WEBVTT 00:11.420 --> 00:18.460 Hello, and welcome to the Aerospace Village panel discussion on building communications across the aviation ecosystem. 00:18.460 --> 00:20.120 Hi, let me introduce myself. 00:20.120 --> 00:26.560 My name is Katie Trimble-Noble, and I'm the Director of Product Security Incident Response and Bug Bounty at Intel. 00:26.560 --> 00:36.820 So, I run the Bug Bounty program as well as researcher outreach and engagement, and I've been really in the ecosystem for many, many years. 00:36.820 --> 00:44.060 Prior to coming over to Intel, I worked for the Department of Homeland Security, where I was the Section Chief for Vulnerability Management and Coordination. 00:44.060 --> 00:47.280 So, I've been doing this for several years. 00:47.300 --> 00:51.760 Throughout my career, I've coordinated and disclosed over 20,000 cybersecurity vulnerabilities. 00:52.060 --> 00:54.560 So, I really want to jump in right now. 00:54.560 --> 00:59.020 We don't have a lot of time today, and I want to go ahead and introduce our panel. 00:59.020 --> 01:02.220 So, we're going to ask everybody to go through and introduce themselves. 01:05.010 --> 01:07.450 So, Randy, can we start with you? 01:08.370 --> 01:08.710 Yeah. 01:08.710 --> 01:10.890 Hi, I'm Randy Talley. 01:10.890 --> 01:16.830 I'm a Senior Advisor with DHS's Cybersecurity and Infrastructure Security Agency. 01:16.830 --> 01:37.490 I've been working in aviation for quite a while as a pilot doing aviation security for DHS and have been on the, excuse me, the Tri-Chair, the DHS Tri-Chair for the Aviation Cyber Initiative for the last two and a half years. 01:39.230 --> 01:40.350 Awesome. 01:40.350 --> 01:41.250 Sid? 01:42.770 --> 01:44.550 Hi, everyone. 01:44.550 --> 01:46.190 My name is Sid Geji. 01:47.030 --> 01:49.530 I work at FAA. 01:49.530 --> 01:54.450 I'm a manager within the Office of Information Security and Privacy. 01:54.930 --> 02:00.410 I've been with the agency about 14 years, and in a variety of different roles. 02:01.010 --> 02:08.630 And I serve as the Tri-Chair for the FAA on the Aviation Cyber Initiative for the past two and a half years as well. 02:08.930 --> 02:11.330 I am glad to be here. 02:11.330 --> 02:13.210 It's my first year at DEF CON. 02:13.630 --> 02:20.470 Lots of people in the room, you know, virtually, and I look forward to learning from you all. 02:20.830 --> 02:22.750 So, glad to be here. 02:23.570 --> 02:24.250 Yeah, thanks. 02:24.250 --> 02:24.910 Welcome, Sid. 02:24.910 --> 02:25.730 Welcome to DEF CON. 02:25.730 --> 02:27.550 I hope this experience is awesome for you. 02:27.550 --> 02:29.850 You get a little bit of a different flavor this year. 02:30.430 --> 02:31.550 So, John? 02:32.310 --> 02:33.830 Hi, my name is John Craig. 02:33.830 --> 02:38.630 I'm the Chief Engineer of Cabin Network and Security Systems at the Boeing Company. 02:38.630 --> 02:41.490 I've been there for around 34 years. 02:41.490 --> 02:50.850 I've worked in all sorts of systems groups on commercial airplanes, and my current role has me working all the cabin systems, the networks on the airplane. 02:50.910 --> 02:58.350 I work the development of the connectivity links, and I'm responsible for product security for commercial airplanes. 02:58.350 --> 03:07.630 I'm also the Chairman of the Aviation ISAC, and really like to encourage people to look up that organization. 03:07.630 --> 03:13.050 It provides a great sharing opportunity in aviation. 03:13.310 --> 03:14.250 Thanks. 03:14.810 --> 03:16.510 Yeah, welcome. 03:16.510 --> 03:17.410 Jen? 03:17.530 --> 03:18.650 Hi, I'm Jen Ellis. 03:18.650 --> 03:27.030 I'm the VP of Community and Public Affairs at Rapid7, and I am probably the least of the aviation experts on this panel. 03:27.030 --> 03:29.070 When I say probably, I mean definitely. 03:29.110 --> 03:45.670 But I represent the voice of, I think, the security research community, and my job is to think about how do you leverage security research and insight and expertise to create social change that makes a more secure, safer world. 03:46.750 --> 03:48.530 Awesome, awesome. 03:48.530 --> 03:49.570 Jeff? 03:51.670 --> 03:52.850 Hi, I'm Jeff Troy. 03:52.850 --> 03:54.710 I'm the President of the Aviation ISAC. 03:54.710 --> 03:57.130 I've been in that role for about three and a half years. 03:57.150 --> 03:59.210 I also work for General Electric. 03:59.210 --> 04:10.150 I'm on the staff of the CISO at General Electric Aviation, and I'm on the Board of Directors of the National Defense ISAC, so very engaged in the information sharing world. 04:10.510 --> 04:23.270 Prior to that, I was with the FBI for 25 years and left there in the cyber division, you know, working the cyber criminal and national security cases. 04:23.930 --> 04:25.750 Glad to be here, thanks. 04:25.810 --> 04:27.130 Yeah, happy to have you. 04:27.130 --> 04:27.930 Alan? 04:28.170 --> 04:39.370 Hi, I'm Al Burke, and I'm an Associate Deputy Director in the Air Force's Cyberspace Operations and Warfighter Communications, and I'm also the Department of Defense Chair for the Aviation Cyber Initiative. 04:39.370 --> 04:59.750 I come out of the airspace and missile defense operations community, and my primary focus in the ACI is on improving cybersecurity initiatives and resilience of derivative aviation capabilities where the DOD, interagency, and industry objectives intersect. 05:00.950 --> 05:02.330 Awesome, awesome. 05:02.330 --> 05:04.350 I'm excited to hear more about that later. 05:04.410 --> 05:16.890 So now that we've all kind of introduced ourselves and we have a good idea who we are and where we come from, you can see we have a just jam-packed panel full of awesome aviation cyber and researcher professionals here. 05:16.890 --> 05:18.030 So I'm really excited about it. 05:18.030 --> 05:19.790 Let's, let's really just jump right in here. 05:19.850 --> 05:34.830 So today, in this panel, we're going to talk a little bit about some current activities between government, industry, security, the security community, the responsible disclosure community, some information sharing, and some improved collaboration and coordination across the aviation sector. 05:34.830 --> 05:36.910 So really jam-packed. 05:36.910 --> 05:45.850 I want to step back just a little bit and explain and go through just a little bit of the groundwork on what the Aviation Cyber Initiative is. 05:45.850 --> 05:51.810 And so Randy, can you talk really briefly about what the Aviation Cyber Initiative is in the tri-chair? 05:52.650 --> 05:53.350 You're good. 05:53.350 --> 05:54.450 You'd love to. 05:54.450 --> 06:01.550 Aviation Cyber Initiative actually started probably around five years ago, the 2016 timeframe. 06:01.950 --> 06:06.050 It was, it was originally focused on, on aircraft only. 06:06.050 --> 06:13.710 There was some testing that our DHS S&T folks were doing and, and was, was of interest to everyone. 06:13.890 --> 06:22.430 And we've, we've taken that, and a lot of things has happened since that initial surge or testing, if you will. 06:22.430 --> 06:29.650 The National Strategy for Aviation Security was published by the White House about a year and a half ago. 06:29.650 --> 06:31.630 We're getting close to two years ago. 06:32.010 --> 06:35.950 And it specifically was a, was an update. 06:35.950 --> 06:37.370 The NSTAS needed to be updated. 06:37.370 --> 06:39.610 It was dated back to 2016. 06:39.610 --> 06:45.810 It was old and it didn't include anything about cybersecurity, nor did it include anything about UAS. 06:45.810 --> 06:50.090 So that was a big upgrade, if you will, for, for the NSTAS. 06:50.170 --> 07:02.870 It also defined the aviation ecosystem, which, which really helped us out and kind of defines the swim lanes, if you will, for, for aviation security. 07:03.030 --> 07:25.830 So, so those, those six swim lanes as defined include the aircraft, obviously, but also talks about airports, talks about airlines, airlift, airlift being the, the cargo derivative, derivative or equivalent of the airlines, talks about actors, which can mean anything from training to, 07:25.830 --> 07:28.270 to third-party vendors on an airport. 07:28.270 --> 07:30.310 It could, it could be anything has to do with people. 07:30.570 --> 07:36.990 And it goes into aviation management, which is all the infrastructure necessary to run the aviation environment. 07:37.030 --> 07:39.590 So, so all of those things are swim lanes. 07:39.590 --> 07:51.270 It's a little easier for us, the Aviation Cyber Initiative, to, to, to talk about this when you're talking about the various swim lanes as opposed to a big amorphous blob. 07:51.390 --> 07:54.370 So what is the ACI? 07:54.370 --> 07:57.170 Well, I've talked a little bit about it initially. 