start	end	text
5600	11860	Hello and welcome to Checklist for Aviation Vulnerability Disclosure, Don't Go It Alone.
12240	17060	Before I dive into the talk, I first off would like to thank the Aerospace Village for allowing
17060	22400	me to come speak today. They've been a great partner with CISA over the past year and I
22400	26720	really appreciate them allowing me to come and chat with you for a few minutes.
28180	36080	So, I am with the Cybersecurity Infrastructure Security Agency, commonly referred to as CISA.
36400	44700	You may know us from some of our previous branding such as US CERT, ICS CERT, NCIC, or even NPPD.
44700	49960	All of those functions, brands, and identities have been rolled up into a single agency within
49960	57800	the U.S. Department of Homeland Security. So, what do we do? We essentially function as the
57800	64440	nation's risk advisor. We do national risk management for cyber and physical infrastructure.
66640	75400	So, kind of to break down, how do we do this? We leverage four major program areas. First,
75400	81780	federal network protection. We augment the protection of the .gov web space, infrastructure,
81780	86980	resilience, and field operations. If you're in the U.S., you may have crossed paths one time or
86980	93590	another with our CSAs or PSAs, our cybersecurity advisors and protected security advisors.
94340	100760	And we also have emergency comms. This group supports the COM ISAC and the critical PSF2
100760	106540	function. And most importantly, the final group that I skipped is the comprehensive
106540	112700	cyber protection efforts. This is where I fall among the many functions in this group.
112700	117660	I facilitate the disclosure of industrial control system vulnerabilities.
118920	124960	So, and to kind of sum up all of this part with who I am. So, I am Jay Angus. I'm the federal lead
124960	131660	for the industrial control systems vulnerability disclosure program. Since 2012, we've been
131660	139140	disclosing on average about 700 to 800 industrial control system vulnerabilities per year. And these
139140	146380	vulnerabilities impact vulnerabilities across all 16 critical infrastructure sectors. We try to
146380	152600	provide timely, actionable information to remediate these vulnerabilities in as public a manner as
152600	161480	possible. So, we're going to kind of level set here. We're going to start off with what is a
161480	167280	vulnerability? What do I consider a vulnerability? And I pulled this from the internet engineering
167280	175450	task force. According to them, through their RFC 4949, it's a flaw or weakness in a system's design
175960	181400	implementation for operation and management that could be exploited to violate the system's security
181400	188540	policy. I kind of generalize as a risk that can be exploited by a threat actor such as an attacker
188980	193780	to perform unauthorized actions within an information system.
197170	202890	So, we break this down generally into two different categories from my perspective.
202890	209670	We have our zero days. These are unintentional vulnerabilities. They're risks previously
209670	216530	unknown to anyone and typically require intervention from the vendor for remediation.
216530	223690	Whereas, we also have misconfigured devices. This is intentional or accidental. The risk is
223690	231610	commonly introduced by the asset owner and it requires changes to the configuration on the device
231610	238250	or the architecture surrounding the device. Either way, zero day misconfigured device.
238250	242400	This is dangerous information in the hands of the adversary.
246400	251960	And to continue this level setting, what do we consider a coordinated vulnerability disclosure?
252100	256700	Just to kind of read the slide here, it's an effort to verify that accurate information
256700	262080	is being openly disclosed on a vulnerability so that it can be addressed accordingly.
263220	269600	I kind of use the airplane analogy at times. Much the way a vulnerability is found, a plane takes
269600	276140	off and hopefully they both will make it controlled, safe to sit, you know, back to
276140	284820	whether it's a public disclosure or a receiving airport. My team works to make disclosures of
284820	290740	vulnerability in a safe, controlled manner. There's no guarantee that every disclosure
291660	298660	will be smooth, but as for the aviation sector, as they begin to handle more disclosures,
299600	308420	I think this is going to be much easier. And this will be an issue that we won't be as
308420	315600	concerned about as time and effort continues to grow in this area. So to kind of help
315600	323920	frame this conversation today, the aviation sector loves checklists. It's a very common
324560	332880	approach to managing safety and risk within the sector. And one of these checklists could make,
332880	338000	you know, disclosures easier whether you're a researcher or a vendor. And I kind of wanted
338000	349480	to pull from the form published by the FAA, the FAA Form 7233-4. So if you're a pilot,
349480	354640	you're probably very familiar with this, but it's the pre-flight pilot checklist.
354640	361440	Looks like it collects a lot of information prior to takeoff. And hopefully I won't get
361440	365860	too lost in the jargon here, but I'm going to break some of this down, compare it to
365860	371520	vulnerability disclosure process, and see if we can find some parallels.
374660	379720	So the first thing I noticed that this report is very interested in the weather.
380580	385440	And what does the weather have to do with vulnerability to disclosure?
386400	394120	To me, it has a... appears to have the primary effort to document what the pilot has no control
394120	402460	over, which I found to be ironic. As vulnerability disclosures, there are multiple parties coming
402460	411380	together of significant influence that typically have no control or direct control over each other.
