Hello, and welcome to the Aerospace Village panel discussion on building communications
across the aviation ecosystem. Hi, let me introduce myself. My name is Katie Trimble-Noble,
and I'm the Director of Product Security Incident Response and Bug Bounty at Intel.
So, I run the Bug Bounty program as well as researcher outreach and engagement,
and I've been really in the ecosystem for many, many years. Prior to coming over to Intel,
I worked for the Department of Homeland Security, where I was the Section Chief for
Vulnerability Management and Coordination. So, I've been doing this for several years.
Throughout my career, I've coordinated and disclosed over 20,000 cybersecurity vulnerabilities.
So, I really want to jump in right now. We don't have a lot of time today, and I want to
go ahead and introduce our panel. So, we're going to ask everybody to go through and introduce
themselves. So, Randy, can we start with you? Yeah. Hi, I'm Randy Talley. I'm a Senior Advisor
with DHS's Cybersecurity and Infrastructure Security Agency. I've been working in aviation
for quite a while as a pilot doing aviation security for DHS and have been on the, excuse me,
the Tri-Chair, the DHS Tri-Chair for the Aviation Cyber Initiative for the last two and a half years.
Awesome. Sid?
Hi, everyone. My name is Sid Geji. I work at FAA. I'm a manager within the
Office of Information Security and Privacy. I've been with the agency about 14 years,
and in a variety of different roles. And I serve as the Tri-Chair for the FAA on the Aviation
Cyber Initiative for the past two and a half years as well. I am glad to be here. It's my first year
at DEF CON. Lots of people in the room, you know, virtually, and I look forward to learning from you
all. So, glad to be here. Yeah, thanks. Welcome, Sid. Welcome to DEF CON. I hope this experience
is awesome for you. You get a little bit of a different flavor this year. So, John?
Hi, my name is John Craig. I'm the Chief Engineer of Cabin Network and Security Systems at the
Boeing Company. I've been there for around 34 years. I've worked in all sorts of systems groups
on commercial airplanes, and my current role has me working all the cabin systems, the networks on
the airplane. I work the development of the connectivity links, and I'm responsible for
product security for commercial airplanes. I'm also the Chairman of the Aviation ISAC,
and really like to encourage people to look up that organization. It provides a great sharing
opportunity in aviation. Thanks. Yeah, welcome. Jen? Hi, I'm Jen Ellis. I'm the VP of Community
and Public Affairs at Rapid7, and I am probably the least of the aviation experts on this panel.
When I say probably, I mean definitely. But I represent the voice of, I think, the security
research community, and my job is to think about how do you leverage security research and insight
and expertise to create social change that makes a more secure, safer world. Awesome, awesome.
Jeff? Hi, I'm Jeff Troy. I'm the President of the Aviation ISAC. I've been in that role for about
three and a half years. I also work for General Electric. I'm on the staff of the CISO at General
Electric Aviation, and I'm on the Board of Directors of the National Defense ISAC, so
very engaged in the information sharing world. Prior to that, I was with the FBI for 25 years and
left there in the cyber division, you know, working the cyber criminal and national security cases.
Glad to be here, thanks. Yeah, happy to have you. Alan? Hi, I'm Al Burke, and I'm an Associate
Deputy Director in the Air Force's Cyberspace Operations and Warfighter Communications,
and I'm also the Department of Defense Chair for the Aviation Cyber Initiative.
I come out of the airspace and missile defense operations community,
and my primary focus in the ACI is on improving cybersecurity
initiatives and resilience of derivative aviation capabilities where the DOD,
interagency, and industry objectives intersect. Awesome, awesome. I'm excited to hear more about
that later. So now that we've all kind of introduced ourselves and we have a good idea
who we are and where we come from, you can see we have a just jam-packed panel full of awesome
aviation cyber and researcher professionals here. So I'm really excited about it. Let's,
let's really just jump right in here. So today, in this panel, we're going to talk a little bit
about some current activities between government, industry, security, the security community,
the responsible disclosure community, some information sharing, and some improved
collaboration and coordination across the aviation sector. So really jam-packed. I want
to step back just a little bit and explain and go through just a little bit of the groundwork
on what the Aviation Cyber Initiative is. And so Randy, can you talk really briefly about what the
Aviation Cyber Initiative is in the tri-chair? You're good. You'd love to. Aviation Cyber
Initiative actually started probably around five years ago, the 2016 timeframe. It was,
it was originally focused on, on aircraft only. There was some testing that our DHS S&T
folks were doing and, and was, was of interest to everyone. And we've, we've taken that,
and a lot of things has happened since that initial surge or testing, if you will.
