1
00:00:03,420 --> 00:00:09,240
... aerospace systems, a changing paradigm and how you can help.

2
00:00:10,100 --> 00:00:14,260
First, let me quickly introduce you to our presenters from TALIS.

3
00:00:14,260 --> 00:00:21,420
We have Yannick LeRae, Head of Pre-Sales and International Development for Cybersecurity Consulting and Operations.

4
00:00:21,560 --> 00:00:28,700
We also have Lawrence Rowell, who is the Director of Product Cybersecurity for our Connected Cabin and In-Flight Entertainment Systems.

5
00:00:28,700 --> 00:00:36,420
And finally, we have Natalie Faith, who is Chief Information and Product Security Officer for Global Avionics Systems.

6
00:00:37,520 --> 00:00:52,020
The focus of today's session is to show how industry design, attack, learn, and improve critical aerospace systems to cybersecure avionics, passenger systems, and air traffic management systems.

7
00:00:52,020 --> 00:00:58,000
First, we will speak to the changing requirements and what digital transformation has done for cybersecurity.

8
00:00:58,580 --> 00:01:04,880
Then, we will explain our paradigm shift with respect to the design of our systems.

9
00:01:04,980 --> 00:01:11,380
And finally, we will talk about how we integrate good faith hacking and create a chain of trust.

10
00:01:11,960 --> 00:01:16,820
So, let's start with Yannick to talk about digital transformation and cybersecurity.

11
00:01:17,200 --> 00:01:18,440
Yannick, over to you.

12
00:01:18,440 --> 00:01:20,180
Thank you, Adam.

13
00:01:20,180 --> 00:01:22,900
We wish we would be there physically.

14
00:01:22,900 --> 00:01:27,700
However, due to COVID-19, we're having this virtual presentation.

15
00:01:27,700 --> 00:01:33,960
Hopefully, we'll be there all together next year for the next DEF CON.

16
00:01:33,960 --> 00:01:36,920
So now, let's talk about digital transformation and cybersecurity.

17
00:01:37,140 --> 00:01:41,220
Today, aviation sector is leading to digital transformation.

18
00:01:41,220 --> 00:01:48,400
This playground represents an international and complex ecosystem with a wide threat surface exposure for attackers.

19
00:01:48,560 --> 00:01:53,280
As you can see in this slide, there are many targets to be protected.

20
00:01:53,760 --> 00:01:59,520
And some of them, we can talk about the air traffic control and air navigation systems.

21
00:01:59,620 --> 00:02:07,500
We can talk about the connected aircraft, the airport, the airline maintenance control center, as well as the UAVs and drones.

22
00:02:07,500 --> 00:02:12,940
These targets are associated with multiple risks and have risk exposure.

23
00:02:12,940 --> 00:02:20,280
And therefore, we need to be coherent and with a global approach to better understand and reduce the risk.

24
00:02:22,950 --> 00:02:30,430
As I said previously, aeronautics environment is leading to digital transformation with an open and connected world.

25
00:02:30,430 --> 00:02:35,970
Digital transformation leads to data-driven organization and therefore cybersecurity.

26
00:02:35,970 --> 00:02:40,250
Knowing that, for aeronautics, safety is the first priority.

27
00:02:40,250 --> 00:02:48,630
We must secure stakeholders' trust as well as safety-critical aeronautics system putting the passenger as our first priority.

28
00:02:48,630 --> 00:02:50,830
No digital transformation without trust.

29
00:02:50,830 --> 00:02:52,810
No trust without cybersecurity.

30
00:02:53,430 --> 00:02:58,260
This connected environment raises two challenges for aerospace ecosystem.

31
00:02:58,260 --> 00:03:09,760
First, safety and security stake, requiring to keep up in a safety environment, setting up cybersecurity conditions across all system lifecycle.

32
00:03:10,000 --> 00:03:17,440
And second, business continuity, needing to value cybersecurity to help prevent business operational disruptions.

33
00:03:17,440 --> 00:03:20,540
Now, let's talk about the hackers in this environment.

34
00:03:20,780 --> 00:03:24,620
We're going to talk about ethical, good-faith hackers.

35
00:03:25,360 --> 00:03:28,780
We aim to provide the best possible practices.

36
00:03:29,580 --> 00:03:36,820
And we want to make sure our solutions and services as well as our customers' infrastructures are cyber-secure.

37
00:03:36,900 --> 00:03:43,700
And therefore, we perform, for example, risk analysis and pen test using our own hackers.

38
00:03:43,700 --> 00:03:48,800
And for sure, we're talking about ethical hackers and ethical-talent hackers.

39
00:03:48,800 --> 00:03:51,380
These hackers can act through the Internet.