07:57.170 --> 08:07.690 A year ago, we were chartered by the Secretary of Homeland Security, the Secretary of Defense, and the Secretary of Transportation to, to be a tri-chaired organization. 08:07.810 --> 08:32.650 So I have my DOD colleague, Al, and Sid, my FAA colleague, and we lead this effort across the whole of government to include industry and to include anybody that's really looking at aviation cybersecurity, to pull them in and try to reduce our risks and increase our resiliency across, 08:32.650 --> 08:34.350 across aviation. 08:34.450 --> 08:37.230 So I'm, I'm very proud to participate in that. 08:37.230 --> 08:38.690 That gives you a little background. 08:38.690 --> 08:43.250 I don't want to get too much in, in depth in it, but I think that that should answer your question. 08:43.990 --> 08:45.030 Yeah, really good. 08:45.030 --> 08:45.890 Thank you. 08:46.030 --> 09:00.770 So I want to talk a little bit about some, a recent situation that I kind of really feel was a really good example of a watershed moment within the researcher aviation and public sector communities. 09:00.770 --> 09:02.930 So this happened about a year ago. 09:02.930 --> 09:09.370 And Jen, RapidSeven made a pretty, it's a pretty interesting disclosure on civil aviation last year. 09:09.370 --> 09:13.410 Can you walk us through that and kind of give us your perspective on the process? 09:13.410 --> 09:14.070 Yeah, sure. 09:14.070 --> 09:14.990 Absolutely. 09:15.130 --> 09:21.950 So we have a researcher, Patrick Kiley, who has done a lot around transportation in the past. 09:21.950 --> 09:25.310 He has done a lot specifically with automotive. 09:25.310 --> 09:31.330 He's also a pilot and he's building his plane as one does apparently. 09:32.010 --> 09:52.730 And so as part of his sort of, you know, passion and enthusiasm in this area, he was investigating various things and he heard about a technology used in small aircraft that is well known in the security community as being sort of quite trivial to exploit. 09:52.730 --> 09:55.090 So the technology is CAN bus. 09:55.150 --> 10:00.970 And he heard that it was being used as a way of sort of connecting avionics. 10:00.970 --> 10:05.670 And the avionics, you know, being the parts that control the plane, he was like, well, that sounds quite dangerous. 10:05.670 --> 10:11.410 And he was well aware that a few years back there had been a lot of noise made around about CAN bus in automotive. 10:11.730 --> 10:14.490 And there'd been very widespread discussion in the automotive industry. 10:14.490 --> 10:22.770 And as a result, many automotive organizations either moved away from using CAN bus or introduced additional mitigations and protections. 10:23.370 --> 10:27.810 He had not heard of such a discussion in the aviation space. 10:27.810 --> 10:41.090 And actually on talking to more people who work in aviation, he found that, you know, generally security people seem to believe it was an issue, but said that they were having trouble in having this be talked about at the right levels and get enough attention to really make a change. 10:41.370 --> 10:43.810 So he did some research on that. 10:43.810 --> 10:52.810 And our goal with the research from the beginning was never to sort of shame a particular vendor or embarrass a vendor. 10:52.810 --> 10:58.590 This wasn't a, we're going to take a specific vendor system and uncover new vulnerabilities. 10:58.590 --> 11:02.390 It's much more of an architectural issue and a known issue. 11:02.390 --> 11:16.210 So the goal was to look at a few different systems, verify that CAN bus was in fact being used, and then talk about why that's an issue on a sort of strategic level and try and stimulate some discussion in the aviation community around it. 11:16.810 --> 11:24.970 As a result, and also because we were dealing with aviation and, you know, we recognize that aviation is a different space. 11:24.970 --> 11:29.450 It, you know, there is a sort of life and death element when you're talking about things to do with aviation. 11:29.870 --> 11:32.810 We were very cautious with how we approached it. 11:33.090 --> 11:41.470 Our typical disclosure process, which is documented and on the internet, is normally a sort of 60-day process, sometimes a bit longer. 11:41.470 --> 11:43.290 This process took a year and a half. 11:43.290 --> 11:45.710 And the reason was two things. 11:45.710 --> 11:49.090 One, we very much did not want to cause hysteria. 11:49.090 --> 11:55.830 You know, as somebody who flies a lot, I know how easy it is to get spooked on this stuff. 11:55.830 --> 12:05.930 And I, so we wanted to be very thoughtful with the approach that we took and we wanted to be very balanced and as neutral as possible. 12:06.010 --> 12:09.010 And the second thing is that we really did want to try and stimulate this discussion. 12:09.010 --> 12:10.290 That was our goal. 12:10.290 --> 12:20.210 So we wanted to try and involve as many people to participate in that process as possible and really sort of like immerse the community as much as we could. 12:21.370 --> 12:24.210 It was a somewhat mixed process. 12:24.390 --> 12:37.950 You know, there's not a lot of tried and true ways of doing this in aviation, even for an organization like Rapid7, who have done a lot of vulnerability disclosure, a lot of vulnerability research over the years. 12:37.950 --> 12:44.070 Aviation, you know, every sector is a little different and aviation is certainly also a little different. 12:44.590 --> 12:57.710 And what we found was that generally , people, including many of the people on this call, were very, very generous with their time and their insight, their expertise. 12:57.710 --> 13:02.530 So we had a lot of people who were willing to talk to us, which was great, because we were worried at the beginning that that wouldn't be the case. 13:03.010 --> 13:21.830 But we also found that there was a bit of a flavor in the discussion that came across of, you know, people sort of pointing out that we weren't aviation experts and that physical security would take care of this and that, you know, we weren't understanding how pilots work. 13:21.830 --> 13:31.630 Now, here's the thing, is certainly I'm not an aviation expert and I was very glad to have input and have expertise from people who really are immersed in the space. 13:31.630 --> 13:33.550 It was a great learning for me. 13:33.850 --> 13:46.770 But in general, I think anybody who works in cybersecurity is always going to be a little leery of any sector that really leans hard on physical security as a response to cybersecurity challenges. 13:46.870 --> 14:03.790 And while we were very aware, always very aware and acknowledged in the report that physical access was required to exploit this system, we're also very aware that these systems stay in place for a very long time and that motivated attackers will find ways, 14:03.790 --> 14:13.110 particularly when you're talking about smaller aircraft, which might not have quite the same degree of physical protection that, you know, sort of larger commercial aircraft might. 14:13.110 --> 14:16.970 And so, there was a little bit of that. 14:16.970 --> 14:26.810 And I think Patrick probably felt a little bit affronted every time he got told that he didn't know how pilots worked, since he may not be a commercial pilot, but, you know, he has flown planes. 14:26.810 --> 14:30.090 So, it was good to get the feedback. 14:30.090 --> 14:35.510 We were super grateful to have the ears and to have the feedback. 14:35.510 --> 14:38.130 And we certainly wanted to challenge our own assumptions. 14:38.630 --> 14:55.710 But what we did learn through the way is that, yes, it's always, with any Coordinated Vulnerability Disclosure, and we are big advocates for Coordinated Vulnerability Disclosure, it is critical and key to build empathy, to listen actively, to take on board feedback and to challenge your own assumptions, 14:55.710 --> 14:57.210 and to try and build trust. 14:57.210 --> 14:59.850 Like, I think, above all, trust is where you want to get to. 15:00.270 --> 15:09.750 But you also have to know when to hold the line on your, like, yes, challenge your own assumptions, but hold your line once you've done that and you've verified that your findings are as you think they are. 15:09.750 --> 15:11.970 So, it was a good learning process for us. 15:11.970 --> 15:14.970 And I think, in the end, the disclosure went well. 15:14.970 --> 15:22.910 One thing, just before I wrap, that I'll say is I think part of the reason the disclosure went so well was because of the role that DHS CISA played. 