The National Strategy for Aviation Security was published by the White House
about a year and a half ago. We're getting close to two years ago. And it specifically was a,
was an update. The NSTAS needed to be updated. It was dated back to 2016. It was old and it didn't
include anything about cybersecurity, nor did it include anything about UAS. So that was a big
upgrade, if you will, for, for the NSTAS. It also defined the aviation ecosystem, which,
which really helped us out and kind of defines the swim lanes, if you will, for,
for aviation security. So, so those, those six swim lanes as defined include the aircraft,
obviously, but also talks about airports, talks about airlines, airlift, airlift being the,
the cargo derivative, derivative or equivalent of the airlines, talks about actors, which can
mean anything from training to, to third-party vendors on an airport. It could, it could be
anything has to do with people. And it goes into aviation management, which is all the
infrastructure necessary to run the aviation environment. So, so all of those things are
swim lanes. It's a little easier for us, the Aviation Cyber Initiative, to, to, to talk about
this when you're talking about the various swim lanes as opposed to a big amorphous blob. So
what is the ACI? Well, I've talked a little bit about it initially. A year ago, we were
chartered by the Secretary of Homeland Security, the Secretary of Defense, and the Secretary of
Transportation to, to be a tri-chaired organization. So I have my DOD colleague,
Al, and Sid, my FAA colleague, and we lead this effort across the whole of government
to include industry and to include anybody that's really looking at aviation cybersecurity,
to pull them in and try to reduce our risks and increase our resiliency across,
across aviation. So I'm, I'm very proud to participate in that. That gives you a little
background. I don't want to get too much in, in depth in it, but I think that that should
answer your question. Yeah, really good. Thank you. So I want to talk a little bit about
some, a recent situation that I kind of really feel was a really good example of a watershed
moment within the researcher aviation and public sector communities. So this happened about a year
ago. And Jen, RapidSeven made a pretty, it's a pretty interesting disclosure on civil aviation
last year. Can you walk us through that and kind of give us your perspective on the process?
Yeah, sure. Absolutely. So we have a researcher, Patrick Kiley, who has done a lot around
transportation in the past. He has done a lot specifically with automotive. He's also a pilot
and he's building his plane as one does apparently. And so as part of his sort of, you know,
passion and enthusiasm in this area, he was investigating various things and he heard about
a technology used in small aircraft that is well known in the security community as being
sort of quite trivial to exploit. So the technology is CAN bus. And he heard that it was being used
as a way of sort of connecting avionics. And the avionics, you know, being the parts that control
the plane, he was like, well, that sounds quite dangerous. And he was well aware that a few years
back there had been a lot of noise made around about CAN bus in automotive. And there'd been
very widespread discussion in the automotive industry. And as a result, many automotive
organizations either moved away from using CAN bus or introduced additional mitigations and
protections. He had not heard of such a discussion in the aviation space. And actually on talking to
more people who work in aviation, he found that, you know, generally security people seem to believe
it was an issue, but said that they were having trouble in having this be talked about at the
right levels and get enough attention to really make a change. So he did some research on that.
And our goal with the research from the beginning was never to sort of shame a particular vendor or
embarrass a vendor. This wasn't a, we're going to take a specific vendor system and uncover
new vulnerabilities. It's much more of an architectural issue and a known issue. So the
goal was to look at a few different systems, verify that CAN bus was in fact being used,
and then talk about why that's an issue on a sort of strategic level and try and stimulate some
discussion in the aviation community around it. As a result, and also because we were dealing with
aviation and, you know, we recognize that aviation is a different space. It, you know, there is a
sort of life and death element when you're talking about things to do with aviation. We were very
cautious with how we approached it. Our typical disclosure process, which is documented and on
the internet, is normally a sort of 60-day process, sometimes a bit longer. This process took a year
and a half. And the reason was two things. One, we very much did not want to cause hysteria. You
know, as somebody who flies a lot, I know how easy it is to get spooked on this stuff. And I,
so we wanted to be very thoughtful with the approach that we took and we wanted to be very
balanced and as neutral as possible. And the second thing is that we really did want to try
and stimulate this discussion. That was our goal. So we wanted to try and involve as many people to
participate in that process as possible and really sort of like immerse the community as much as we
could. It was a somewhat mixed process. You know, there's not a lot of tried and true ways of doing
this in aviation, even for an organization like Rapid7, who have done a lot of vulnerability
disclosure, a lot of vulnerability research over the years. Aviation, you know, every sector is a
little different and aviation is certainly also a little different. And what we found was that
generally, people, including many of the people on this call, were very, very generous with their
time and their insight, their expertise. So we had a lot of people who were willing to talk to us,
which was great, because we were worried at the beginning that that wouldn't be the case.
But we also found that there was a bit of a flavor in the discussion that came across of,
you know, people sort of pointing out that we weren't aviation experts and that physical security
would take care of this and that, you know, we weren't understanding how pilots work. Now,
here's the thing, is certainly I'm not an aviation expert and I was very glad to have
input and have expertise from people who really are immersed in the space. It was a great learning
for me. But in general, I think anybody who works in cybersecurity is always going to be a little
leery of any sector that really leans hard on physical security as a response to cybersecurity
challenges. And while we were very aware, always very aware and acknowledged in the report
that physical access was required to exploit this system, we're also very aware that these
systems stay in place for a very long time and that motivated attackers will find ways,
particularly when you're talking about smaller aircraft, which might not have quite the same
degree of physical protection that, you know, sort of larger commercial aircraft might.
And so, there was a little bit of that. And I think Patrick probably felt a little bit
affronted every time he got told that he didn't know how pilots worked, since he may not be a
commercial pilot, but, you know, he has flown planes. So, it was good to get the feedback.