40
00:03:51,380 --> 00:04:04,280
For example, from one of our air navigation service provider customer, we've been able through some services that we provided to them through a contract.

41
00:04:04,280 --> 00:04:08,840
We've been able to penetrate their power generation systems.

42
00:04:08,840 --> 00:04:19,420
And this was enabling us to go into their server, which turned on and off the whole air traffic center.

43
00:04:19,420 --> 00:04:29,540
All this through our own facilities in France, going in their own air traffic control, where it was not for sure in France.

44
00:04:29,580 --> 00:04:35,540
And other tools that we have are specific simulation environments.

45
00:04:35,540 --> 00:04:40,040
As you can see in this slide, we have the red team versus the blue team.

46
00:04:40,040 --> 00:04:54,860
With our simulation environments, we're able to implement the infrastructure of our customer, their operational infrastructure, where the red team is our own hackers, which mission is to, of course, attack the vulnerabilities of the system.

47
00:04:54,860 --> 00:04:57,020
And the blue team is our customers.

48
00:04:57,020 --> 00:05:05,180
Our customers in this environment are there to be trained and see if they are cyber secure.

49
00:05:05,180 --> 00:05:07,480
Also, their system is cyber secure.

50
00:05:07,480 --> 00:05:13,140
More and more, we need ethical hackers able to master specific sector expertise.

51
00:05:13,460 --> 00:05:16,100
This sector expertise is very specific.

52
00:05:16,100 --> 00:05:18,420
We're not talking about only ISIT.

53
00:05:18,420 --> 00:05:21,420
We're talking about operational technologies.

54
00:05:21,420 --> 00:05:35,880
More and more, we're facing attackers who are aiming at this type of equipment and trying to be more and more specific to their attacking.

55
00:05:35,880 --> 00:05:41,320
And I know the floor to Lawrence will develop more on what we do in terms of avionics.

56
00:05:41,320 --> 00:05:42,180
Lawrence?

57
00:05:42,540 --> 00:05:43,780
Thanks, Yannick.

58
00:05:43,780 --> 00:05:52,500
Okay, so when we're talking about this changing paradigm, it's really important to understand the current and historical state of affairs.

59
00:05:52,640 --> 00:05:57,620
In other words, how has security been managed to this point and why?

60
00:05:57,620 --> 00:06:02,080
And then we're also going to talk about what is changing to drive the new paradigm.

61
00:06:02,680 --> 00:06:09,140
So at TALIS, the high-level approach to cybersecurity is defined by nine cybersecurity rules.

62
00:06:09,140 --> 00:06:16,160
One of the rules is really important to this audience in this conversation because it speaks directly to penetration testing.

63
00:06:17,280 --> 00:06:33,340
Oftentimes, we use a gray box approach with third-party pen testers and we give them a limited amount of information so they have some understanding about the system components and overall architecture and they can test all the threat vectors.

64
00:06:33,840 --> 00:06:48,300
This is good and it's a great start considering where we are today, but it also serves as a very good example of a security practice that does not really reach its full potential.

65
00:06:49,320 --> 00:06:56,740
The model I just described is performed by a limited number of people for a limited amount of time.

66
00:06:57,480 --> 00:07:12,740
They also only have a limited amount of information and it's done in a closed environment that is not really remotely accessible due to policy and other technical limitations today.

67
00:07:12,740 --> 00:07:29,920
This approach does not really leverage the full power of the good faith hacking community and ultimately, it results in what can only be called as a limited snapshot into a product's security posture.

68
00:07:31,320 --> 00:07:40,940
And we must admit the culture of aerospace and aviation has really kind of contributed to this approach that we have today.

69
00:07:42,160 --> 00:07:47,080
Vulnerability management in aerospace and aviation is pretty difficult.

70
00:07:47,360 --> 00:07:51,760
Updating the product, in most cases, is not easy.

71
00:07:51,840 --> 00:07:57,400
And this is even true for the non-safety critical part of the aircraft.

72
00:07:57,500 --> 00:08:09,680
It usually takes a lot of time, a lot of money, and usually a lot of lost revenue to update the system, the aircraft systems.

73
00:08:11,460 --> 00:08:16,360
Historically, this has kind of contributed to a closed type of thinking.

74
00:08:16,540 --> 00:08:25,580
You know, along the lines of, hey, if we don't look hard enough, we'll never find anything and therefore we must not have a problem.

75
00:08:26,360 --> 00:08:32,160
The good news is that this mentality, we're seeing a change with this.

76
00:08:32,160 --> 00:08:45,410
In a recent Atlantic Council survey, 84% of aviation professionals that were polled indicated that cybersecurity researchers are good for aviation.

