disclosure to a disclosure that we might see somewhere else is that this is more of an architecture into a lot of different things versus, say, one particular product and one particular version.

221
00:20:37,730 --> 00:20:43,550
And so just the impact was very awe-inspiring.

222
00:20:43,550 --> 00:20:45,130
We didn't know where things were.

223
00:20:45,130 --> 00:20:47,330
So we really had to rely on the subject matter experts.

224
00:20:47,330 --> 00:20:50,910
And we really had to bring in a lot of different people to ask and find out.

225
00:20:50,910 --> 00:21:00,870
And so, Sid, can you really quickly tell us about your work and how you were brought in and talked to some of your colleagues at the FAA and the safety that was involved in that?

226
00:21:02,710 --> 00:21:03,750
Yeah, sure.

227
00:21:03,750 --> 00:21:08,910
So, Randy brought this up last year.

228
00:21:08,990 --> 00:21:11,750
And I think I agree with you, Katie.

229
00:21:11,750 --> 00:21:13,250
I think it was a watershed moment.

230
00:21:13,250 --> 00:21:15,010
That's a good way to describe it.

231
00:21:15,310 --> 00:21:18,610
We had a researcher that came forward with a vulnerability.

232
00:21:20,070 --> 00:21:25,310
Rapid7 came to us and they said, hey, look, this is important.

233
00:21:25,310 --> 00:21:26,750
You know, this is an issue.

234
00:21:27,170 --> 00:21:39,370
And so it really helped kind of spur a set of conversations within the FAA, both from our ABS, which is this aviation safety organization within the agency.

235
00:21:39,670 --> 00:21:41,530
The CISO was on the call.

236
00:21:41,630 --> 00:21:46,370
And it helped us, I think, you know, really connect different offices.

237
00:21:46,370 --> 00:21:50,330
And so, granted, it's a physical security issue.

238
00:21:50,330 --> 00:21:55,330
And I believe the other thing that happened also was TSA was notified.

239
00:21:56,030 --> 00:22:00,890
That's the agency that's responsible for all of aviation security in the U.S.

240
00:22:01,150 --> 00:22:08,330
So it really helped us connect with different stakeholders and really laid the groundwork for a process .

241
00:22:09,170 --> 00:22:18,190
There's going to be a lot of back and forth in such situations between the safety engineers, the regulators, the researchers.

242
00:22:18,350 --> 00:22:21,150
And that's really, in my mind, very good.

243
00:22:21,190 --> 00:22:22,530
And it's healthy.

244
00:22:22,530 --> 00:22:24,990
We want to spur those types of conversations.

245
00:22:25,430 --> 00:22:30,090
Everybody's not going to agree on what exactly how big the risk is.

246
00:22:30,810 --> 00:22:35,110
And so it can get a little difficult to come to get to the same page.

247
00:22:35,110 --> 00:22:38,510
But I think having those conversations is really important.

248
00:22:38,510 --> 00:22:41,370
And I think this event helped us do that.

249
00:22:41,610 --> 00:22:48,110
So thanks to Rapid7, thanks to DHS and the ISAC for taking the lead on this.

250
00:22:48,650 --> 00:22:49,710
Yeah, yeah.

251
00:22:49,710 --> 00:22:53,890
So that actually leads us right into, Jeff, can you talk about the ISAC?

252
00:22:53,890 --> 00:22:56,150
And the ISAC is information sharing.

253
00:22:56,150 --> 00:22:59,690
And so if you really want to affect change, you need to get the information out there.

254
00:22:59,690 --> 00:23:01,730
You need to make sure that people understand.

255
00:23:01,730 --> 00:23:05,010
So can you talk to us about your involvement in this?

256
00:23:05,890 --> 00:23:06,770
Thanks, Katie.

257
00:23:06,870 --> 00:23:14,970
So first off, we were just really highly appreciative of Rapid7's approach to this and allowing us to be invited in.

258
00:23:14,970 --> 00:23:27,550
Similarly to Randy and the rest of the folks at the Aviation Cyber Initiative for being so inclusive, letting us kind of get this information and be able to pass it out to the members.

259
00:23:27,550 --> 00:23:37,470
So like has been mentioned earlier, the Aviation ISAC's role in these security disclosures is really a connector.

260
00:23:37,970 --> 00:23:43,790
Jen highlighted how important it is for communication to be happening during these events.

261
00:23:43,850 --> 00:23:49,450
And typically when they start, it's really hard for a researcher to find the right person in the industry.

262
00:23:49,950 --> 00:23:53,030
We also mentioned here, though, that this was a little different.

263
00:23:53,030 --> 00:23:59,910
This is a technology that's broadly used across the industry, and it's actually something a lot of other folks plug into.

264
00:24:00,990 --> 00:24:08,270
Many times when a researcher has a particular disclosure they want to make, it's about one type of product.

265
00:24:08,270 --> 00:24:13,470
There's one vulnerability in some design of a specific component.

266
00:24:13,730 --> 00:24:23,950
When researchers want to get a hold of that company, frequently they're calling us because if you want to get a hold of somebody in the industry, it's a lot harder nowadays actually to find the right person.

267
00:24:23,950 --> 00:24:27,350
And we just happen to have them all connected in our community.

268
00:24:27,790 --> 00:24:37,410
But this one was different, and it was a great learning experience for us all because there was a little bit of a shorter window on the industrial side.

269
00:24:37,410 --> 00:24:46,070
But as we look back at the event, it really made a lot of sense because there wasn't somebody that was one particular company to take a look at this.

270
00:24:46,070 --> 00:24:49,330
This was more of everybody saying, hey, wait a minute, we're all plugging into this.

271
00:24:49,330 --> 00:24:54,890
We really need to take a look at this as a larger issue and as a systems issue.

272
00:24:55,570 --> 00:25:03,470
In the end, we did, and it's been mentioned as well, there was a physical security component, that is one component.

273
00:25:03,670 --> 00:25:09,250
But in the whole concept of layered security, physical security is just one layer.

274
00:25:09,250 --> 00:25:18,230
And when you find that there is an issue inside of any layer, the objective in a really good layered concept is to harden that layer.

275
00:25:18,250 --> 00:25:20,990
And this was a really good example of that.