411380	417400	They can certainly cause buffeting of each other during the course of disclosure.
418240	425160	And kind of... so as the researcher starts down the aviation research goal process,
425840	433400	what is their end goal, right? Typically, their findings are focused on safe and more secure
433400	440220	aviation. For the researcher, I cannot stress enough, but know the company that you're dealing
440220	446900	with, as back to the idea that you can't change them. I have no doubt that you know how to
446900	452940	manipulate their products and work with them very aggressively, but know the culture of the company.
452940	457740	Depending on the company, it could be difficult for you to get your report in front of the right
457740	465020	person. And similarly for vendors, you can't control researchers, but you can help guide
465020	472000	them down a safe path so that you both have a controlled disclosure and sharing of information.
472320	476540	And for the vendor, the first step is going to be that vulnerability disclosure policy.
477400	482320	And for vendors and researchers, as I said, you can't change one party or the other,
482320	487380	but you can certainly create opportunities to facilitate a controlled disclosure.
490410	493050	So as we continue down the checklist...
494790	501650	Wins Aloft. So this is the part of the flight that should be the most straightforward. Cruising,
501650	506710	we're cruising. Systems are communicating as intended and parties have acknowledged each
506710	512090	other's presence. The researcher has begun divulging to the vendor their findings and
512090	517810	the vendor is reviewing the information. But we won't be here forever at this altitude.
517810	522750	As the exchange of information progresses, researchers and vendors need to be open about
522750	531190	their intentions and capabilities. Researchers need to be open of what they intend to do
531190	537590	with their disclosure. Maybe they're going to take this to a talk at a conference.
537830	542390	Maybe they're just doing this as an act of goodwill and don't require public acknowledgement,
542390	550330	such as CVEs or press releases. Whatever the case may be, the party should be open about their
550330	556170	tolerance for attention during the process. We want to keep the flight moving, keep the disclosure
556170	564170	moving along as smoothly as possible. To keep this portion of the disclosure smoothly moving,
564170	573810	vendors need to be more open about their product development life cycle,
573810	580290	offer up realistic timelines for remediation. Simply ignoring the researcher first off doesn't
580290	586310	buy you more time and at times can make the researcher make a less informed decision about
586310	593390	how they want to proceed in a disclosure. Sometimes we don't need to dive into long
593390	602630	protracted timeline for disclosures. And we kind of want to break that down a little bit
602630	610510	into two different types of disclosures here. So for misconfigured devices, frequently focus
611380	616550	on leaving the information with the vendor and a lot of times the asset owner under the
616550	622110	expectation they'll remediate the finding. It's likely this type of disclosure, straightforward,
622110	630170	relatively quick to resolve, and there's no space for a CVE assignment. But that being said,
630170	634810	if you are having trouble getting someone's attention, we can help it sizzle with that
634810	639610	and making sure that the information is put in front of the right person and I'll have my contact
639610	647590	info later for that kind of disclosure. And then so second, the other type of disclosure we're
647590	655170	seeing for zero days, you can expect that kind of a long protracted disclosure timeline for these.
655490	662610	We've seen anywhere from 45 days for a typical IT vulnerability and at times to a couple of years
662610	668810	for operational technology. Try to find a happy medium here. Researchers should acknowledge the
668810	674550	amount of time that they spent finding the vulnerability and expect lag and remediation
674550	681150	from the vendor. It's particularly for aviation systems as they have a much longer remediation
681150	687890	process. A quote I hear sometimes from the aviation sector is it costs a million dollars
687890	695210	to update a line of code. Whether or not that's true, recognize there's great efforts that could
695210	705650	be required to remediate a vulnerability. So here we are. I think one of my more important
705650	713310	points for this discussion today, who are you working with? So first off, I'll go ahead and
713310	720170	list my favorite option, CISA. Our ICS vulnerability disclosure program has been in place for eight
720170	726090	years now and we've assisted with disclosure of thousands of vulnerabilities across all critical
726090	733850	infrastructure sectors. Most importantly, as a CNA, we can assign CVEs to new vulnerabilities,
733850	740610	assuming it's within scope, and doing so will assist with better identifying vulnerabilities
740610	747810	in the future. So, and I've listed multiple entities here. All of these entities are more
747810	754050	than happy to work with researchers and I've seen them do so in good, definitely good faith.
754490	761450	But, and for vendors, who are you working with? It's important that you have a relationship with
761450	767090	the national search. You want to have that relationship ahead of time. And especially
767090	771550	if you have a product security team, that they're in a perfect position to be building
772170	779650	those contacts and reaching out to these, the national search to build the relationships in
779650	787870	advance. So, and also we can kind of talk about here, when should an additional party be brought
787870	795130	in to assist with a disclosure? And I definitely believe for all disclosures, anytime it's crossing
795130	801250	international boundaries, I think it's, that's a great time to engage an external third party
801250	807230	to assist with communicating with other entities and making sure your information is put in front
807230	815290	of the right group. And, and the other situation, obviously for this discussion, aviation disclosures
815290	821310	should always have a trusted third party involved. I think these third parties add some oversight
821850	827410	and an additional party to make sure that the correct stakeholders and asset owners are being
827410	840110	notified. So, hopefully as we discussed earlier, we've kind of talked around the factors. What does
840390	846450	a landing look like for an aviation disclosure? Researchers, from my experience, want to
846450	853670	acknowledge, want to be acknowledged publicly, privately, and want to see a fix for a
853670	861810	vulnerability. At times it is just that simple, especially for misconfigured devices.