15:23.010 --> 15:44.650 I think that having the Vulnerability Management Center part of CISA, which Katie was kind of running out of time, having you guys independently verify the research findings and then decide that it was a significant enough issue to put out your own alert to coincide with our report, 15:44.650 --> 15:47.410 that, to me, was a pretty big deal. 15:47.410 --> 15:49.550 It was actually kind of a game changer, I think. 15:50.910 --> 15:56.330 I can't say whether we would have bowed to pressure if that had not been the case, but I'm certainly very grateful that we didn't have to make that choice. 15:56.330 --> 15:57.210 So, thank you. 15:57.430 --> 16:02.750 And thank you to everyone else on the call who helped educate us along the way and gave us their time and their feedback. 16:03.810 --> 16:06.690 Yeah, it's definitely a complicated situation. 16:06.690 --> 16:15.870 I think a lot of times it's difficult when you think about every sector is different and, you know, your ICS systems, your embedded systems, your safety systems, they're very complex. 16:15.870 --> 16:26.550 And doing that coordination up and down the hardware stack is a little different than you would necessarily see in, say, a digital services sort of platform or in a general, typical, traditional software platform. 16:26.550 --> 16:29.430 So, it's definitely learning, I think, for everyone. 16:29.430 --> 16:31.810 And there are some ups and downs in that. 16:32.110 --> 16:38.330 And I think that when you look at it, you have to take it for... we're going to look at climate versus weather. 16:38.330 --> 16:41.390 You know, if we look at one each individual disclosure, it's pretty tough. 16:41.390 --> 16:43.410 But in the end, we learned a lot. 16:43.410 --> 16:47.490 So, Randy, can you talk a little bit about... DHS got involved in this disclosure. 16:47.490 --> 16:53.290 Can you talk a little bit about how DHS got involved in this disclosure and what role DHS took? 16:54.390 --> 16:54.950 Sure. 16:54.950 --> 16:59.310 Yeah, we have the Vulnerability Disclosure Program that DHS runs. 16:59.310 --> 17:00.350 Great group of folks. 17:00.350 --> 17:06.510 As a matter of fact, I think Jay Angus is going to have a panel at the Aerospace Village on Vulnerability Disclosure. 17:06.650 --> 17:09.370 So, I invite you to go and listen to that. 17:10.090 --> 17:11.310 Great, great folks. 17:11.310 --> 17:18.370 They approached me... great folks, including you, Katie... approached me and said, hey, I've got an aviation thing. 17:18.370 --> 17:20.710 I need to get it to you. 17:20.710 --> 17:25.170 I need you to understand we need to know kind of where we go from here. 17:26.090 --> 17:29.910 So, I was able to get the briefing from Rapid7. 17:30.250 --> 17:34.770 Actually got to read their final draft report, if you will. 17:35.570 --> 17:38.950 And you have to realize in aviation, aviation is a big thing. 17:38.950 --> 17:53.610 So, I've got a big background in aviation, but the CAN bus, where it's installed, you know, different aircraft vendors, it's a huge thing to try to go, yeah, I got this. 17:53.650 --> 17:55.790 So, how important is it? 17:55.790 --> 17:58.830 Well, it did require physical access. 17:58.830 --> 18:01.250 So, I can stand down a little bit from that. 18:01.250 --> 18:03.590 I think everybody understood that. 18:03.850 --> 18:08.730 But, you know, what... how does it affect commercial aviation? 18:08.730 --> 18:15.090 How does it affect small aircraft or the general aviation folks? 18:15.250 --> 18:18.790 So, I said, look, we need to get it to two places. 18:18.790 --> 18:20.270 We need to get to the FAA. 18:20.270 --> 18:21.210 They're the regulator. 18:21.210 --> 18:26.610 They should be aware of this because they need to make a risk assessment if it's a big thing. 18:26.750 --> 18:28.890 We also need to get it to the Aviation ISAC. 18:28.890 --> 18:32.350 Aviation ISAC has their members. 18:32.350 --> 18:43.390 They can quickly get it out to aircraft manufacturers and actually the folks who are building systems and determine, hey, what can I do with this? 18:43.390 --> 18:46.690 Or what should I be doing with this in the future? 18:47.130 --> 18:57.290 I think this was the first time since the ACI has been stood up that we've had a vulnerability disclosure come to me. 18:57.490 --> 19:00.450 It's not the last time, but it was the first time. 19:00.450 --> 19:03.050 It was handled very well, I think, by Rapid 7. 19:03.050 --> 19:13.730 I think they understood going in, you know, the physical access aspect was a big deal, the acknowledgement of that. 19:13.730 --> 19:15.530 It wasn't the skies falling. 19:15.530 --> 19:20.290 It was, hey, this is an issue and we need to address it. 19:20.290 --> 19:22.270 And I love that part of it. 19:23.190 --> 19:30.930 I know our VDP folks, the vulnerability disclosure folks, were very interested in, hey, look, we need to send out an advisory. 19:31.050 --> 19:34.310 It's going to mirror what we did on the cars years ago. 19:34.310 --> 19:38.350 And it's also going to say, hey, it does require physical access. 19:38.350 --> 19:50.230 So then once again, not the skies falling, we found a vulnerability, but this is something you should be aware of when you're architecting a system. 19:50.630 --> 19:54.530 So it was very good for me. 19:54.530 --> 19:58.790 I enjoyed getting involved in it to this level. 19:58.790 --> 20:07.090 And then, you know, the focus for that vulnerability disclosure is, can we get, you know, how do we approach a mitigation? 20:07.090 --> 20:10.250 If we found a vulnerability, how do we approach a mitigation? 20:10.470 --> 20:15.450 How do we close that down and make the system more safe and secure? 20:15.450 --> 20:18.070 And I think we achieved that in this particular case. 20:20.750 --> 20:21.510 Great. 20:21.630 --> 20:24.390 Yeah, we go back to that physical security. 20:24.390 --> 20:37.730 And I think overwhelmingly, one of the big things that was very different from, say, this disclosure to a disclosure that we might see somewhere else is that this is more of an architecture into a lot of different things versus, say, one particular product and one particular version. 20:37.730 --> 20:43.550 And so just the impact was very awe-inspiring. 20:43.550 --> 20:45.130 We didn't know where things were. 20:45.130 --> 20:47.330 So we really had to rely on the subject matter experts. 20:47.330 --> 20:50.910 And we really had to bring in a lot of different people to ask and find out. 20:50.910 --> 21:00.870 And so, Sid, can you really quickly tell us about your work and how you were brought in and talked to some of your colleagues at the FAA and the safety that was involved in that? 21:02.710 --> 21:03.750 Yeah, sure. 21:03.750 --> 21:08.910 So, Randy brought this up last year. 21:08.990 --> 21:11.750 And I think I agree with you, Katie. 21:11.750 --> 21:13.250 I think it was a watershed moment. 21:13.250 --> 21:15.010 That's a good way to describe it. 21:15.310 --> 21:18.610 We had a researcher that came forward with a vulnerability. 21:20.070 --> 21:25.310 Rapid7 came to us and they said, hey, look, this is important. 21:25.310 --> 21:26.750 You know, this is an issue. 21:27.170 --> 21:39.370 And so it really helped kind of spur a set of conversations within the FAA, both from our ABS, which is this aviation safety organization within the agency. 21:39.670 --> 21:41.530 The CISO was on the call. 21:41.630 --> 21:46.370 And it helped us, I think, you know, really connect different offices. 21:46.370 --> 21:50.330 And so, granted, it's a physical security issue. 21:50.330 --> 21:55.330 And I believe the other thing that happened also was TSA was notified. 21:56.030 --> 22:00.890 That's the agency that's responsible for all of aviation security in the U.S. 22:01.150 --> 22:08.330 So it really helped us connect with different stakeholders and really laid the groundwork for a process . 22:09.170 --> 22:18.190 There's going to be a lot of back and forth in such situations between the safety engineers, the regulators, the researchers. 22:18.350 --> 22:21.150 And that's really, in my mind, very good. 22:21.190 --> 22:22.530 And it's healthy. 22:22.530 --> 22:24.990 We want to spur those types of conversations. 22:25.430 --> 22:30.090 Everybody's not going to agree on what exactly how big the risk is. 22:30.810 --> 22:35.110 And so it can get a little difficult to come to get to the same page. 22:35.110 --> 22:38.510 But I think having those conversations is really important. 