276
00:25:20,990 --> 00:25:31,970
It's like, it doesn't matter if it's embedded in a lower layer, let's get every layer as hard as it can possibly be and make it difficult for anyone to make that complete penetration.

277
00:25:32,450 --> 00:25:34,570
So I would agree with everyone.

278
00:25:34,570 --> 00:25:38,950
I think this was a really good example of how to do it right.

279
00:25:39,130 --> 00:25:54,350
And I think what was really impressive for us, too, as the trust gets built across the engagement between the researchers and the industry, it was really good to see what Jen talked about was the perspective right from the start.

280
00:25:54,350 --> 00:25:59,630
Hey, we don't want to get people overly excited or hysterical about something.

281
00:25:59,630 --> 00:26:06,210
We really need to understand in the whole equation of risk, you know, how big of a risk is this?

282
00:26:06,210 --> 00:26:08,830
And, you know, how does that risk get managed?

283
00:26:08,830 --> 00:26:19,010
And their approach that they took, that cautious approach of really trying to get that understanding and validation was really critical to the successful outcome.

284
00:26:22,050 --> 00:26:23,050
Awesome.

285
00:26:23,050 --> 00:26:36,870
So I think this is a great opportunity and it was a great example of pieces that didn't ever, you know, typically work together and who were new to each other and maybe didn't even know that the other existed and were able to really pull together.

286
00:26:36,870 --> 00:26:38,230
And there were some ups and downs.

287
00:26:38,230 --> 00:26:48,050
And in the end, Rapid7 put out their vulnerability information, DHS put out a complementary security advisory, and I think it sort of laid the groundwork.

288
00:26:48,050 --> 00:26:51,690
So now that we kind of talked about that, I really want to pivot to the current.

289
00:26:51,990 --> 00:26:57,470
So there are some really awesome progress being made in the aviation and researcher communities.

290
00:26:57,470 --> 00:27:00,430
And it's hard to even pull a couple topics.

291
00:27:00,430 --> 00:27:04,090
When I sat down to kind of go through and say, what can we talk about here?

292
00:27:04,110 --> 00:27:06,830
There were just so many topics out there.

293
00:27:06,830 --> 00:27:09,810
The community is moving so rapidly.

294
00:27:09,810 --> 00:27:15,370
And I think even the aviation village itself is something that 10 years ago, we wouldn't have even thought of.

295
00:27:15,370 --> 00:27:16,970
We could pull together and do that.

296
00:27:16,970 --> 00:27:19,210
And so there's so many wonderful things.

297
00:27:19,490 --> 00:27:24,490
John, Boeing is getting involved in some really awesome community outreach and community engagement.

298
00:27:24,490 --> 00:27:26,690
Can you talk a little bit about the tech council?

299
00:27:27,530 --> 00:27:32,230
Yeah, I'll start off with, you know, aviation is a unique space.

300
00:27:32,230 --> 00:27:34,470
And we have a very strong safety culture.

301
00:27:34,470 --> 00:27:37,290
We have a unique development process.

302
00:27:37,290 --> 00:27:41,590
And, you know, to some extent, I think we view ourselves as being special.

303
00:27:42,050 --> 00:27:52,970
And, you know, Jen kind of mentioned earlier that when people come from outside that community, the natural antibodies kick in and we find reasons to kind of discount the feedback.

304
00:27:53,570 --> 00:27:56,710
I've been working in this space for 10 to 15 years.

305
00:27:56,710 --> 00:28:03,270
And, you know, reality kind of kicked in on me when the Stuxnet virus was disclosed.

306
00:28:03,270 --> 00:28:08,250
And it broke all my, you know, stereotypes of aviation and how we're unique.

307
00:28:08,690 --> 00:28:13,250
You know, and oftentimes I feel like an evangelist out trying to spread the good word.

308
00:28:13,650 --> 00:28:18,390
Well, last year was a significant milestone, and I'd say turning point for Boeing.

309
00:28:18,390 --> 00:28:27,750
A researcher got a hold of some of our executable code, reversed engineered it, and disclosed things that were actually quite surprising.

310
00:28:27,750 --> 00:28:41,090
I think we were surprised with the tools that allowed them to actually go in and, you know, kind of view the code in, you know, in a space where we didn't think was really possible.

311
00:28:41,270 --> 00:28:45,650
We actually spent a lot of time, several months, analyzing the code.

312
00:28:45,650 --> 00:28:46,350
We were in our lab.

313
00:28:46,350 --> 00:28:51,090
We have very extensive labs that replicate the airplane quite accurately.

314
00:28:51,230 --> 00:28:54,150
At the end of it, we actually went out onto an airplane .

315
00:28:54,290 --> 00:28:57,170
We brought all the systems engineers out to view it.

316
00:28:57,170 --> 00:28:59,530
We went through a bunch of scenarios.

317
00:28:59,530 --> 00:29:02,630
Some of the claims, we actually went well beyond the claims.

318
00:29:02,730 --> 00:29:06,190
We did a pretty thorough test on a 787.

319
00:29:07,670 --> 00:29:15,930
And at the end of that, our response, you know, not knowing, you know, it wasn't the real intent, but I think it was viewed as hostile.

320
00:29:15,930 --> 00:29:22,770
And I got that feedback from several folks, you know, in the aerospace village.

321
00:29:23,050 --> 00:29:27,750
And so after our analysis disclosure, we held a meeting with a lot of key stakeholders.

322
00:29:27,750 --> 00:29:29,950
A lot of the airlines had a lot of questions for us.

323
00:29:29,950 --> 00:29:30,970
You know, what do you think of this?

324
00:29:30,970 --> 00:29:32,050
Is it real?

325
00:29:32,290 --> 00:29:34,450
You know, we gave our synopsis.

326
00:29:34,510 --> 00:29:37,410
A lot of the government folks and Katie were in one of the meetings with us.

327
00:29:37,410 --> 00:29:42,170
We had a spirited discussion with lots of different government people, as you remember.

328
00:29:42,850 --> 00:29:50,410
And in that meeting, Katie kind of said, you know, John, you really need to reach out to these folks and I can help you if you'd like.

329
00:29:50,790 --> 00:29:57,250
So we took that, went internal to Boeing and we had some spirited discussions because this is really uncomfortable.

330
00:29:57,250 --> 00:30:02,490
You know, changing how we've operated for a long time is not the easiest thing.