We were super grateful to have the ears and to have the feedback. And we certainly wanted to
challenge our own assumptions. But what we did learn through the way is that, yes, it's always,
with any Coordinated Vulnerability Disclosure, and we are big advocates for Coordinated
Vulnerability Disclosure, it is critical and key to build empathy, to listen actively,
to take on board feedback and to challenge your own assumptions, and to try and build trust. Like,
I think, above all, trust is where you want to get to. But you also have to know when to
hold the line on your, like, yes, challenge your own assumptions, but hold your line
once you've done that and you've verified that your findings are as you think they are.
So, it was a good learning process for us. And I think, in the end, the disclosure went well. One
thing, just before I wrap, that I'll say is I think part of the reason the disclosure went so well
was because of the role that DHS CISA played. I think that having the Vulnerability Management
Center part of CISA, which Katie was kind of running out of time, having you guys independently
verify the research findings and then decide that it was a significant enough issue to put
out your own alert to coincide with our report, that, to me, was a pretty big deal. It was actually
kind of a game changer, I think. I can't say whether we would have bowed to pressure if that
had not been the case, but I'm certainly very grateful that we didn't have to make that choice.
So, thank you. And thank you to everyone else on the call who helped educate us along the way and
gave us their time and their feedback. Yeah, it's definitely a complicated situation. I think
a lot of times it's difficult when you think about every sector is different and, you know,
your ICS systems, your embedded systems, your safety systems, they're very complex. And doing
that coordination up and down the hardware stack is a little different than you would necessarily
see in, say, a digital services sort of platform or in a general, typical, traditional software
platform. So, it's definitely learning, I think, for everyone. And there are some ups and downs
in that. And I think that when you look at it, you have to take it for... we're going to look at
climate versus weather. You know, if we look at one each individual disclosure, it's pretty tough.
But in the end, we learned a lot. So, Randy, can you talk a little bit about... DHS got involved
in this disclosure. Can you talk a little bit about how DHS got involved in this disclosure and
what role DHS took? Sure. Yeah, we have the Vulnerability Disclosure Program that DHS runs.
Great group of folks. As a matter of fact, I think Jay Angus is going to have a panel at the
Aerospace Village on Vulnerability Disclosure. So, I invite you to go and listen to that.
Great, great folks. They approached me... great folks, including you, Katie... approached me and
said, hey, I've got an aviation thing. I need to get it to you. I need you to understand
we need to know kind of where we go from here. So, I was able to get the briefing from Rapid7.
Actually got to read their final draft report, if you will. And you have to realize in aviation,
aviation is a big thing. So, I've got a big background in aviation, but the CAN bus,
where it's installed, you know, different aircraft vendors, it's a huge thing to try to go,
yeah, I got this. So, how important is it? Well, it did require physical access. So, I can stand
down a little bit from that. I think everybody understood that. But, you know, what... how does
it affect commercial aviation? How does it affect small aircraft or the general aviation folks?
So, I said, look, we need to get it to two places. We need to get to the FAA. They're
the regulator. They should be aware of this because they need to make a risk assessment if
it's a big thing. We also need to get it to the Aviation ISAC. Aviation ISAC has their members.
They can quickly get it out to aircraft manufacturers and actually the folks who
are building systems and determine, hey, what can I do with this? Or what should I be doing with this
in the future? I think this was the first time since the ACI has been stood up that we've had
a vulnerability disclosure come to me. It's not the last time, but it was the first time.
It was handled very well, I think, by Rapid 7. I think they understood going in, you know,
the physical access aspect was a big deal, the acknowledgement of that. It wasn't the skies
falling. It was, hey, this is an issue and we need to address it. And I love that part of it.
I know our VDP folks, the vulnerability disclosure folks, were very interested in, hey, look, we need
to send out an advisory. It's going to mirror what we did on the cars years ago. And it's also
going to say, hey, it does require physical access. So then once again, not the skies falling,
we found a vulnerability, but this is something you should be aware of when you're architecting
a system. So it was very good for me. I enjoyed getting involved in it to this level. And then,
you know, the focus for that vulnerability disclosure is, can we get, you know,
how do we approach a mitigation? If we found a vulnerability, how do we approach a mitigation?
How do we close that down and make the system more safe and secure? And I think we achieved
that in this particular case. Great. Yeah, we go back to that physical security. And I think
overwhelmingly, one of the big things that was very different from, say, this disclosure to
a disclosure that we might see somewhere else is that this is more of an architecture
into a lot of different things versus, say, one particular product and one particular version.
And so just the impact was very awe-inspiring. We didn't know where things were. So we really
had to rely on the subject matter experts. And we really had to bring in a lot of different people
to ask and find out. And so, Sid, can you really quickly tell us about your work and how you were
brought in and talked to some of your colleagues at the FAA and the safety that was involved in
that? Yeah, sure. So, Randy brought this up last year. And I think I agree with you, Katie. I think
it was a watershed moment. That's a good way to describe it. We had a researcher that came forward
with a vulnerability. Rapid7 came to us and they said, hey, look, this is important. You know,
this is an issue. And so it really helped kind of spur a set of conversations within the FAA,
both from our ABS, which is this aviation safety organization within the agency.
The CISO was on the call. And it helped us, I think, you know, really connect different offices.
And so, granted, it's a physical security issue. And I believe the other thing that happened also
was TSA was notified. That's the agency that's responsible for all of aviation security in the
U.S. So it really helped us connect with different stakeholders and really laid the groundwork for a
process. There's going to be a lot of back and forth in such situations between the safety
engineers, the regulators, the researchers. And that's really, in my mind, very good.