22:38.510 --> 22:41.370 And I think this event helped us do that. 22:41.610 --> 22:48.110 So thanks to Rapid7, thanks to DHS and the ISAC for taking the lead on this. 22:48.650 --> 22:49.710 Yeah, yeah. 22:49.710 --> 22:53.890 So that actually leads us right into, Jeff, can you talk about the ISAC? 22:53.890 --> 22:56.150 And the ISAC is information sharing. 22:56.150 --> 22:59.690 And so if you really want to affect change, you need to get the information out there. 22:59.690 --> 23:01.730 You need to make sure that people understand. 23:01.730 --> 23:05.010 So can you talk to us about your involvement in this? 23:05.890 --> 23:06.770 Thanks, Katie. 23:06.870 --> 23:14.970 So first off, we were just really highly appreciative of Rapid7's approach to this and allowing us to be invited in. 23:14.970 --> 23:27.550 Similarly to Randy and the rest of the folks at the Aviation Cyber Initiative for being so inclusive, letting us kind of get this information and be able to pass it out to the members. 23:27.550 --> 23:37.470 So like has been mentioned earlier, the Aviation ISAC's role in these security disclosures is really a connector. 23:37.970 --> 23:43.790 Jen highlighted how important it is for communication to be happening during these events. 23:43.850 --> 23:49.450 And typically when they start, it's really hard for a researcher to find the right person in the industry. 23:49.950 --> 23:53.030 We also mentioned here, though, that this was a little different. 23:53.030 --> 23:59.910 This is a technology that's broadly used across the industry, and it's actually something a lot of other folks plug into. 24:00.990 --> 24:08.270 Many times when a researcher has a particular disclosure they want to make, it's about one type of product. 24:08.270 --> 24:13.470 There's one vulnerability in some design of a specific component. 24:13.730 --> 24:23.950 When researchers want to get a hold of that company, frequently they're calling us because if you want to get a hold of somebody in the industry, it's a lot harder nowadays actually to find the right person. 24:23.950 --> 24:27.350 And we just happen to have them all connected in our community. 24:27.790 --> 24:37.410 But this one was different, and it was a great learning experience for us all because there was a little bit of a shorter window on the industrial side. 24:37.410 --> 24:46.070 But as we look back at the event, it really made a lot of sense because there wasn't somebody that was one particular company to take a look at this. 24:46.070 --> 24:49.330 This was more of everybody saying, hey, wait a minute, we're all plugging into this. 24:49.330 --> 24:54.890 We really need to take a look at this as a larger issue and as a systems issue. 24:55.570 --> 25:03.470 In the end, we did, and it's been mentioned as well, there was a physical security component, that is one component. 25:03.670 --> 25:09.250 But in the whole concept of layered security, physical security is just one layer. 25:09.250 --> 25:18.230 And when you find that there is an issue inside of any layer, the objective in a really good layered concept is to harden that layer. 25:18.250 --> 25:20.990 And this was a really good example of that. 25:20.990 --> 25:31.970 It's like, it doesn't matter if it's embedded in a lower layer, let's get every layer as hard as it can possibly be and make it difficult for anyone to make that complete penetration. 25:32.450 --> 25:34.570 So I would agree with everyone. 25:34.570 --> 25:38.950 I think this was a really good example of how to do it right. 25:39.130 --> 25:54.350 And I think what was really impressive for us, too, as the trust gets built across the engagement between the researchers and the industry, it was really good to see what Jen talked about was the perspective right from the start. 25:54.350 --> 25:59.630 Hey, we don't want to get people overly excited or hysterical about something. 25:59.630 --> 26:06.210 We really need to understand in the whole equation of risk, you know, how big of a risk is this? 26:06.210 --> 26:08.830 And, you know, how does that risk get managed? 26:08.830 --> 26:19.010 And their approach that they took, that cautious approach of really trying to get that understanding and validation was really critical to the successful outcome. 26:22.050 --> 26:23.050 Awesome. 26:23.050 --> 26:36.870 So I think this is a great opportunity and it was a great example of pieces that didn't ever, you know, typically work together and who were new to each other and maybe didn't even know that the other existed and were able to really pull together. 26:36.870 --> 26:38.230 And there were some ups and downs. 26:38.230 --> 26:48.050 And in the end, Rapid7 put out their vulnerability information, DHS put out a complementary security advisory, and I think it sort of laid the groundwork. 26:48.050 --> 26:51.690 So now that we kind of talked about that, I really want to pivot to the current. 26:51.990 --> 26:57.470 So there are some really awesome progress being made in the aviation and researcher communities. 26:57.470 --> 27:00.430 And it's hard to even pull a couple topics. 27:00.430 --> 27:04.090 When I sat down to kind of go through and say, what can we talk about here? 27:04.110 --> 27:06.830 There were just so many topics out there. 27:06.830 --> 27:09.810 The community is moving so rapidly. 27:09.810 --> 27:15.370 And I think even the aviation village itself is something that 10 years ago, we wouldn't have even thought of. 27:15.370 --> 27:16.970 We could pull together and do that. 27:16.970 --> 27:19.210 And so there's so many wonderful things. 27:19.490 --> 27:24.490 John, Boeing is getting involved in some really awesome community outreach and community engagement. 27:24.490 --> 27:26.690 Can you talk a little bit about the tech council? 27:27.530 --> 27:32.230 Yeah, I'll start off with, you know, aviation is a unique space. 27:32.230 --> 27:34.470 And we have a very strong safety culture. 27:34.470 --> 27:37.290 We have a unique development process. 27:37.290 --> 27:41.590 And, you know, to some extent, I think we view ourselves as being special. 27:42.050 --> 27:52.970 And, you know, Jen kind of mentioned earlier that when people come from outside that community, the natural antibodies kick in and we find reasons to kind of discount the feedback. 27:53.570 --> 27:56.710 I've been working in this space for 10 to 15 years. 27:56.710 --> 28:03.270 And, you know, reality kind of kicked in on me when the Stuxnet virus was disclosed. 28:03.270 --> 28:08.250 And it broke all my, you know, stereotypes of aviation and how we're unique. 28:08.690 --> 28:13.250 You know, and oftentimes I feel like an evangelist out trying to spread the good word. 28:13.650 --> 28:18.390 Well, last year was a significant milestone, and I'd say turning point for Boeing. 28:18.390 --> 28:27.750 A researcher got a hold of some of our executable code, reversed engineered it, and disclosed things that were actually quite surprising. 28:27.750 --> 28:41.090 I think we were surprised with the tools that allowed them to actually go in and, you know, kind of view the code in, you know, in a space where we didn't think was really possible. 28:41.270 --> 28:45.650 We actually spent a lot of time, several months, analyzing the code. 28:45.650 --> 28:46.350 We were in our lab. 28:46.350 --> 28:51.090 We have very extensive labs that replicate the airplane quite accurately. 28:51.230 --> 28:54.150 At the end of it, we actually went out onto an airplane . 28:54.290 --> 28:57.170 We brought all the systems engineers out to view it. 28:57.170 --> 28:59.530 We went through a bunch of scenarios. 28:59.530 --> 29:02.630 Some of the claims, we actually went well beyond the claims. 29:02.730 --> 29:06.190 We did a pretty thorough test on a 787. 29:07.670 --> 29:15.930 And at the end of that, our response, you know, not knowing, you know, it wasn't the real intent, but I think it was viewed as hostile. 29:15.930 --> 29:22.770 And I got that feedback from several folks, you know, in the aerospace village. 29:23.050 --> 29:27.750 And so after our analysis disclosure, we held a meeting with a lot of key stakeholders. 29:27.750 --> 29:29.950 A lot of the airlines had a lot of questions for us. 29:29.950 --> 29:30.970 You know, what do you think of this? 29:30.970 --> 29:32.050 Is it real? 29:32.290 --> 29:34.450 You know, we gave our synopsis. 29:34.510 --> 29:37.410 A lot of the government folks and Katie were in one of the meetings with us. 29:37.410 --> 29:42.170 We had a spirited discussion with lots of different government people, as you remember. 