331
00:30:02,490 --> 00:30:09,470
But at the end of the day, we said, you know what, we need to do this because these people are out looking at our designs.

332
00:30:09,470 --> 00:30:15,390
They're not, you know, I don't think there's any ill will, but we need to embrace them and we need to learn from them.

333
00:30:15,390 --> 00:30:21,890
And so we set up this tech council and we had several meetings trying to level set a little bit.

334
00:30:21,890 --> 00:30:23,770
It's a little hard via the phone.

335
00:30:24,290 --> 00:30:28,910
And so after the RSA conference in San Francisco in February, we invited them all back to Boeing.

336
00:30:28,990 --> 00:30:35,970
And at Boeing, we kind of went over some of our design methodologies and, you know, met face to face.

337
00:30:35,970 --> 00:30:41,410
And that's a real, it's real powerful to get to know people at a much more personal level.

338
00:30:41,670 --> 00:30:45,210
We took them into our labs, showed them what we're capable of.

339
00:30:45,210 --> 00:30:48,150
We even arranged time on a 787 simulator.

340
00:30:48,150 --> 00:30:53,470
In fact, one of the gentlemen was a military pilot and we set up kind of a difficult landing for him.

341
00:30:53,470 --> 00:30:57,050
High winds and, you know, low light conditions, et cetera.

342
00:30:57,050 --> 00:30:59,390
He made it down good, which was positive.

343
00:30:59,510 --> 00:31:03,490
But I think it went a long way to mending the adversary relationship.

344
00:31:04,070 --> 00:31:13,050
So as part of that, we have part of this team, they have a, some folks have a claim they'd like to investigate with us.

345
00:31:13,050 --> 00:31:21,830
And we're in the, we were in the process of bringing them into Boeing, into our lab to kind of evaluate that when, you know, the COVID hit and that kind of slowed us down a little bit.

346
00:31:21,830 --> 00:31:26,190
But, you know, I really want to embrace this and I want to expand it.

347
00:31:26,190 --> 00:31:36,990
And, you know, at DEF CON, we actually plan on bringing, you know, real hardware, setting up some kind of capture the flag event to kind of embrace this community much more.

348
00:31:37,270 --> 00:31:42,270
Another aspect of this, we actually matured our vulnerability disclosure process.

349
00:31:42,270 --> 00:31:45,950
It is now very easy to find on the Boeing website.

350
00:31:45,950 --> 00:31:47,250
At least I hope it is for folks.

351
00:31:47,250 --> 00:31:48,610
I was able to find it.

352
00:31:48,890 --> 00:31:51,530
And you can send your vulnerabilities encrypted.

353
00:31:51,530 --> 00:31:53,310
We provide that means.

354
00:31:54,230 --> 00:31:56,990
And we're starting to receive a lot of stuff in.

355
00:31:57,050 --> 00:32:01,810
And a lot of things that come in are shared between all the stakeholders.

356
00:32:01,810 --> 00:32:04,930
And as the product guy for the airplane, we see all of it.

357
00:32:04,930 --> 00:32:09,810
And we actually evaluated surprising vulnerabilities that are in the IT space.

358
00:32:09,810 --> 00:32:14,010
A lot of these systems are used in some form in aerospace.

359
00:32:14,010 --> 00:32:20,970
And so we have to evaluate all those and see if we have the same issue that maybe the original claim came in with.

360
00:32:21,270 --> 00:32:23,930
So I'll just close, you know, saying we're still crawling here.

361
00:32:23,930 --> 00:32:26,090
I'm really hoping to get more engaged.

362
00:32:26,850 --> 00:32:31,050
You know, I think it's critical that we interject this into our designs.

363
00:32:31,050 --> 00:32:32,070
It's a different view.

364
00:32:32,070 --> 00:32:36,970
And, you know, it's always powerful to get diverse opinions and diverse perspectives.

365
00:32:36,970 --> 00:32:43,370
And those outside of aviation probably are more powerful at looking at our designs than we may be.

366
00:32:43,370 --> 00:32:45,710
So thanks.

367
00:32:46,710 --> 00:32:48,050
Yeah, awesome.

368
00:32:48,150 --> 00:32:54,630
I know I remember sitting in some of those meetings and I remember thinking to myself, why don't we all just talk?

369
00:32:54,630 --> 00:32:56,610
You know, why can't we just, why don't we all just talk?

370
00:32:56,610 --> 00:33:07,050
And I can imagine that there were some people in that room who thought that I was just that crazy lady from Homeland Security with these wild dreams of working together.

371
00:33:07,050 --> 00:33:11,610
But I'm hopeful that we're going to see more of that and that that has actually worked out really well.

372
00:33:12,330 --> 00:33:17,790
So yeah, you know, we're still in steps here.

373
00:33:17,790 --> 00:33:21,550
And I would like to, you know, commend Boeing because Boeing did all the hard work on that.

374
00:33:21,550 --> 00:33:31,490
You know, the hardest part is getting going and taking all of the steps that needed to happen in order to bring people in and really get down into the labs and get into the weeds.

375
00:33:31,490 --> 00:33:34,130
And that takes a lot of effort.

376
00:33:34,130 --> 00:33:36,250
And so I commend Boeing for that.

377
00:33:39,070 --> 00:33:47,670
So Sid, can you talk a little bit about the FAA structure and the work with the tri-chair and some of the things that you've been working with?

378
00:33:51,470 --> 00:33:52,670
Yeah, sure.

379
00:33:53,030 --> 00:33:54,170
Thanks, Katie.

380
00:33:54,170 --> 00:33:58,670
I agree with everything that has been said on this great panel.

381
00:33:58,670 --> 00:34:01,570
I think, let me make a few points.

382
00:34:02,290 --> 00:34:05,930
You know, we kind of oversee and regulate civil aviation.

383
00:34:05,930 --> 00:34:08,050
So we have a unique role.

384
00:34:08,050 --> 00:34:11,250
We are the premier aviation agency in the US.

385
00:34:11,490 --> 00:34:22,270
We have authority over all the aircraft that fly in the US and all the airmen, all the pilots, we certify them, we certify all the aircraft .

386
00:34:23,010 --> 00:34:30,490
And we also conduct air traffic control, all the airplanes that take off and land are controlled by the FAA.