And it's healthy. We want to spur those types of conversations. Everybody's not going to agree
on what exactly how big the risk is. And so it can get a little difficult to come to
get to the same page. But I think having those conversations is really important. And I think
this event helped us do that. So thanks to Rapid7, thanks to DHS and the ISAC for taking
the lead on this. Yeah, yeah. So that actually leads us right into, Jeff, can you talk about
the ISAC? And the ISAC is information sharing. And so if you really want to affect change,
you need to get the information out there. You need to make sure that people understand. So can
you talk to us about your involvement in this? Thanks, Katie. So first off, we were just really
highly appreciative of Rapid7's approach to this and allowing us to be invited in. Similarly to
Randy and the rest of the folks at the Aviation Cyber Initiative for being so inclusive, letting
us kind of get this information and be able to pass it out to the members. So like has been
mentioned earlier, the Aviation ISAC's role in these security disclosures is really a connector.
Jen highlighted how important it is for communication to be happening during these
events. And typically when they start, it's really hard for a researcher to find the right person in
the industry. We also mentioned here, though, that this was a little different. This is a technology
that's broadly used across the industry, and it's actually something a lot of other folks plug into.
Many times when a researcher has a particular disclosure they want to make, it's about one
type of product. There's one vulnerability in some design of a specific component.
When researchers want to get a hold of that company, frequently they're calling us because
if you want to get a hold of somebody in the industry, it's a lot harder nowadays actually
to find the right person. And we just happen to have them all connected in our community.
But this one was different, and it was a great learning experience for us all
because there was a little bit of a shorter window on the industrial side. But as we look
back at the event, it really made a lot of sense because there wasn't somebody that was one
particular company to take a look at this. This was more of everybody saying, hey, wait a minute,
we're all plugging into this. We really need to take a look at this as a larger issue and as a
systems issue. In the end, we did, and it's been mentioned as well, there was a physical security
component, that is one component. But in the whole concept of layered security, physical
security is just one layer. And when you find that there is an issue inside of any layer,
the objective in a really good layered concept is to harden that layer. And this was a really
good example of that. It's like, it doesn't matter if it's embedded in a lower layer,
let's get every layer as hard as it can possibly be and make it difficult for anyone to make that
complete penetration. So I would agree with everyone. I think this was a really good example
of how to do it right. And I think what was really impressive for us, too, as the trust
gets built across the engagement between the researchers and the industry, it was really good
to see what Jen talked about was the perspective right from the start. Hey, we don't want to get
people overly excited or hysterical about something. We really need to understand in the
whole equation of risk, you know, how big of a risk is this? And, you know, how does that risk
get managed? And their approach that they took, that cautious approach of really trying to get
that understanding and validation was really critical to the successful outcome. Awesome.
So I think this is a great opportunity and it was a great example of pieces that didn't ever,
you know, typically work together and who were new to each other and maybe didn't even know that
the other existed and were able to really pull together. And there were some ups and downs. And
in the end, Rapid7 put out their vulnerability information, DHS put out a complementary
security advisory, and I think it sort of laid the groundwork. So now that we kind of talked
about that, I really want to pivot to the current. So there are some really awesome progress being
made in the aviation and researcher communities. And it's hard to even pull a couple topics. When
I sat down to kind of go through and say, what can we talk about here? There were just so many
topics out there. The community is moving so rapidly. And I think even the aviation village
itself is something that 10 years ago, we wouldn't have even thought of. We could pull together and
do that. And so there's so many wonderful things. John, Boeing is getting involved in some really
awesome community outreach and community engagement. Can you talk a little bit about the tech council?
Yeah, I'll start off with, you know, aviation is a unique space. And we have a very strong safety
culture. We have a unique development process. And, you know, to some extent, I think we view
ourselves as being special. And, you know, Jen kind of mentioned earlier that when people come
from outside that community, the natural antibodies kick in and we find reasons to kind
of discount the feedback. I've been working in this space for 10 to 15 years. And, you know,
reality kind of kicked in on me when the Stuxnet virus was disclosed. And it broke all my,
you know, stereotypes of aviation and how we're unique. You know, and oftentimes I feel like an
evangelist out trying to spread the good word. Well, last year was a significant milestone,
and I'd say turning point for Boeing. A researcher got a hold of some of our executable code,
reversed engineered it, and disclosed things that were actually quite surprising. I think
we were surprised with the tools that allowed them to actually go in and, you know, kind of view the
code in, you know, in a space where we didn't think was really possible. We actually spent a
lot of time, several months, analyzing the code. We were in our lab. We have very extensive labs
that replicate the airplane quite accurately. At the end of it, we actually went out onto an
airplane. We brought all the systems engineers out to view it. We went through a bunch of scenarios.
Some of the claims, we actually went well beyond the claims. We did a pretty thorough test on a 787.