861810	866990	Many times vendors struggle with their own bureaucracy and lose valuable time arguing
866990	873430	points of a disclosure rather than focusing on remediation. My opinion is we do not see
873430	879150	enough aviation specific vulnerabilities with CVEs being assigned. While I can appreciate the
879150	884590	sensitivity of the sector, that this quiet disclosure process can create digital debt
884590	890690	that can come due over and over again as more researchers enter the sector and continue to have
890690	900090	similar findings. While the quiet disclosure is a useful alternative, it will come with
900090	914770	consequences over time. So, airspace restrictions. Make sure you're clear to do the work that you're
914770	922230	doing. This should go without saying. Please, please do not do cyber security research against
922450	929170	a system that is not yours or you do not have clear written permission to have access to.
929190	934310	If you have a question about the legality of your work here in the U.S., I encourage you to
934310	942450	check out the DMCA. There is space for cyber security research specific to aviation devices.
943030	952850	You just, it needs to be in your possession, in your property. To be clear, while I do work
952850	958550	for DHS, I am not law enforcement or sector regulator. I can't put anyone in jail and I
958550	964290	certainly can't force anyone to fix a vulnerability. That said, as a federal employee, I do have
964430	970990	a certain obligation to report suspected crimes. Remember, I can definitely help researchers amplify
970990	976370	their messaging around a vulnerability and I have a team of really awesome vulnerability assessors
976370	982110	that can assist vendors with researchers, assist vendors and researchers in describing
982110	987470	the vulnerability and suggesting mitigation strategies. But I have to have that information
987470	993810	put out in front of me and it has to be in a very legitimate, legal format.
997000	1003840	So as I'm trying to sum this up, don't go it alone. I think that's one of the most important
1003840	1011380	parts here. Be prepared beyond the vulnerability. So many times I've seen researchers that know
1011380	1016560	systems better than the manufacturer, but the researcher is completely unprepared to acknowledge
1016560	1024480	that they're working with a business that operates nine to five. Vendors, I can't help but push this
1024480	1031000	message over and over again. You've got to have a public vulnerability disclosure policy. It makes
1031000	1037280	it easier for researchers and vulnerability coordinators to put information in front of you.
1037700	1045580	If you have a public policy, make sure you have an internal policy and staffing to support it.
1046340	1049900	You need a team to manage these types of risks.
1050160	1054880	It's great that you want to take responsibility, but you must have accountability for these
1054880	1062380	processes. And for both parties, be honest about timelines. I know it's hard. You can't take this
1062380	1075190	process personal. One item that I'd like to see more of is I think tabletop exercises specific
1075190	1080590	to your organization's business model are important. They can help identify responsible
1080590	1085810	personnel and develop policy in advance of a disclosure. And a great way to
1087710	1093430	create a scenario that's more realistic is to maybe bring in a researcher that you've worked
1093430	1100450	with in the past. They probably have experience doing disclosures in a way that could be difficult
1101070	1104750	for their experience. And bringing them in and seeing their expertise
1104750	1109070	would be a huge opportunity for your organization to grow.
1110750	1114790	So researchers and vendors, while you're working together,
1114790	1119430	you need to be honest, again, about these timelines and plans for vulnerability.
1120030	1124510	I really don't enjoy seeing researchers dropping zero days to the internet,
1124510	1128870	especially in the aviation sector, without a reasonable attempt to contact the company.
1130610	1136670	But, you know, that just really doesn't build trust between the two parties in the long
1136670	1141970	run. And I don't believe that it serves the greater good. And the same goes for vendors
1141970	1148190	ignoring researchers. The lack of engagement doesn't build trust and at times causes these
1149570	1158230	uncontrolled disclosures to happen. Finally, have a plan tailored to your goals,
1158230	1164030	vendor or researcher. Both parties in this disclosure should have a plan in place for
1164030	1170610	the disclosure. And as always, CISA is here to help. We have a great deal of experience with
1170610	1178630	this. We partner regularly with SEI, CERT CC. We have direct access to the FAA. We've partnered
1178630	1185150	with the Aviation ISAC. We also have our ACI program to support with disclosures.
1186910	1193790	So, if you have questions about disclosures, here's my contact information. Feel free to
1193790	1201970	send me an email and I will be in the chat box here after the presentation answering some
1201970	1208310	questions. If you have anything, I'd love to support your disclosures. Thank you.