387
00:34:31,210 --> 00:34:33,490
So it's a pretty big role.

388
00:34:33,490 --> 00:34:34,910
It's a pretty big responsibility.

389
00:34:35,910 --> 00:34:40,670
I think safety is our focus and we are a safety agency.

390
00:34:41,350 --> 00:34:49,530
And so the way I see it is that cybersecurity is part of our safety responsibility.

391
00:34:50,370 --> 00:34:53,030
And I run into that all the time.

392
00:34:53,470 --> 00:34:59,370
As a tri-chair for the ACI, it's really a big task is culture change.

393
00:34:59,370 --> 00:35:12,210
We are trying to bring that culture of security and looking at how to improve the security of the whole ecosystem into an agency that's focused primarily on safety.

394
00:35:12,970 --> 00:35:17,390
So in terms of vulnerability disclosure, we don't have like a formal program.

395
00:35:17,510 --> 00:35:23,870
We don't have like a way that you all the researchers can come forward and directly to us.

396
00:35:24,710 --> 00:35:28,730
We rely on DHS, which is our partner through the ACI.

397
00:35:29,050 --> 00:35:33,830
But that does not mean that we are not open to all of your ideas.

398
00:35:34,010 --> 00:35:41,410
I think the fact that I'm here on a panel, you know, I'd love to hear from you all.

399
00:35:42,090 --> 00:35:50,010
And we'd love to have that dialogue about what the risk is and what some of the vulnerabilities are.

400
00:35:50,210 --> 00:35:52,670
So I want to echo what has been said earlier.

401
00:35:52,670 --> 00:35:55,190
I think trust building is incredibly important.

402
00:35:56,290 --> 00:35:58,010
We all should come together.

403
00:35:58,010 --> 00:36:05,790
And like Katie said, we need to be talking all the time and exchanging notes and exchanging ideas.

404
00:36:06,170 --> 00:36:07,790
Let me share a quick story.

405
00:36:07,790 --> 00:36:10,470
About two years ago, I was at the Pentagon.

406
00:36:11,550 --> 00:36:14,590
And DoD has this team called Gen5.

407
00:36:14,750 --> 00:36:28,210
That's basically a bunch of very smart people, just like you all, that were looking at some of the vulnerabilities within ADSP, which is our system for surveillance-based air traffic control.

408
00:36:28,210 --> 00:36:31,350
It's satellite-based, I'm sorry, air traffic control.

409
00:36:31,350 --> 00:36:36,670
We are moving away from radar into satellite-based GPS radar control.

410
00:36:37,370 --> 00:36:49,010
And so they had worked on this project for about a year to look at some of the vulnerabilities within ADSP, which is a huge investment for the FAA and for the American public.

411
00:36:49,450 --> 00:36:54,570
And I was with the CISO at the time and some other executives from FAA.

412
00:36:54,570 --> 00:36:57,450
And we just thought it was fantastic.

413
00:36:57,450 --> 00:37:08,510
I mean, to invite these researchers into the Pentagon and have them test an aviation system and hear some of their ideas.

414
00:37:08,510 --> 00:37:12,510
They actually came out with a report, which was super insightful.

415
00:37:13,150 --> 00:37:16,450
And we took it all the way to the National Security Council.

416
00:37:16,890 --> 00:37:24,130
And that has formed a basis for a lot of the follow-on work that's going on within ACI for ADSP.

417
00:37:24,130 --> 00:37:28,550
So, you know, I told my boss, this is something we need at FAA, too.

418
00:37:28,550 --> 00:37:37,590
We need a team like this to come in and test our systems and bring a completely different perspective than what the agency is used to.

419
00:37:38,830 --> 00:38:01,050
So that coming together of the researchers, of the research community, of the safety folks, you know, of the air traffic controllers and the IT people, all that has to happen because it's really about bringing all those disciplines together to tackle what is a very difficult sort of problem.

420
00:38:01,050 --> 00:38:04,150
I mean, we are looking at risks across the ecosystem.

421
00:38:04,490 --> 00:38:08,670
And so that conversation needs to happen between the different disciplines.

422
00:38:08,710 --> 00:38:14,250
I just did an online cyber course through Harvard a month or so ago.

423
00:38:14,250 --> 00:38:15,050
I finished it.

424
00:38:15,050 --> 00:38:16,950
It was like an eight-week class.

425
00:38:17,210 --> 00:38:18,670
Let me just share a couple of things.

426
00:38:18,670 --> 00:38:27,030
Every organization, including aviation, has operational risks, reputational risks, and legal risks when it comes to cybersecurity.

427
00:38:27,330 --> 00:38:36,130
So a cyber breach can cause huge damage, millions of dollars in terms of your operations, in terms of your reputation.

428
00:38:36,250 --> 00:38:37,690
Something to think about.

429
00:38:37,690 --> 00:38:45,150
Second is that we need a culture within cybersecurity where we reward people for being skeptical.

430
00:38:45,150 --> 00:38:52,050
You know, you don't want to just kind of reward people who are sort of agreeing with what's going on.

431
00:38:52,050 --> 00:38:57,070
You want people to look skeptically at what's going on and tell you a different way to do things.

432
00:38:57,070 --> 00:39:02,490
We want to reward people who want to break things because that can lead to a more cyber secure posture.

433
00:39:03,070 --> 00:39:14,230
And a lot of the challenge that we face today as organizations has to do with information sharing, has to do with culture change, and trust building.

434
00:39:14,230 --> 00:39:18,430
And so those are the tasks that we are all involved with.

435
00:39:19,870 --> 00:39:22,670
So information sharing should be happening all the time.

436
00:39:22,670 --> 00:39:29,570
And that's what the ACI is designed to do within the government, between our three big departments and with industry.

437
00:39:30,210 --> 00:39:40,570
I want to... the last thing I want to say is also the fact that the aviation ecosystem faces a lot of state and non-state cyber threats.

438
00:39:41,090 --> 00:39:42,950
The threats are very real.

439
00:39:43,530 --> 00:39:46,630
There are known vulnerabilities within this ecosystem.

440
00:39:46,630 --> 00:39:47,890
We all recognize that.

441
00:39:48,430 --> 00:39:55,330
So that can impact the operations within the national airspace and civil flights.