And at the end of that, our response, you know, not knowing, you know, it wasn't the real intent,
but I think it was viewed as hostile. And I got that feedback from several folks,
you know, in the aerospace village. And so after our analysis disclosure, we held a meeting with
a lot of key stakeholders. A lot of the airlines had a lot of questions for us. You know, what do
you think of this? Is it real? You know, we gave our synopsis. A lot of the government folks and
Katie were in one of the meetings with us. We had a spirited discussion with lots of different
government people, as you remember. And in that meeting, Katie kind of said, you know, John,
you really need to reach out to these folks and I can help you if you'd like. So we took that,
went internal to Boeing and we had some spirited discussions because this is really uncomfortable.
You know, changing how we've operated for a long time is not the easiest thing. But at the end of
the day, we said, you know what, we need to do this because these people are out looking at our
designs. They're not, you know, I don't think there's any ill will, but we need to embrace
them and we need to learn from them. And so we set up this tech council and we had several meetings
trying to level set a little bit. It's a little hard via the phone. And so after the RSA conference
in San Francisco in February, we invited them all back to Boeing. And at Boeing, we kind of
went over some of our design methodologies and, you know, met face to face. And that's a real,
it's real powerful to get to know people at a much more personal level. We took them into our labs,
showed them what we're capable of. We even arranged time on a 787 simulator. In fact, one of the
gentlemen was a military pilot and we set up kind of a difficult landing for him. High winds and,
you know, low light conditions, et cetera. He made it down good, which was positive.
But I think it went a long way to mending the adversary relationship. So as part of that, we
have part of this team, they have a, some folks have a claim they'd like to investigate with us.
And we're in the, we were in the process of bringing them into Boeing, into our lab to kind
of evaluate that when, you know, the COVID hit and that kind of slowed us down a little bit. But,
you know, I really want to embrace this and I want to expand it. And, you know, at DEF CON,
we actually plan on bringing, you know, real hardware, setting up some kind of
capture the flag event to kind of embrace this community much more. Another aspect of this,
we actually matured our vulnerability disclosure process. It is now very easy to find on the Boeing
website. At least I hope it is for folks. I was able to find it. And you can send your
vulnerabilities encrypted. We provide that means. And we're starting to receive a lot of stuff in.
And a lot of things that come in are shared between all the stakeholders. And as the product
guy for the airplane, we see all of it. And we actually evaluated surprising vulnerabilities
that are in the IT space. A lot of these systems are used in some form in aerospace. And so we have
to evaluate all those and see if we have the same issue that maybe the original claim came in with.
So I'll just close, you know, saying we're still crawling here. I'm really hoping to get
more engaged. You know, I think it's critical that we interject this into our designs. It's
a different view. And, you know, it's always powerful to get diverse opinions and diverse
perspectives. And those outside of aviation probably are more powerful at looking at our
designs than we may be. So thanks. Yeah, awesome. I know I remember sitting in some of those meetings
and I remember thinking to myself, why don't we all just talk? You know, why can't we just,
why don't we all just talk? And I can imagine that there were some people in that room who thought
that I was just that crazy lady from Homeland Security with these wild dreams of working
together. But I'm hopeful that we're going to see more of that and that that has actually worked out
really well. So yeah, you know, we're still in steps here. And I would like to, you know,
commend Boeing because Boeing did all the hard work on that. You know, the hardest part is
getting going and taking all of the steps that needed to happen in order to bring
people in and really get down into the labs and get into the weeds. And that takes a
lot of effort. And so I commend Boeing for that.
So Sid, can you talk a little bit about the FAA structure
and the work with the tri-chair and some of the things that you've been working with?
Yeah, sure. Thanks, Katie. I agree with everything that has been said on this great panel. I think,
let me make a few points. You know, we kind of oversee and regulate civil aviation. So we have a
unique role. We are the premier aviation agency in the US. We have authority over all the aircraft
that fly in the US and all the airmen, all the pilots, we certify them, we certify all the
aircraft. And we also conduct air traffic control, all the airplanes that take off and land are
controlled by the FAA. So it's a pretty big role. It's a pretty big responsibility. I think safety
is our focus and we are a safety agency. And so the way I see it is that cybersecurity is part
of our safety responsibility. And I run into that all the time. As a tri-chair for the ACI,
it's really a big task is culture change. We are trying to bring that culture of security
and looking at how to improve the security of the whole ecosystem into an agency that's focused
primarily on safety. So in terms of vulnerability disclosure, we don't have like a formal program.
We don't have like a way that you all the researchers can come forward and directly to us.
We rely on DHS, which is our partner through the ACI. But that does not mean that we are not open
to all of your ideas. I think the fact that I'm here on a panel, you know, I'd love to hear from
you all. And we'd love to have that dialogue about what the risk is and what some of the
vulnerabilities are. So I want to echo what has been said earlier. I think trust building
is incredibly important. We all should come together. And like Katie said, we need to be
talking all the time and exchanging notes and exchanging ideas. Let me share a quick story.
About two years ago, I was at the Pentagon. And DoD has this team called Gen5. That's basically
a bunch of very smart people, just like you all, that were looking at some of the vulnerabilities
within ADSP, which is our system for surveillance-based air traffic control. It's
satellite-based, I'm sorry, air traffic control. We are moving away from radar into satellite-based
GPS radar control. And so they had worked on this project for about a year to look at some
of the vulnerabilities within ADSP, which is a huge investment for the FAA and for the American
public. And I was with the CISO at the time and some other executives from FAA. And we just thought
it was fantastic. I mean, to invite these researchers into the Pentagon and have them test
an aviation system and hear some of their ideas. They actually came out with a report,
which was super insightful. And we took it all the way to the National Security Council.