29:42.850 --> 29:50.410 And in that meeting, Katie kind of said, you know, John, you really need to reach out to these folks and I can help you if you'd like. 29:50.790 --> 29:57.250 So we took that, went internal to Boeing and we had some spirited discussions because this is really uncomfortable. 29:57.250 --> 30:02.490 You know, changing how we've operated for a long time is not the easiest thing. 30:02.490 --> 30:09.470 But at the end of the day, we said, you know what, we need to do this because these people are out looking at our designs. 30:09.470 --> 30:15.390 They're not, you know, I don't think there's any ill will, but we need to embrace them and we need to learn from them. 30:15.390 --> 30:21.890 And so we set up this tech council and we had several meetings trying to level set a little bit. 30:21.890 --> 30:23.770 It's a little hard via the phone. 30:24.290 --> 30:28.910 And so after the RSA conference in San Francisco in February, we invited them all back to Boeing. 30:28.990 --> 30:35.970 And at Boeing, we kind of went over some of our design methodologies and, you know, met face to face. 30:35.970 --> 30:41.410 And that's a real, it's real powerful to get to know people at a much more personal level. 30:41.670 --> 30:45.210 We took them into our labs, showed them what we're capable of. 30:45.210 --> 30:48.150 We even arranged time on a 787 simulator. 30:48.150 --> 30:53.470 In fact, one of the gentlemen was a military pilot and we set up kind of a difficult landing for him. 30:53.470 --> 30:57.050 High winds and, you know, low light conditions, et cetera. 30:57.050 --> 30:59.390 He made it down good, which was positive. 30:59.510 --> 31:03.490 But I think it went a long way to mending the adversary relationship. 31:04.070 --> 31:13.050 So as part of that, we have part of this team, they have a, some folks have a claim they'd like to investigate with us. 31:13.050 --> 31:21.830 And we're in the, we were in the process of bringing them into Boeing, into our lab to kind of evaluate that when, you know, the COVID hit and that kind of slowed us down a little bit. 31:21.830 --> 31:26.190 But, you know, I really want to embrace this and I want to expand it. 31:26.190 --> 31:36.990 And, you know, at DEF CON, we actually plan on bringing, you know, real hardware, setting up some kind of capture the flag event to kind of embrace this community much more. 31:37.270 --> 31:42.270 Another aspect of this, we actually matured our vulnerability disclosure process. 31:42.270 --> 31:45.950 It is now very easy to find on the Boeing website. 31:45.950 --> 31:47.250 At least I hope it is for folks. 31:47.250 --> 31:48.610 I was able to find it. 31:48.890 --> 31:51.530 And you can send your vulnerabilities encrypted. 31:51.530 --> 31:53.310 We provide that means. 31:54.230 --> 31:56.990 And we're starting to receive a lot of stuff in. 31:57.050 --> 32:01.810 And a lot of things that come in are shared between all the stakeholders. 32:01.810 --> 32:04.930 And as the product guy for the airplane, we see all of it. 32:04.930 --> 32:09.810 And we actually evaluated surprising vulnerabilities that are in the IT space. 32:09.810 --> 32:14.010 A lot of these systems are used in some form in aerospace. 32:14.010 --> 32:20.970 And so we have to evaluate all those and see if we have the same issue that maybe the original claim came in with. 32:21.270 --> 32:23.930 So I'll just close, you know, saying we're still crawling here. 32:23.930 --> 32:26.090 I'm really hoping to get more engaged. 32:26.850 --> 32:31.050 You know, I think it's critical that we interject this into our designs. 32:31.050 --> 32:32.070 It's a different view. 32:32.070 --> 32:36.970 And, you know, it's always powerful to get diverse opinions and diverse perspectives. 32:36.970 --> 32:43.370 And those outside of aviation probably are more powerful at looking at our designs than we may be. 32:43.370 --> 32:45.710 So thanks. 32:46.710 --> 32:48.050 Yeah, awesome. 32:48.150 --> 32:54.630 I know I remember sitting in some of those meetings and I remember thinking to myself, why don't we all just talk? 32:54.630 --> 32:56.610 You know, why can't we just, why don't we all just talk? 32:56.610 --> 33:07.050 And I can imagine that there were some people in that room who thought that I was just that crazy lady from Homeland Security with these wild dreams of working together. 33:07.050 --> 33:11.610 But I'm hopeful that we're going to see more of that and that that has actually worked out really well. 33:12.330 --> 33:17.790 So yeah, you know, we're still in steps here. 33:17.790 --> 33:21.550 And I would like to, you know, commend Boeing because Boeing did all the hard work on that. 33:21.550 --> 33:31.490 You know, the hardest part is getting going and taking all of the steps that needed to happen in order to bring people in and really get down into the labs and get into the weeds. 33:31.490 --> 33:34.130 And that takes a lot of effort. 33:34.130 --> 33:36.250 And so I commend Boeing for that. 33:39.070 --> 33:47.670 So Sid, can you talk a little bit about the FAA structure and the work with the tri-chair and some of the things that you've been working with? 33:51.470 --> 33:52.670 Yeah, sure. 33:53.030 --> 33:54.170 Thanks, Katie. 33:54.170 --> 33:58.670 I agree with everything that has been said on this great panel. 33:58.670 --> 34:01.570 I think, let me make a few points. 34:02.290 --> 34:05.930 You know, we kind of oversee and regulate civil aviation. 34:05.930 --> 34:08.050 So we have a unique role. 34:08.050 --> 34:11.250 We are the premier aviation agency in the US. 34:11.490 --> 34:22.270 We have authority over all the aircraft that fly in the US and all the airmen, all the pilots, we certify them, we certify all the aircraft . 34:23.010 --> 34:30.490 And we also conduct air traffic control, all the airplanes that take off and land are controlled by the FAA. 34:31.210 --> 34:33.490 So it's a pretty big role. 34:33.490 --> 34:34.910 It's a pretty big responsibility. 34:35.910 --> 34:40.670 I think safety is our focus and we are a safety agency. 34:41.350 --> 34:49.530 And so the way I see it is that cybersecurity is part of our safety responsibility. 34:50.370 --> 34:53.030 And I run into that all the time. 34:53.470 --> 34:59.370 As a tri-chair for the ACI, it's really a big task is culture change. 34:59.370 --> 35:12.210 We are trying to bring that culture of security and looking at how to improve the security of the whole ecosystem into an agency that's focused primarily on safety. 35:12.970 --> 35:17.390 So in terms of vulnerability disclosure, we don't have like a formal program. 35:17.510 --> 35:23.870 We don't have like a way that you all the researchers can come forward and directly to us. 35:24.710 --> 35:28.730 We rely on DHS, which is our partner through the ACI. 35:29.050 --> 35:33.830 But that does not mean that we are not open to all of your ideas. 35:34.010 --> 35:41.410 I think the fact that I'm here on a panel, you know, I'd love to hear from you all. 35:42.090 --> 35:50.010 And we'd love to have that dialogue about what the risk is and what some of the vulnerabilities are. 35:50.210 --> 35:52.670 So I want to echo what has been said earlier. 35:52.670 --> 35:55.190 I think trust building is incredibly important. 35:56.290 --> 35:58.010 We all should come together. 35:58.010 --> 36:05.790 And like Katie said, we need to be talking all the time and exchanging notes and exchanging ideas. 36:06.170 --> 36:07.790 Let me share a quick story. 36:07.790 --> 36:10.470 About two years ago, I was at the Pentagon. 36:11.550 --> 36:14.590 And DoD has this team called Gen5. 36:14.750 --> 36:28.210 That's basically a bunch of very smart people, just like you all, that were looking at some of the vulnerabilities within ADSP, which is our system for surveillance-based air traffic control. 36:28.210 --> 36:31.350 It's satellite-based, I'm sorry, air traffic control. 36:31.350 --> 36:36.670 We are moving away from radar into satellite-based GPS radar control. 36:37.370 --> 36:49.010 And so they had worked on this project for about a year to look at some of the vulnerabilities within ADSP, which is a huge investment for the FAA and for the American public. 36:49.450 --> 36:54.570 And I was with the CISO at the time and some other executives from FAA. 36:54.570 --> 36:57.450 And we just thought it was fantastic. 36:57.450 --> 37:08.510 I mean, to invite these researchers into the Pentagon and have them test an aviation system and hear some of their ideas. 37:08.510 --> 37:12.510 They actually came out with a report, which was super insightful. 