442
00:39:55,930 --> 00:40:01,290
And the fact is we got to tackle those threats and risks together.

443
00:40:01,670 --> 00:40:12,330
And so the FAA issues cyber situation reports today which address specific equities across this ecosystem.

444
00:40:12,330 --> 00:40:16,810
And some of those are externally tailored to partners outside of FAA.

445
00:40:16,810 --> 00:40:22,870
So those include other federal agencies and industry partners.

446
00:40:24,030 --> 00:40:27,070
And that's what I have.

447
00:40:27,070 --> 00:40:28,250
So thanks, Katie.

448
00:40:29,090 --> 00:40:30,090
Yeah, awesome.

449
00:40:30,090 --> 00:40:37,430
It's really exciting to kind of hear some of the things that get passed around and just really are exciting initiatives.

450
00:40:37,430 --> 00:40:44,210
The Pentagon has, I know, been deeply involved in aviation for, you know, I was in the Air Force, so, you know, since forever.

451
00:40:44,210 --> 00:40:54,530
And so it's really great to see these very, very established organizations get excited about working with research and breaking things.

452
00:40:54,530 --> 00:40:56,590
That just makes my day.

453
00:40:57,110 --> 00:41:00,690
So these are really awesome initiatives and I'm really excited about them.

454
00:41:00,730 --> 00:41:02,810
I want to move to the future for a little while.

455
00:41:02,810 --> 00:41:07,990
We kind of talked about the past and we talked about the current and then I want to kind of talk about the future really quick.

456
00:41:07,990 --> 00:41:14,090
And so I think the DOD's got kind of a really fun new initiative that I'd love to hear more about.

457
00:41:14,090 --> 00:41:15,950
I think it's called the INFACTOR.

458
00:41:15,950 --> 00:41:18,530
So Al, can you talk to us about the INFACTOR?

459
00:41:19,090 --> 00:41:20,270
Hey, sure, Katie.

460
00:41:20,610 --> 00:41:23,930
Hey, just as a little background before we dive right into the INFACTOR.

461
00:41:23,930 --> 00:41:29,410
So we talked a lot about identifying and sharing cyber vulnerabilities, sharing information.

462
00:41:29,410 --> 00:41:38,210
But going forward, the future is that we need to work together to close those vulnerabilities using a threat-informed, risk-based approach.

463
00:41:38,310 --> 00:41:42,870
And that points us to two trends the aviation ecosystem must address.

464
00:41:42,870 --> 00:41:49,130
You know, like Sid said, the first trend is the cyber threat to aviation is real and growing.

465
00:41:49,130 --> 00:42:03,510
So it's highly likely that advanced nefarious cyber actors, to include adversary nation states, will use cyberspace to steal our aviation intellectual property and to conduct cyber operations to damage the reputation of U.S.

466
00:42:03,510 --> 00:42:09,490
and allied aircraft and aviation industries, to gain a competitive advantage for their own industries.

467
00:42:09,510 --> 00:42:18,990
And so from a national security perspective, improving the cybersecurity and resilience of our own nation's aviation ecosystem to counter this threat is key.

468
00:42:18,990 --> 00:42:27,610
And for the Department of Defense, we have to be able to project power, defend the homeland, and protecting critical aviation infrastructure is part of that.

469
00:42:27,610 --> 00:42:29,490
But there's one thing we acknowledge.

470
00:42:29,490 --> 00:42:35,070
This challenge is not something the Department of Defense or the government can do on its own.

471
00:42:35,450 --> 00:42:45,450
So recognizing these two trends, recognizing that trend, you know, requires an increase in a public and private sector collaboration or whole-of-nation approach.

472
00:42:45,530 --> 00:42:51,930
I don't know if you're aware, but Congress recently chartered the Cyberspace Solarium Commission.

473
00:42:52,150 --> 00:42:59,150
And in this commission report, it identified the need to increase public and private sector collaboration.

474
00:42:59,390 --> 00:43:06,690
And the goal is to improve our speed and agility in addressing cybersecurity and resilience threats.

475
00:43:06,750 --> 00:43:21,970
And so the N-FACTOR that you referred to, which stands for the National Federation of Aviation Cyber Test Organizations and Researchers, the N-FACTOR, is a great example how the Aviation Cyber Initiative is pushing to work on this.

476
00:43:21,970 --> 00:43:39,210
And so the thing that the Aviation Cyber Initiative does is, you know, we bring together that whole-of-nation approach, bring together the cyber experts from federal agencies, state agencies, industry, our federally funded research and development centers,

477
00:43:39,210 --> 00:43:49,410
our university affiliated research centers, our national labs, all working together in the N-FACTOR to achieve three lines of effort.

478
00:43:49,410 --> 00:43:54,950
Those lines of effort are, one, is catalog, collaborate, and connect.

479
00:43:55,010 --> 00:44:04,910
And so, you know, just at a top level, we talk about catalog, our big push is to create a national -level aviation cyber resource guide.

480
00:44:04,990 --> 00:44:20,150
And the goal of this resource guide is to be an online, accessible, and searchable database of aviation cyber research, development, test, and evaluation resources, expertise, facilities, and capabilities.

481
00:44:20,150 --> 00:44:39,150
And so, if you're part of the N-FACTOR and you're working on initiative to counter, to look at cyber fuzzing or any of these other kind of cyber trends, you could go to the resource guide and it'll give you a list of who's working in that space, what kind of capabilities they have to test,

482
00:44:39,150 --> 00:44:45,210
and what, and more importantly, how you can get to hold, get a hold of them to further collaborate.

483
00:44:45,670 --> 00:44:48,430
And so, the collaboration is our second line of effort.

484
00:44:48,430 --> 00:45:07,670
You know, the goal of the collaboration is to create a persistent collaboration forum where these cyber experts, this whole nation approach, can get together and be able to spotlight or showcase capabilities, share information on projects, and more importantly,

485
00:45:07,670 --> 00:45:19,850
if a, like, let's say, for example, you're working a project on intrusion detection, cyber anomaly and intrusion detection, you can come to the N-FACTOR and present your project and give us asks.

486
00:45:19,850 --> 00:45:27,210
And in the ask, the goal for the ask is that the N-FACTOR try to close those gaps.

487
00:45:27,210 --> 00:45:31,030
And when we talk about closing those gaps, we call that a connect.