And that has formed a basis for a lot of the follow-on work that's going on within ACI
for ADSP. So, you know, I told my boss, this is something we need at FAA, too. We need a
team like this to come in and test our systems and bring a completely different perspective
than what the agency is used to. So that coming together of the researchers,
of the research community, of the safety folks, you know, of the air traffic controllers and
the IT people, all that has to happen because it's really about bringing all those disciplines
together to tackle what is a very difficult sort of problem. I mean, we are looking at risks
across the ecosystem. And so that conversation needs to happen between the different disciplines.
I just did an online cyber course through Harvard a month or so ago. I finished it.
It was like an eight-week class. Let me just share a couple of things. Every organization,
including aviation, has operational risks, reputational risks, and legal risks when it
comes to cybersecurity. So a cyber breach can cause huge damage, millions of dollars in terms
of your operations, in terms of your reputation. Something to think about. Second is that we need
a culture within cybersecurity where we reward people for being skeptical. You know, you don't
want to just kind of reward people who are sort of agreeing with what's going on. You want people
to look skeptically at what's going on and tell you a different way to do things. We want to reward
people who want to break things because that can lead to a more cyber secure posture. And a lot of
the challenge that we face today as organizations has to do with information sharing, has to do with
culture change, and trust building. And so those are the tasks that we are all involved with.
So information sharing should be happening all the time. And that's what the ACI is
designed to do within the government, between our three big departments and with industry.
I want to... the last thing I want to say is also the fact that the aviation ecosystem faces
a lot of state and non-state cyber threats. The threats are very real.
There are known vulnerabilities within this ecosystem. We all recognize that.
So that can impact the operations within the national airspace and civil flights.
And the fact is we got to tackle those threats and risks together.
And so the FAA issues cyber situation reports today which address specific equities across
this ecosystem. And some of those are externally tailored to partners outside of FAA. So those
include other federal agencies and industry partners. And that's what I have. So thanks, Katie.
Yeah, awesome. It's really exciting to kind of hear some of the things that get passed around
and just really are exciting initiatives. The Pentagon has, I know, been deeply involved in
aviation for, you know, I was in the Air Force, so, you know, since forever. And so it's really
great to see these very, very established organizations get excited about working with
research and breaking things. That just makes my day. So these are really awesome initiatives and
I'm really excited about them. I want to move to the future for a little while. We kind of talked
about the past and we talked about the current and then I want to kind of talk about the future
really quick. And so I think the DOD's got kind of a really fun new initiative that I'd love to
hear more about. I think it's called the INFACTOR. So Al, can you talk to us about the INFACTOR?
Hey, sure, Katie. Hey, just as a little background before we dive right into the
INFACTOR. So we talked a lot about identifying and sharing cyber vulnerabilities, sharing
information. But going forward, the future is that we need to work together to close those
vulnerabilities using a threat-informed, risk-based approach. And that points us to two trends
the aviation ecosystem must address. You know, like Sid said, the first trend is the cyber threat
to aviation is real and growing. So it's highly likely that advanced nefarious cyber actors, to
include adversary nation states, will use cyberspace to steal our aviation intellectual property
and to conduct cyber operations to damage the reputation of U.S. and allied aircraft and
aviation industries, to gain a competitive advantage for their own industries. And so from
a national security perspective, improving the cybersecurity and resilience of our own
nation's aviation ecosystem to counter this threat is key. And for the Department of Defense, we have
to be able to project power, defend the homeland, and protecting critical aviation infrastructure
is part of that. But there's one thing we acknowledge. This challenge is not something
the Department of Defense or the government can do on its own. So recognizing these two trends,
recognizing that trend, you know, requires an increase in a public and private sector
collaboration or whole-of-nation approach. I don't know if you're aware, but Congress recently
chartered the Cyberspace Solarium Commission. And in this commission report, it identified
the need to increase public and private sector collaboration. And the goal is to improve our
speed and agility in addressing cybersecurity and resilience threats. And so the N-FACTOR that you
referred to, which stands for the National Federation of Aviation Cyber Test Organizations
and Researchers, the N-FACTOR, is a great example how the Aviation Cyber Initiative is pushing to
work on this. And so the thing that the Aviation Cyber Initiative does is, you know, we bring
together that whole-of-nation approach, bring together the cyber experts from federal agencies,
state agencies, industry, our federally funded research and development centers, our university
affiliated research centers, our national labs, all working together in the N-FACTOR to achieve
three lines of effort. Those lines of effort are, one, is catalog, collaborate, and connect.