37:13.150 --> 37:16.450 And we took it all the way to the National Security Council. 37:16.890 --> 37:24.130 And that has formed a basis for a lot of the follow-on work that's going on within ACI for ADSP. 37:24.130 --> 37:28.550 So, you know, I told my boss, this is something we need at FAA, too. 37:28.550 --> 37:37.590 We need a team like this to come in and test our systems and bring a completely different perspective than what the agency is used to. 37:38.830 --> 38:01.050 So that coming together of the researchers, of the research community, of the safety folks, you know, of the air traffic controllers and the IT people, all that has to happen because it's really about bringing all those disciplines together to tackle what is a very difficult sort of problem. 38:01.050 --> 38:04.150 I mean, we are looking at risks across the ecosystem. 38:04.490 --> 38:08.670 And so that conversation needs to happen between the different disciplines. 38:08.710 --> 38:14.250 I just did an online cyber course through Harvard a month or so ago. 38:14.250 --> 38:15.050 I finished it. 38:15.050 --> 38:16.950 It was like an eight-week class. 38:17.210 --> 38:18.670 Let me just share a couple of things. 38:18.670 --> 38:27.030 Every organization, including aviation, has operational risks, reputational risks, and legal risks when it comes to cybersecurity. 38:27.330 --> 38:36.130 So a cyber breach can cause huge damage, millions of dollars in terms of your operations, in terms of your reputation. 38:36.250 --> 38:37.690 Something to think about. 38:37.690 --> 38:45.150 Second is that we need a culture within cybersecurity where we reward people for being skeptical. 38:45.150 --> 38:52.050 You know, you don't want to just kind of reward people who are sort of agreeing with what's going on. 38:52.050 --> 38:57.070 You want people to look skeptically at what's going on and tell you a different way to do things. 38:57.070 --> 39:02.490 We want to reward people who want to break things because that can lead to a more cyber secure posture. 39:03.070 --> 39:14.230 And a lot of the challenge that we face today as organizations has to do with information sharing, has to do with culture change, and trust building. 39:14.230 --> 39:18.430 And so those are the tasks that we are all involved with. 39:19.870 --> 39:22.670 So information sharing should be happening all the time. 39:22.670 --> 39:29.570 And that's what the ACI is designed to do within the government, between our three big departments and with industry. 39:30.210 --> 39:40.570 I want to... the last thing I want to say is also the fact that the aviation ecosystem faces a lot of state and non-state cyber threats. 39:41.090 --> 39:42.950 The threats are very real. 39:43.530 --> 39:46.630 There are known vulnerabilities within this ecosystem. 39:46.630 --> 39:47.890 We all recognize that. 39:48.430 --> 39:55.330 So that can impact the operations within the national airspace and civil flights. 39:55.930 --> 40:01.290 And the fact is we got to tackle those threats and risks together. 40:01.670 --> 40:12.330 And so the FAA issues cyber situation reports today which address specific equities across this ecosystem. 40:12.330 --> 40:16.810 And some of those are externally tailored to partners outside of FAA. 40:16.810 --> 40:22.870 So those include other federal agencies and industry partners. 40:24.030 --> 40:27.070 And that's what I have. 40:27.070 --> 40:28.250 So thanks, Katie. 40:29.090 --> 40:30.090 Yeah, awesome. 40:30.090 --> 40:37.430 It's really exciting to kind of hear some of the things that get passed around and just really are exciting initiatives. 40:37.430 --> 40:44.210 The Pentagon has, I know, been deeply involved in aviation for, you know, I was in the Air Force, so, you know, since forever. 40:44.210 --> 40:54.530 And so it's really great to see these very, very established organizations get excited about working with research and breaking things. 40:54.530 --> 40:56.590 That just makes my day. 40:57.110 --> 41:00.690 So these are really awesome initiatives and I'm really excited about them. 41:00.730 --> 41:02.810 I want to move to the future for a little while. 41:02.810 --> 41:07.990 We kind of talked about the past and we talked about the current and then I want to kind of talk about the future really quick. 41:07.990 --> 41:14.090 And so I think the DOD's got kind of a really fun new initiative that I'd love to hear more about. 41:14.090 --> 41:15.950 I think it's called the INFACTOR. 41:15.950 --> 41:18.530 So Al, can you talk to us about the INFACTOR? 41:19.090 --> 41:20.270 Hey, sure, Katie. 41:20.610 --> 41:23.930 Hey, just as a little background before we dive right into the INFACTOR. 41:23.930 --> 41:29.410 So we talked a lot about identifying and sharing cyber vulnerabilities, sharing information. 41:29.410 --> 41:38.210 But going forward, the future is that we need to work together to close those vulnerabilities using a threat-informed, risk-based approach. 41:38.310 --> 41:42.870 And that points us to two trends the aviation ecosystem must address. 41:42.870 --> 41:49.130 You know, like Sid said, the first trend is the cyber threat to aviation is real and growing. 41:49.130 --> 42:03.510 So it's highly likely that advanced nefarious cyber actors, to include adversary nation states, will use cyberspace to steal our aviation intellectual property and to conduct cyber operations to damage the reputation of U.S. 42:03.510 --> 42:09.490 and allied aircraft and aviation industries, to gain a competitive advantage for their own industries. 42:09.510 --> 42:18.990 And so from a national security perspective, improving the cybersecurity and resilience of our own nation's aviation ecosystem to counter this threat is key. 42:18.990 --> 42:27.610 And for the Department of Defense, we have to be able to project power, defend the homeland, and protecting critical aviation infrastructure is part of that. 42:27.610 --> 42:29.490 But there's one thing we acknowledge. 42:29.490 --> 42:35.070 This challenge is not something the Department of Defense or the government can do on its own. 42:35.450 --> 42:45.450 So recognizing these two trends, recognizing that trend, you know, requires an increase in a public and private sector collaboration or whole-of-nation approach. 42:45.530 --> 42:51.930 I don't know if you're aware, but Congress recently chartered the Cyberspace Solarium Commission. 42:52.150 --> 42:59.150 And in this commission report, it identified the need to increase public and private sector collaboration. 42:59.390 --> 43:06.690 And the goal is to improve our speed and agility in addressing cybersecurity and resilience threats. 43:06.750 --> 43:21.970 And so the N-FACTOR that you referred to, which stands for the National Federation of Aviation Cyber Test Organizations and Researchers, the N-FACTOR, is a great example how the Aviation Cyber Initiative is pushing to work on this. 43:21.970 --> 43:39.210 And so the thing that the Aviation Cyber Initiative does is, you know, we bring together that whole-of-nation approach, bring together the cyber experts from federal agencies, state agencies, industry, our federally funded research and development centers, 43:39.210 --> 43:49.410 our university affiliated research centers, our national labs, all working together in the N-FACTOR to achieve three lines of effort. 43:49.410 --> 43:54.950 Those lines of effort are, one, is catalog, collaborate, and connect. 43:55.010 --> 44:04.910 And so, you know, just at a top level, we talk about catalog, our big push is to create a national -level aviation cyber resource guide. 44:04.990 --> 44:20.150 And the goal of this resource guide is to be an online, accessible, and searchable database of aviation cyber research, development, test, and evaluation resources, expertise, facilities, and capabilities. 44:20.150 --> 44:39.150 And so, if you're part of the N-FACTOR and you're working on initiative to counter, to look at cyber fuzzing or any of these other kind of cyber trends, you could go to the resource guide and it'll give you a list of who's working in that space, what kind of capabilities they have to test, 44:39.150 --> 44:45.210 and what, and more importantly, how you can get to hold, get a hold of them to further collaborate. 44:45.670 --> 44:48.430 And so, the collaboration is our second line of effort. 