488
00:45:31,030 --> 00:45:43,590
And that's the third line of effort, to connect projects, efforts, research papers with resources to do things like test, validate, and move forward projects.

489
00:45:43,590 --> 00:45:45,330
And just a couple examples.

490
00:45:45,330 --> 00:45:53,110
You know, on the collaboration side, Johns Hopkins APL did a presentation on how they were doing cyber modeling on various aircraft.

491
00:45:53,390 --> 00:46:01,910
And the aircraft they were doing the modeling on, it so happened, since John Craig was on, they were Boeing aircraft.

492
00:46:01,910 --> 00:46:08,690
And so, you know, after the meeting, John and his team got together and said, hey, we probably need to know more about this modeling effort.

493
00:46:08,690 --> 00:46:12,590
And oh, by the way, maybe we can work with Johns Hopkins to make it better.

494
00:46:12,610 --> 00:46:15,250
And so right now, that's what we call a connect.

495
00:46:15,250 --> 00:46:22,070
We're working to bring those Johns Hopkins APL and Boeing together to talk about how they can enhance that cyber modeling.

496
00:46:22,070 --> 00:46:31,730
And then on the resource sharing side, we had a project come forward that was working on a cyber anomaly and intrusion detection capability with AI machine learning based.

497
00:46:31,730 --> 00:46:36,230
And they needed a data tap to pull data from 1553 bus.

498
00:46:36,230 --> 00:46:37,490
They didn't have it.

499
00:46:37,490 --> 00:46:44,390
And they also needed large quantities of data to support, you know, training a machine learning and AI capable tool.

500
00:46:44,390 --> 00:46:53,750
And so we connected them with the Air Force Research Lab and provided a tool called Vampire, which is a aviation bus tap, and shipped that to them.

501
00:46:53,750 --> 00:47:03,150
And then Johns Hopkins APL again came through, and they've been working on a data sharing effort that's been fantastic in terms of connecting.

502
00:47:03,150 --> 00:47:07,030
So those are the kind of things that the end factor is trying to do.

503
00:47:07,030 --> 00:47:09,430
And we're trying to do it at scale.

504
00:47:09,690 --> 00:47:15,570
And so that leads us to the, I'm sure people are saying, so how do you participate in the end factor?

505
00:47:15,570 --> 00:47:18,190
Well, we got a couple asks.

506
00:47:18,190 --> 00:47:21,450
You know, first off, we're focused right now on US organizations.

507
00:47:22,130 --> 00:47:26,690
So if you want to be a part of the end factor, what we ask you to do is three things.

508
00:47:26,690 --> 00:47:37,150
First, we want you to one, agree to populate our aviation cyber resource guide with your company's capabilities and resources.

509
00:47:37,410 --> 00:47:38,590
So that's one.

510
00:47:38,590 --> 00:47:46,270
The second one is, we want you to participate in our tight 90-minute monthly forum.

511
00:47:46,410 --> 00:47:48,830
It's the end factor collaboration forum.

512
00:47:49,090 --> 00:47:53,890
And our goal is to be able to showcase all our major participants as we go forward.

513
00:47:54,310 --> 00:47:59,090
And to participate in follow-on meetings, you know, should those connects happen.

514
00:47:59,090 --> 00:48:02,170
And the third one is, that is the connect part.

515
00:48:02,170 --> 00:48:15,790
That if you have capacity, and if you have resources, we would like for you to help connect others to serve as a mechanism to accelerate our cyber innovation in the aviation ecosystem.

516
00:48:15,790 --> 00:48:18,230
And so that's the kind of the three asks.

517
00:48:18,230 --> 00:48:28,030
I'll tell you, just yesterday, we had nearly 100 participants from across more than 60 organizations participate in the end factor forum.

518
00:48:28,030 --> 00:48:38,990
Our FAA tech center and DoD guides are working to deliver the aviation cyber resource guide by the end of August, at least the first instantiation of it.

519
00:48:38,990 --> 00:48:42,310
It's based on the FAA's technical capabilities library.

520
00:48:42,550 --> 00:48:46,070
And I would say, you know, in fact is growing.

521
00:48:46,150 --> 00:48:48,990
And I think it's exceeding many of our expectations.

522
00:48:49,350 --> 00:48:52,870
And what we want to do is get more people to work with us.

523
00:48:52,890 --> 00:48:56,570
So we can do what I like to say, collaborate with effect.

524
00:48:56,630 --> 00:49:08,310
And so that's, that's the end factor going forward, working to address the threat, and to increase our public and private sector cooperation across the aviation ecosystem.

525
00:49:08,910 --> 00:49:15,970
So Al, let me ask you really quickly, is that, is this initiative specific to military aviation, or is it open to civil aviation as well?

526
00:49:15,970 --> 00:49:20,090
No, it's, it's, it's not limited to military aviation.

527
00:49:20,090 --> 00:49:21,970
In fact, it's not a DoD initiative.

528
00:49:22,190 --> 00:49:25,550
It's an aviation cyber initiative, initiative.

529
00:49:25,610 --> 00:49:29,810
And so, you know, we have a charter to engage industry.

530
00:49:29,810 --> 00:49:32,310
And so we're, we're working to do that in spades.

531
00:49:32,310 --> 00:49:46,110
And, you know, at least a couple times a week, we're reaching out to bring our industry partners and really small businesses, you know, which we think the small business, businesses are real powerhouses in innovation.

532
00:49:46,150 --> 00:49:57,830
And, you know, when we can connect them with the larger big companies like the Raytheons and Boeings of the world, then we can, we believe that we'll be able to accelerate aviation cybersecurity capabilities.

533
00:50:00,240 --> 00:50:01,780
Awesome, awesome.

534
00:50:02,100 --> 00:50:07,020
So we have about eight minutes or so left.

535
00:50:07,020 --> 00:50:20,360
And so I really want to close up with some of our closing thoughts, and some just kind of words of wisdom and things that we've learned from each one of the participants.

536
00:50:20,560 --> 00:50:22,780
So Randy, can we start with you?

537
00:50:22,780 --> 00:50:27,240
What are your, what are your words of wisdom, things to take away, closing thoughts?

538
00:50:28,200 --> 00:50:29,580
Things to take away?