And so, you know, just at a top level, we talk about catalog, our big push is to create a
national-level aviation cyber resource guide. And the goal of this resource guide is to be
an online, accessible, and searchable database of aviation cyber research, development, test,
and evaluation resources, expertise, facilities, and capabilities. And so, if you're part of the
N-FACTOR and you're working on initiative to counter, to look at cyber fuzzing or any of
these other kind of cyber trends, you could go to the resource guide and it'll give you a list of
who's working in that space, what kind of capabilities they have to test, and what, and
more importantly, how you can get to hold, get a hold of them to further collaborate. And so, the
collaboration is our second line of effort. You know, the goal of the collaboration is to create
a persistent collaboration forum where these cyber experts, this whole nation approach, can get
together and be able to spotlight or showcase capabilities, share information on projects,
and more importantly, if a, like, let's say, for example, you're working a project on intrusion
detection, cyber anomaly and intrusion detection, you can come to the N-FACTOR and present your
project and give us asks. And in the ask, the goal for the ask is that the N-FACTOR try to close
those gaps. And when we talk about closing those gaps, we call that a connect. And that's the third
line of effort, to connect projects, efforts, research papers with resources to do things like
test, validate, and move forward projects. And just a couple examples. You know, on the
collaboration side, Johns Hopkins APL did a presentation on how they were doing cyber
modeling on various aircraft. And the aircraft they were doing the modeling on, it so happened,
since John Craig was on, they were Boeing aircraft. And so, you know, after the meeting,
John and his team got together and said, hey, we probably need to know more about this modeling
effort. And oh, by the way, maybe we can work with Johns Hopkins to make it better. And so right now,
that's what we call a connect. We're working to bring those Johns Hopkins APL and Boeing together
to talk about how they can enhance that cyber modeling. And then on the resource sharing side,
we had a project come forward that was working on a cyber anomaly and intrusion detection
capability with AI machine learning based. And they needed a data tap to pull data from 1553 bus.
They didn't have it. And they also needed large quantities of data to support,
you know, training a machine learning and AI capable tool. And so we connected them with
the Air Force Research Lab and provided a tool called Vampire, which is a aviation bus tap,
and shipped that to them. And then Johns Hopkins APL again came through,
and they've been working on a data sharing effort that's been fantastic in terms of connecting. So
those are the kind of things that the end factor is trying to do. And we're trying to do it at
scale. And so that leads us to the, I'm sure people are saying, so how do you participate
in the end factor? Well, we got a couple asks. You know, first off, we're focused right now on US
organizations. So if you want to be a part of the end factor, what we ask you to do is three things.
First, we want you to one, agree to populate our aviation cyber resource guide with your
company's capabilities and resources. So that's one. The second one is, we want you to participate
in our tight 90-minute monthly forum. It's the end factor collaboration forum. And our goal is
to be able to showcase all our major participants as we go forward. And to participate in follow-on
meetings, you know, should those connects happen. And the third one is, that is the connect part.
That if you have capacity, and if you have resources, we would like for you to help connect
others to serve as a mechanism to accelerate our cyber innovation in the aviation ecosystem.
And so that's the kind of the three asks. I'll tell you, just yesterday, we had nearly 100
participants from across more than 60 organizations participate in the end factor forum. Our FAA tech
center and DoD guides are working to deliver the aviation cyber resource guide by the end of August,
at least the first instantiation of it. It's based on the FAA's technical capabilities library.
And I would say, you know, in fact is growing. And I think it's exceeding many of our expectations.
And what we want to do is get more people to work with us. So we can do what I like to say,
collaborate with effect. And so that's, that's the end factor going forward,
working to address the threat, and to increase our public and private sector cooperation
across the aviation ecosystem. So Al, let me ask you really quickly, is that,
is this initiative specific to military aviation, or is it open to civil aviation as well?
No, it's, it's, it's not limited to military aviation. In fact, it's not a DoD initiative.
It's an aviation cyber initiative, initiative. And so, you know, we have a charter to engage
industry. And so we're, we're working to do that in spades. And, you know, at least a couple
times a week, we're reaching out to bring our industry partners and really small businesses,
you know, which we think the small business, businesses are real powerhouses in innovation.
And, you know, when we can connect them with the larger big companies like the Raytheons and
Boeings of the world, then we can, we believe that we'll be able to accelerate aviation
cybersecurity capabilities.
Awesome, awesome. So we have about eight minutes or so left. And so I really want to
close up with some of our closing thoughts, and some just kind of words of wisdom and
things that we've learned from each one of the participants. So Randy, can we start with you?
What are your, what are your words of wisdom, things to take away, closing thoughts?
Things to take away? Well, I'll tell you what, Katie, I'm super proud of what we're doing under
ACI. I think it's, I think, I think it's time that we reach out across the entire ecosystem
and try to pull people together and have those conversations, address those vulnerabilities.
And, and I think, frankly, I think this is beginning to work. You know, working for DHS
CISA, you know, I've got that, that outward look. I'm looking to industry. I can pick up the phone
and call virtually anybody on this panel at any time. And if they're not in a meeting, which they
always are, they'll answer the phone and we'll have a conversation. This is, this is collaboration
at its finest. And, and I gotta say, you know, and I know we're limited on time, so I'll, I'll
stop it here. I love my job. And that, and these are the reasons why I love my job. The people on
the panel, the things that we're trying to accomplish and what we're trying to do through
ACI. I'm very proud of that. Yeah, it's wonderful. It's something that I think is really going to
make a difference. And that's, that's very exciting. I'm excited to be proud of it or to
be part of it. Sid, what are your, what are your thoughts? Well, I, I want to say that COVID-19
obviously has affected the aviation industry. It's transforming,
it's going to transform how we travel. It's going to change so many things. And
we're, you know, we're going through a change right now as an aviation industry,
but that does not mean we ignore the cyber threats. The work we are doing here
on this panel and the work I do through the ACI is incredibly important.