44:48.430 --> 45:07.670 You know, the goal of the collaboration is to create a persistent collaboration forum where these cyber experts, this whole nation approach, can get together and be able to spotlight or showcase capabilities, share information on projects, and more importantly, 45:07.670 --> 45:19.850 if a, like, let's say, for example, you're working a project on intrusion detection, cyber anomaly and intrusion detection, you can come to the N-FACTOR and present your project and give us asks. 45:19.850 --> 45:27.210 And in the ask, the goal for the ask is that the N-FACTOR try to close those gaps. 45:27.210 --> 45:31.030 And when we talk about closing those gaps, we call that a connect. 45:31.030 --> 45:43.590 And that's the third line of effort, to connect projects, efforts, research papers with resources to do things like test, validate, and move forward projects. 45:43.590 --> 45:45.330 And just a couple examples. 45:45.330 --> 45:53.110 You know, on the collaboration side, Johns Hopkins APL did a presentation on how they were doing cyber modeling on various aircraft. 45:53.390 --> 46:01.910 And the aircraft they were doing the modeling on, it so happened, since John Craig was on, they were Boeing aircraft. 46:01.910 --> 46:08.690 And so, you know, after the meeting, John and his team got together and said, hey, we probably need to know more about this modeling effort. 46:08.690 --> 46:12.590 And oh, by the way, maybe we can work with Johns Hopkins to make it better. 46:12.610 --> 46:15.250 And so right now, that's what we call a connect. 46:15.250 --> 46:22.070 We're working to bring those Johns Hopkins APL and Boeing together to talk about how they can enhance that cyber modeling. 46:22.070 --> 46:31.730 And then on the resource sharing side, we had a project come forward that was working on a cyber anomaly and intrusion detection capability with AI machine learning based. 46:31.730 --> 46:36.230 And they needed a data tap to pull data from 1553 bus. 46:36.230 --> 46:37.490 They didn't have it. 46:37.490 --> 46:44.390 And they also needed large quantities of data to support, you know, training a machine learning and AI capable tool. 46:44.390 --> 46:53.750 And so we connected them with the Air Force Research Lab and provided a tool called Vampire, which is a aviation bus tap, and shipped that to them. 46:53.750 --> 47:03.150 And then Johns Hopkins APL again came through, and they've been working on a data sharing effort that's been fantastic in terms of connecting. 47:03.150 --> 47:07.030 So those are the kind of things that the end factor is trying to do. 47:07.030 --> 47:09.430 And we're trying to do it at scale. 47:09.690 --> 47:15.570 And so that leads us to the, I'm sure people are saying, so how do you participate in the end factor? 47:15.570 --> 47:18.190 Well, we got a couple asks. 47:18.190 --> 47:21.450 You know, first off, we're focused right now on US organizations. 47:22.130 --> 47:26.690 So if you want to be a part of the end factor, what we ask you to do is three things. 47:26.690 --> 47:37.150 First, we want you to one, agree to populate our aviation cyber resource guide with your company's capabilities and resources. 47:37.410 --> 47:38.590 So that's one. 47:38.590 --> 47:46.270 The second one is, we want you to participate in our tight 90-minute monthly forum. 47:46.410 --> 47:48.830 It's the end factor collaboration forum. 47:49.090 --> 47:53.890 And our goal is to be able to showcase all our major participants as we go forward. 47:54.310 --> 47:59.090 And to participate in follow-on meetings, you know, should those connects happen. 47:59.090 --> 48:02.170 And the third one is, that is the connect part. 48:02.170 --> 48:15.790 That if you have capacity, and if you have resources, we would like for you to help connect others to serve as a mechanism to accelerate our cyber innovation in the aviation ecosystem. 48:15.790 --> 48:18.230 And so that's the kind of the three asks. 48:18.230 --> 48:28.030 I'll tell you, just yesterday, we had nearly 100 participants from across more than 60 organizations participate in the end factor forum. 48:28.030 --> 48:38.990 Our FAA tech center and DoD guides are working to deliver the aviation cyber resource guide by the end of August, at least the first instantiation of it. 48:38.990 --> 48:42.310 It's based on the FAA's technical capabilities library. 48:42.550 --> 48:46.070 And I would say, you know, in fact is growing. 48:46.150 --> 48:48.990 And I think it's exceeding many of our expectations. 48:49.350 --> 48:52.870 And what we want to do is get more people to work with us. 48:52.890 --> 48:56.570 So we can do what I like to say, collaborate with effect. 48:56.630 --> 49:08.310 And so that's, that's the end factor going forward, working to address the threat, and to increase our public and private sector cooperation across the aviation ecosystem. 49:08.910 --> 49:15.970 So Al, let me ask you really quickly, is that, is this initiative specific to military aviation, or is it open to civil aviation as well? 49:15.970 --> 49:20.090 No, it's, it's, it's not limited to military aviation. 49:20.090 --> 49:21.970 In fact, it's not a DoD initiative. 49:22.190 --> 49:25.550 It's an aviation cyber initiative, initiative. 49:25.610 --> 49:29.810 And so, you know, we have a charter to engage industry. 49:29.810 --> 49:32.310 And so we're, we're working to do that in spades. 49:32.310 --> 49:46.110 And, you know, at least a couple times a week, we're reaching out to bring our industry partners and really small businesses, you know, which we think the small business, businesses are real powerhouses in innovation. 49:46.150 --> 49:57.830 And, you know, when we can connect them with the larger big companies like the Raytheons and Boeings of the world, then we can, we believe that we'll be able to accelerate aviation cybersecurity capabilities. 50:00.240 --> 50:01.780 Awesome, awesome. 50:02.100 --> 50:07.020 So we have about eight minutes or so left. 50:07.020 --> 50:20.360 And so I really want to close up with some of our closing thoughts, and some just kind of words of wisdom and things that we've learned from each one of the participants. 50:20.560 --> 50:22.780 So Randy, can we start with you? 50:22.780 --> 50:27.240 What are your, what are your words of wisdom, things to take away, closing thoughts? 50:28.200 --> 50:29.580 Things to take away? 50:29.580 --> 50:35.400 Well, I'll tell you what, Katie, I'm super proud of what we're doing under ACI. 50:35.400 --> 50:47.360 I think it's, I think, I think it's time that we reach out across the entire ecosystem and try to pull people together and have those conversations, address those vulnerabilities. 50:47.360 --> 50:52.420 And, and I think, frankly, I think this is beginning to work. 50:52.520 --> 50:56.880 You know, working for DHS CISA, you know, I've got that, that outward look. 50:56.900 --> 50:58.660 I'm looking to industry. 50:58.660 --> 51:04.000 I can pick up the phone and call virtually anybody on this panel at any time. 51:04.000 --> 51:09.160 And if they're not in a meeting, which they always are, they'll answer the phone and we'll have a conversation. 51:09.300 --> 51:13.040 This is, this is collaboration at its finest. 51:13.500 --> 51:18.980 And, and I gotta say, you know, and I know we're limited on time, so I'll, I'll stop it here. 51:19.100 --> 51:20.780 I love my job. 51:20.780 --> 51:23.720 And that, and these are the reasons why I love my job. 51:23.720 --> 51:29.260 The people on the panel, the things that we're trying to accomplish and what we're trying to do through ACI. 51:29.260 --> 51:30.480 I'm very proud of that. 51:31.260 --> 51:32.680 Yeah, it's wonderful. 51:33.160 --> 51:37.000 It's something that I think is really going to make a difference. 51:37.000 --> 51:38.940 And that's, that's very exciting. 51:38.940 --> 51:41.140 I'm excited to be proud of it or to be part of it. 51:41.680 --> 51:44.060 Sid, what are your, what are your thoughts? 51:46.260 --> 51:53.880 Well, I, I want to say that COVID-19 obviously has affected the aviation industry. 51:53.880 --> 51:57.660 It's transforming, it's going to transform how we travel. 51:57.940 --> 52:00.060 It's going to change so many things. 52:00.060 --> 52:09.220 And we're, you know, we're going through a change right now as an aviation industry, but that does not mean we ignore the cyber threats. 52:09.400 --> 52:19.260 The work we are doing here on this panel and the work I do through the ACI is incredibly important. 52:20.220 --> 52:24.580 The cyber threats are real from both state and non-state actors. 52:25.340 --> 52:35.720 It's a combination of physical security and cybersecurity and the information technology and operational technology, safety, security, all of that. 52:35.880 --> 52:40.060 And the ecosystem is a vast complex network. 