539
00:50:29,580 --> 00:50:35,400
Well, I'll tell you what, Katie, I'm super proud of what we're doing under ACI.

540
00:50:35,400 --> 00:50:47,360
I think it's, I think, I think it's time that we reach out across the entire ecosystem and try to pull people together and have those conversations, address those vulnerabilities.

541
00:50:47,360 --> 00:50:52,420
And, and I think, frankly, I think this is beginning to work.

542
00:50:52,520 --> 00:50:56,880
You know, working for DHS CISA, you know, I've got that, that outward look.

543
00:50:56,900 --> 00:50:58,660
I'm looking to industry.

544
00:50:58,660 --> 00:51:04,000
I can pick up the phone and call virtually anybody on this panel at any time.

545
00:51:04,000 --> 00:51:09,160
And if they're not in a meeting, which they always are, they'll answer the phone and we'll have a conversation.

546
00:51:09,300 --> 00:51:13,040
This is, this is collaboration at its finest.

547
00:51:13,500 --> 00:51:18,980
And, and I gotta say, you know, and I know we're limited on time, so I'll, I'll stop it here.

548
00:51:19,100 --> 00:51:20,780
I love my job.

549
00:51:20,780 --> 00:51:23,720
And that, and these are the reasons why I love my job.

550
00:51:23,720 --> 00:51:29,260
The people on the panel, the things that we're trying to accomplish and what we're trying to do through ACI.

551
00:51:29,260 --> 00:51:30,480
I'm very proud of that.

552
00:51:31,260 --> 00:51:32,680
Yeah, it's wonderful.

553
00:51:33,160 --> 00:51:37,000
It's something that I think is really going to make a difference.

554
00:51:37,000 --> 00:51:38,940
And that's, that's very exciting.

555
00:51:38,940 --> 00:51:41,140
I'm excited to be proud of it or to be part of it.

556
00:51:41,680 --> 00:51:44,060
Sid, what are your, what are your thoughts?

557
00:51:46,260 --> 00:51:53,880
Well, I, I want to say that COVID-19 obviously has affected the aviation industry.

558
00:51:53,880 --> 00:51:57,660
It's transforming, it's going to transform how we travel.

559
00:51:57,940 --> 00:52:00,060
It's going to change so many things.

560
00:52:00,060 --> 00:52:09,220
And we're, you know, we're going through a change right now as an aviation industry, but that does not mean we ignore the cyber threats.

561
00:52:09,400 --> 00:52:19,260
The work we are doing here on this panel and the work I do through the ACI is incredibly important.

562
00:52:20,220 --> 00:52:24,580
The cyber threats are real from both state and non-state actors.

563
00:52:25,340 --> 00:52:35,720
It's a combination of physical security and cybersecurity and the information technology and operational technology, safety, security, all of that.

564
00:52:35,880 --> 00:52:40,060
And the ecosystem is a vast complex network.

565
00:52:40,060 --> 00:52:44,500
So there's a lot of vulnerabilities to it.

566
00:52:44,500 --> 00:52:46,960
A cyber breach can happen anytime.

567
00:52:47,260 --> 00:52:54,840
There are threats out there and an attack can cause millions of dollars of damage and a loss of reputation.

568
00:52:54,900 --> 00:52:58,620
So it can shake public confidence.

569
00:52:58,620 --> 00:53:01,480
It can change again, the nature of flying.

570
00:53:01,480 --> 00:53:03,500
So we cannot ignore it.

571
00:53:03,720 --> 00:53:13,340
I think the work we're doing is super important and I'm privileged and I feel lucky to be part of this team of so many smart people who are doing such incredible work.

572
00:53:13,340 --> 00:53:15,500
So thank you for having me.

573
00:53:15,500 --> 00:53:19,640
You have my contact information, so I urge you all to reach out to me anytime.

574
00:53:22,960 --> 00:53:23,920
Awesome.

575
00:53:24,300 --> 00:53:25,240
John?

576
00:53:30,260 --> 00:53:39,140
So, you know, the last year has been interesting and we have got much more of a focus at Boeing on this.

577
00:53:39,440 --> 00:53:42,080
We do daily report outs to the board of directors.

578
00:53:42,080 --> 00:53:44,020
In fact, we have a champion on our board.

579
00:53:44,060 --> 00:53:54,660
We are leveraging our enterprise to not only help us with incident response, but helping to beef up our design guides.

580
00:53:54,660 --> 00:54:04,460
We have expanded our product cert team and we're being much more proactive at looking at things.

581
00:54:05,360 --> 00:54:07,340
And then we're looking at things across board.

582
00:54:07,340 --> 00:54:12,080
How do you create a process to evaluate threats and risks?

583
00:54:12,080 --> 00:54:13,300
And we're looking into that.

584
00:54:13,300 --> 00:54:20,160
We're actually working with industry and the government on, you know, how do we do that effectively?

585
00:54:20,420 --> 00:54:24,540
But key is we're really starting to engage outside of aerospace.

586
00:54:24,540 --> 00:54:28,820
And I think that's going to be the thing that really helps us the most.

587
00:54:28,820 --> 00:54:36,700
You know, the tech council is one, but participation at DEF CON so we can build those relationships, RSA conferences, et cetera.

588
00:54:36,700 --> 00:54:38,300
So it's pretty exciting.

589
00:54:38,300 --> 00:54:42,520
It's really exciting right now and a little uncomfortable, but it's good.

590
00:54:42,520 --> 00:54:43,820
So thanks.

591
00:54:44,560 --> 00:54:45,260
Yeah.

592
00:54:45,400 --> 00:54:46,920
Embrace the uncomfort.

593
00:54:48,100 --> 00:54:49,220
Jen?

594
00:54:50,220 --> 00:54:52,740
Katie, I'm honestly kind of blown away.

595
00:54:52,840 --> 00:55:11,240
You know, I think the whole purpose of the Aerospace Village is to increase understanding and appreciation of the importance of cyber security in aviation and to do so in a way that builds trust between the security community, the aviation industry and the government,

596
00:55:11,240 --> 00:55:16,020
which all play a very, very important role in advancing cyber security in aviation.

597
00:55:16,380 --> 00:55:30,280
And when I sit and I listen to my panel of panelists talking about some of the amazing initiatives they've got going on and hear their attitudes and their responses to the research and that kind of stuff, I just, I feel like we're in such a dramatically different position to where we were a couple of years ago.