The cyber threats are real from both state and non-state actors. It's a combination of physical
security and cybersecurity and the information technology and operational technology,
safety, security, all of that. And the ecosystem is a vast complex network. So
there's a lot of vulnerabilities to it. A cyber breach can happen anytime.
There are threats out there and an attack can cause millions of dollars of damage
and a loss of reputation. So it can shake public confidence. It can change again,
the nature of flying. So we cannot ignore it. I think the work we're doing is super important
and I'm privileged and I feel lucky to be part of this team of so many smart people
who are doing such incredible work. So thank you for having me. You have my contact information,
so I urge you all to reach out to me anytime. Awesome. John?
So, you know, the last year has been interesting and we have got much more of a focus at Boeing on this.
We do daily report outs to the board of directors. In fact, we have a champion on our board.
We are leveraging our enterprise to not only help us with incident response, but helping
to beef up our design guides. We have expanded our product
cert team and we're being much more proactive at looking at things.
And then we're looking at things across board. How do you create a process to evaluate threats
and risks? And we're looking into that. We're actually working with industry and the government
on, you know, how do we do that effectively? But key is we're really starting to engage outside
of aerospace. And I think that's going to be the thing that really helps us the most. You know,
the tech council is one, but participation at DEF CON so we can build those relationships,
RSA conferences, et cetera. So it's pretty exciting. It's really exciting right now
and a little uncomfortable, but it's good. So thanks. Yeah. Embrace the uncomfort.
Jen? Katie, I'm honestly kind of blown away. You know, I think the whole purpose of the
Aerospace Village is to increase understanding and appreciation of the importance of cyber
security in aviation and to do so in a way that builds trust between the security community,
the aviation industry and the government, which all play a very, very important role in advancing
cyber security in aviation. And when I sit and I listen to my panel of panelists talking about
some of the amazing initiatives they've got going on and hear their attitudes and their responses
to the research and that kind of stuff, I just, I feel like we're in such a dramatically different
position to where we were a couple of years ago. And I hear people saying that they want to hear
from the research community. They want to hear from the security community. They want to partner
and collaborate. And that is, that's an incredible opportunity. And I hope that anybody listening,
particularly people who are participating in security research in some way, that they get a lot
of hope and optimism from this and feel that they can engage and that they can build trust,
they can build empathy and they can get involved. Yeah, it's very exciting. The trust and the
relationships, I think, are some of the most important factors in all of this. It's
getting involved. So yeah, getting involved. Jeff, information sharing, what have you got?
Oh, thanks a lot. I think this has been a great discussion. And, you know, we only went through
one example. But at the Aviation ISAC, we've had several of these events happen over the last
couple of years. And each one of them pretty much follows this pattern of building a great
relationship with a security researcher, finding out, you know, what a vulnerability is that
they've discovered, and then going through that validation process of, you know, is it really
an issue? Or isn't it an issue? And then, you know, working through the remediations and
disclosures when those have to happen. And, you know, likewise, we have found this to be
incredibly eye opening. And, I mean, so much so with the researchers, we've even hired one, which
helps us tremendously, particularly in the work that we're doing now. So I am glad that
there's been kind of this breakthrough and that we're seeing, you know, the bridge is being built,
and I only think it's going to get better. Awesome. Al, what are your closing remarks,
closing thoughts? Okay, hey, Katie. So kind of echoing across the board, I think the most
important thing is one is we have to recognize that the threat is real. And we should learn
from the maritime sector's NoPetya attack. We shouldn't have to wait until a serious cyber
attack of our own on the aviation ecosystem occurs. And the key to preventing that is to embrace the
idea that there's safety in the herd. You know, we need to strengthen the aviation herd, you know,
by continuing to share information, vulnerabilities, and work together to address those
vulnerabilities to improve our aviation cybersecurity and resilience. And so threats
real, and there's safety in the herd. Terribly true. Very true. So I guess my closing remarks,
then, I will say that the thing that I take away from all of these things is that I go back to
coordinated vulnerability disclosure. And I say that coordinated vulnerability disclosure is an
essential part of any security research. I think that everyone here and everyone that I've met,
from varying backgrounds all over the world, everyone has the same goal. We may not all speak
the same language. We may talk past each other. But I think ultimately, we have the same goal.
And that goal is protecting the end user. It's reducing risk and making people safer.
And so I think the last thing that anybody wants is to inadvertently put countless people's lives
at risk, economic situation at risk, because we published a roadmap that if that fell into the
wrong hands could just wreak havoc. So I go for coordinated vulnerability disclosure because it
really is a balancing act. It's a process that allows us to mitigate or to balance while we're
trying to mitigate. So that's my closing advice. I feel like all of the progress that we've made
is so wonderful. We have a long way to go. I love the fact that we're all talking to each other
and we're working together. But I want to make sure we know that there is a road ahead of us.
That road to me, the future looks bright and I'm excited for it. So thank you guys for coming to
the panel and listening to us. And if you have any questions, our contact information is up.
I think there's going to be an opportunity for some live chat later at some point. So
you'll be able to find out more information about that. If you have any questions or want to talk
more to us, please feel free to reach out. I think everyone here would invite a conversation.
It was great talking to everybody today. Thank you.