52:40.060 --> 52:44.500 So there's a lot of vulnerabilities to it. 52:44.500 --> 52:46.960 A cyber breach can happen anytime. 52:47.260 --> 52:54.840 There are threats out there and an attack can cause millions of dollars of damage and a loss of reputation. 52:54.900 --> 52:58.620 So it can shake public confidence. 52:58.620 --> 53:01.480 It can change again, the nature of flying. 53:01.480 --> 53:03.500 So we cannot ignore it. 53:03.720 --> 53:13.340 I think the work we're doing is super important and I'm privileged and I feel lucky to be part of this team of so many smart people who are doing such incredible work. 53:13.340 --> 53:15.500 So thank you for having me. 53:15.500 --> 53:19.640 You have my contact information, so I urge you all to reach out to me anytime. 53:22.960 --> 53:23.920 Awesome. 53:24.300 --> 53:25.240 John? 53:30.260 --> 53:39.140 So, you know, the last year has been interesting and we have got much more of a focus at Boeing on this. 53:39.440 --> 53:42.080 We do daily report outs to the board of directors. 53:42.080 --> 53:44.020 In fact, we have a champion on our board. 53:44.060 --> 53:54.660 We are leveraging our enterprise to not only help us with incident response, but helping to beef up our design guides. 53:54.660 --> 54:04.460 We have expanded our product cert team and we're being much more proactive at looking at things. 54:05.360 --> 54:07.340 And then we're looking at things across board. 54:07.340 --> 54:12.080 How do you create a process to evaluate threats and risks? 54:12.080 --> 54:13.300 And we're looking into that. 54:13.300 --> 54:20.160 We're actually working with industry and the government on, you know, how do we do that effectively? 54:20.420 --> 54:24.540 But key is we're really starting to engage outside of aerospace. 54:24.540 --> 54:28.820 And I think that's going to be the thing that really helps us the most. 54:28.820 --> 54:36.700 You know, the tech council is one, but participation at DEF CON so we can build those relationships, RSA conferences, et cetera. 54:36.700 --> 54:38.300 So it's pretty exciting. 54:38.300 --> 54:42.520 It's really exciting right now and a little uncomfortable, but it's good. 54:42.520 --> 54:43.820 So thanks. 54:44.560 --> 54:45.260 Yeah. 54:45.400 --> 54:46.920 Embrace the uncomfort. 54:48.100 --> 54:49.220 Jen? 54:50.220 --> 54:52.740 Katie, I'm honestly kind of blown away. 54:52.840 --> 55:11.240 You know, I think the whole purpose of the Aerospace Village is to increase understanding and appreciation of the importance of cyber security in aviation and to do so in a way that builds trust between the security community, the aviation industry and the government, 55:11.240 --> 55:16.020 which all play a very, very important role in advancing cyber security in aviation. 55:16.380 --> 55:30.280 And when I sit and I listen to my panel of panelists talking about some of the amazing initiatives they've got going on and hear their attitudes and their responses to the research and that kind of stuff, I just, I feel like we're in such a dramatically different position to where we were a couple of years ago. 55:30.620 --> 55:35.220 And I hear people saying that they want to hear from the research community. 55:35.220 --> 55:36.520 They want to hear from the security community. 55:36.520 --> 55:37.980 They want to partner and collaborate. 55:38.160 --> 55:40.500 And that is, that's an incredible opportunity. 55:40.540 --> 55:54.820 And I hope that anybody listening, particularly people who are participating in security research in some way, that they get a lot of hope and optimism from this and feel that they can engage and that they can build trust, they can build empathy and they can get involved. 55:58.980 --> 56:00.560 Yeah, it's very exciting. 56:00.980 --> 56:06.520 The trust and the relationships, I think, are some of the most important factors in all of this. 56:06.640 --> 56:08.500 It's getting involved. 56:09.300 --> 56:10.840 So yeah, getting involved. 56:10.840 --> 56:13.520 Jeff, information sharing, what have you got? 56:14.060 --> 56:15.460 Oh, thanks a lot. 56:15.460 --> 56:17.540 I think this has been a great discussion. 56:17.560 --> 56:19.980 And, you know, we only went through one example. 56:20.160 --> 56:26.700 But at the Aviation ISAC, we've had several of these events happen over the last couple of years. 56:26.700 --> 56:43.020 And each one of them pretty much follows this pattern of building a great relationship with a security researcher, finding out, you know, what a vulnerability is that they've discovered, and then going through that validation process of, you know, is it really an issue? 56:43.020 --> 56:44.560 Or isn't it an issue? 56:44.560 --> 56:50.200 And then, you know, working through the remediations and disclosures when those have to happen. 56:50.480 --> 56:55.780 And, you know, likewise, we have found this to be incredibly eye opening. 56:56.120 --> 57:05.560 And, I mean, so much so with the researchers, we've even hired one, which helps us tremendously, particularly in the work that we're doing now. 57:05.560 --> 57:17.760 So I am glad that there's been kind of this breakthrough and that we're seeing, you know, the bridge is being built, and I only think it's going to get better. 57:19.020 --> 57:19.980 Awesome. 57:20.720 --> 57:24.280 Al, what are your closing remarks, closing thoughts? 57:24.280 --> 57:25.500 Okay, hey, Katie. 57:25.640 --> 57:32.360 So kind of echoing across the board, I think the most important thing is one is we have to recognize that the threat is real. 57:32.660 --> 57:36.600 And we should learn from the maritime sector's NoPetya attack. 57:36.600 --> 57:42.420 We shouldn't have to wait until a serious cyber attack of our own on the aviation ecosystem occurs. 57:42.480 --> 57:48.660 And the key to preventing that is to embrace the idea that there's safety in the herd. 57:48.660 --> 58:01.620 You know, we need to strengthen the aviation herd, you know, by continuing to share information, vulnerabilities, and work together to address those vulnerabilities to improve our aviation cybersecurity and resilience. 58:01.620 --> 58:04.840 And so threats real, and there's safety in the herd. 58:06.300 --> 58:07.240 Terribly true. 58:07.240 --> 58:08.120 Very true. 58:08.120 --> 58:18.360 So I guess my closing remarks, then, I will say that the thing that I take away from all of these things is that I go back to coordinated vulnerability disclosure. 58:18.360 --> 58:22.860 And I say that coordinated vulnerability disclosure is an essential part of any security research. 58:22.860 --> 58:29.800 I think that everyone here and everyone that I've met, from varying backgrounds all over the world, everyone has the same goal. 58:29.800 --> 58:31.540 We may not all speak the same language. 58:31.540 --> 58:33.340 We may talk past each other. 58:33.340 --> 58:35.640 But I think ultimately, we have the same goal. 58:35.640 --> 58:37.460 And that goal is protecting the end user. 58:37.460 --> 58:39.660 It's reducing risk and making people safer. 58:39.820 --> 58:53.300 And so I think the last thing that anybody wants is to inadvertently put countless people's lives at risk, economic situation at risk, because we published a roadmap that if that fell into the wrong hands could just wreak havoc. 58:53.640 --> 58:57.920 So I go for coordinated vulnerability disclosure because it really is a balancing act. 58:57.920 --> 59:04.940 It's a process that allows us to mitigate or to balance while we're trying to mitigate. 59:04.940 --> 59:07.560 So that's my closing advice. 59:07.560 --> 59:13.900 I feel like all of the progress that we've made is so wonderful. 59:13.900 --> 59:15.760 We have a long way to go. 59:16.420 --> 59:20.700 I love the fact that we're all talking to each other and we're working together. 59:20.740 --> 59:25.140 But I want to make sure we know that there is a road ahead of us. 59:25.140 --> 59:31.220 That road to me, the future looks bright and I'm excited for it. 59:31.280 --> 59:35.340 So thank you guys for coming to the panel and listening to us. 59:35.340 --> 59:39.300 And if you have any questions, our contact information is up. 59:39.320 --> 59:42.920 I think there's going to be an opportunity for some live chat later at some point. 59:42.920 --> 59:45.700 So you'll be able to find out more information about that. 59:45.700 --> 59:49.220 If you have any questions or want to talk more to us, please feel free to reach out. 59:49.220 --> 59:52.480 I think everyone here would invite a conversation. 59:52.480 --> 59:55.080 It was great talking to everybody today. 01:00:00.460 --> 01:00:01.380 Thank you.