598
00:55:30,620 --> 00:55:35,220
And I hear people saying that they want to hear from the research community.

599
00:55:35,220 --> 00:55:36,520
They want to hear from the security community.

600
00:55:36,520 --> 00:55:37,980
They want to partner and collaborate.

601
00:55:38,160 --> 00:55:40,500
And that is, that's an incredible opportunity.

602
00:55:40,540 --> 00:55:54,820
And I hope that anybody listening, particularly people who are participating in security research in some way, that they get a lot of hope and optimism from this and feel that they can engage and that they can build trust, they can build empathy and they can get involved.

603
00:55:58,980 --> 00:56:00,560
Yeah, it's very exciting.

604
00:56:00,980 --> 00:56:06,520
The trust and the relationships, I think, are some of the most important factors in all of this.

605
00:56:06,640 --> 00:56:08,500
It's getting involved.

606
00:56:09,300 --> 00:56:10,840
So yeah, getting involved.

607
00:56:10,840 --> 00:56:13,520
Jeff, information sharing, what have you got?

608
00:56:14,060 --> 00:56:15,460
Oh, thanks a lot.

609
00:56:15,460 --> 00:56:17,540
I think this has been a great discussion.

610
00:56:17,560 --> 00:56:19,980
And, you know, we only went through one example.

611
00:56:20,160 --> 00:56:26,700
But at the Aviation ISAC, we've had several of these events happen over the last couple of years.

612
00:56:26,700 --> 00:56:43,020
And each one of them pretty much follows this pattern of building a great relationship with a security researcher, finding out, you know, what a vulnerability is that they've discovered, and then going through that validation process of, you know, is it really an issue?

613
00:56:43,020 --> 00:56:44,560
Or isn't it an issue?

614
00:56:44,560 --> 00:56:50,200
And then, you know, working through the remediations and disclosures when those have to happen.

615
00:56:50,480 --> 00:56:55,780
And, you know, likewise, we have found this to be incredibly eye opening.

616
00:56:56,120 --> 00:57:05,560
And, I mean, so much so with the researchers, we've even hired one, which helps us tremendously, particularly in the work that we're doing now.

617
00:57:05,560 --> 00:57:17,760
So I am glad that there's been kind of this breakthrough and that we're seeing, you know, the bridge is being built, and I only think it's going to get better.

618
00:57:19,020 --> 00:57:19,980
Awesome.

619
00:57:20,720 --> 00:57:24,280
Al, what are your closing remarks, closing thoughts?

620
00:57:24,280 --> 00:57:25,500
Okay, hey, Katie.

621
00:57:25,640 --> 00:57:32,360
So kind of echoing across the board, I think the most important thing is one is we have to recognize that the threat is real.

622
00:57:32,660 --> 00:57:36,600
And we should learn from the maritime sector's NoPetya attack.

623
00:57:36,600 --> 00:57:42,420
We shouldn't have to wait until a serious cyber attack of our own on the aviation ecosystem occurs.

624
00:57:42,480 --> 00:57:48,660
And the key to preventing that is to embrace the idea that there's safety in the herd.

625
00:57:48,660 --> 00:58:01,620
You know, we need to strengthen the aviation herd, you know, by continuing to share information, vulnerabilities, and work together to address those vulnerabilities to improve our aviation cybersecurity and resilience.

626
00:58:01,620 --> 00:58:04,840
And so threats real, and there's safety in the herd.

627
00:58:06,300 --> 00:58:07,240
Terribly true.

628
00:58:07,240 --> 00:58:08,120
Very true.

629
00:58:08,120 --> 00:58:18,360
So I guess my closing remarks, then, I will say that the thing that I take away from all of these things is that I go back to coordinated vulnerability disclosure.

630
00:58:18,360 --> 00:58:22,860
And I say that coordinated vulnerability disclosure is an essential part of any security research.

631
00:58:22,860 --> 00:58:29,800
I think that everyone here and everyone that I've met, from varying backgrounds all over the world, everyone has the same goal.

632
00:58:29,800 --> 00:58:31,540
We may not all speak the same language.

633
00:58:31,540 --> 00:58:33,340
We may talk past each other.

634
00:58:33,340 --> 00:58:35,640
But I think ultimately, we have the same goal.

635
00:58:35,640 --> 00:58:37,460
And that goal is protecting the end user.

636
00:58:37,460 --> 00:58:39,660
It's reducing risk and making people safer.

637
00:58:39,820 --> 00:58:53,300
And so I think the last thing that anybody wants is to inadvertently put countless people's lives at risk, economic situation at risk, because we published a roadmap that if that fell into the wrong hands could just wreak havoc.

638
00:58:53,640 --> 00:58:57,920
So I go for coordinated vulnerability disclosure because it really is a balancing act.

639
00:58:57,920 --> 00:59:04,940
It's a process that allows us to mitigate or to balance while we're trying to mitigate.

640
00:59:04,940 --> 00:59:07,560
So that's my closing advice.

641
00:59:07,560 --> 00:59:13,900
I feel like all of the progress that we've made is so wonderful.

642
00:59:13,900 --> 00:59:15,760
We have a long way to go.

643
00:59:16,420 --> 00:59:20,700
I love the fact that we're all talking to each other and we're working together.

644
00:59:20,740 --> 00:59:25,140
But I want to make sure we know that there is a road ahead of us.

645
00:59:25,140 --> 00:59:31,220
That road to me, the future looks bright and I'm excited for it.

646
00:59:31,280 --> 00:59:35,340
So thank you guys for coming to the panel and listening to us.

647
00:59:35,340 --> 00:59:39,300
And if you have any questions, our contact information is up.

648
00:59:39,320 --> 00:59:42,920
I think there's going to be an opportunity for some live chat later at some point.

649
00:59:42,920 --> 00:59:45,700
So you'll be able to find out more information about that.

650
00:59:45,700 --> 00:59:49,220
If you have any questions or want to talk more to us, please feel free to reach out.

651
00:59:49,220 --> 00:59:52,480
I think everyone here would invite a conversation.

652
00:59:52,480 --> 00:59:55,080
It was great talking to everybody today.

653
01:00:00,460 --> 01:00:01,380
Thank you.