77
00:08:45,740 --> 00:08:50,460
So, now is the time for the industry to improve.

78
00:08:50,460 --> 00:08:52,400
And we can do better.

79
00:08:52,400 --> 00:09:02,800
But first, it's important to understand the factors that are driving this shift in thinking before we try to answer the question of how we do better.

80
00:09:05,670 --> 00:09:10,550
Let's use the cabin of today's commercial aircraft as an example.

81
00:09:10,550 --> 00:09:14,910
It makes sense to look here first for a couple of reasons.

82
00:09:15,150 --> 00:09:18,890
This portion of the aircraft is not deemed safety critical.

83
00:09:19,530 --> 00:09:31,290
Therefore, it lends itself to the fastest changes and is going through a rapid evolution in terms of the technologies and systems deployed to satisfy the airline customer.

84
00:09:31,750 --> 00:09:41,670
This means this area of aviation will embrace the good faith hacking community the fastest and with relative ease.

85
00:09:41,670 --> 00:09:46,090
And it will likely influence other areas of aviation.

86
00:09:46,770 --> 00:09:52,610
So, everyone knows the majority of commercial aircraft are connected to the internet.

87
00:09:52,610 --> 00:09:56,110
Wi-Fi is viewed as critical for today's passenger.

88
00:09:56,550 --> 00:10:05,130
There are also several other changes that are bringing the comforts of the living room into the cabin in today's passenger.

89
00:10:05,790 --> 00:10:10,510
So, if we take a look at the inflight entertainment system, it's a really good example.

90
00:10:10,810 --> 00:10:14,010
It's becoming much more complex in several ways.

91
00:10:14,970 --> 00:10:21,810
There's an increasing selection of movies and other entertainment content that has not been released to the public.

92
00:10:21,810 --> 00:10:26,050
This requires protection and ongoing security testing.

93
00:10:26,050 --> 00:10:30,510
There's a large influx of third-party applications and games.

94
00:10:30,510 --> 00:10:37,470
And these are games that are not from the Apple App Store or Google Play and have been validated by Apple and Google.

95
00:10:37,470 --> 00:10:40,970
These require ongoing security testing as well.

96
00:10:42,030 --> 00:10:46,930
E-commerce and shopping options are constantly expanding.

97
00:10:46,930 --> 00:10:52,670
Along with more convenient ways to pay for your goods and services.

98
00:10:53,430 --> 00:10:58,210
And this includes the introduction of technologies like near-field communication.

99
00:10:58,670 --> 00:11:02,170
The amount of personal information is increasing.

100
00:11:02,170 --> 00:11:06,090
With airlines providing a much more personalized service.

101
00:11:06,090 --> 00:11:08,890
With more convenient payment systems.

102
00:11:08,890 --> 00:11:18,190
And this also includes the introduction of advertising that is targeted to specific passengers with their demographic information.

103
00:11:18,190 --> 00:11:27,210
In order to support all of this, the number of interfaces on the aircraft that are accessible by the passenger from their seat is increasing.

104
00:11:27,330 --> 00:11:34,710
This includes things like USB, Bluetooth, touchscreen, near-field communication, and Wi-Fi.

105
00:11:34,710 --> 00:11:38,910
Now consider this is only part of the overall equation.

106
00:11:41,980 --> 00:11:50,920
All of these solutions I just described to support e-commerce, entertainment, and personalization are supported by a constantly expanding ground infrastructure.

107
00:11:51,260 --> 00:11:56,060
And this ground infrastructure, it has similar cybersecurity risks.

108
00:11:56,060 --> 00:12:00,900
It's exposed to the same regulatory requirements like PCI and GDPR.

109
00:12:01,260 --> 00:12:03,440
But there's a big difference.

110
00:12:03,440 --> 00:12:08,680
These environments look and feel much more like a traditional IT environment.

111
00:12:09,780 --> 00:12:20,820
So, one positive aspect of this is that IT-oriented DevOps teams have already started to embrace practices like crowdsourced pen testing.

112
00:12:21,580 --> 00:12:31,520
So, in the case of aviation and aerospace, this will be a force that will drive the overall industry towards engaging the GoodFaith hacking community.

113
00:12:32,620 --> 00:12:41,340
So, before I finish, there's one last thing I'd like to mention about how we are seeing COVID, the COVID pandemic, impact this paradigm shift.

114
00:12:42,080 --> 00:12:51,680
Third-party pen testers who were previously required to be on premise to pen test certain products and solutions cannot travel and be on site to do this.

115
00:12:51,680 --> 00:12:54,340
Yet, the pen testing still must be conducted.

116
00:12:55,330 --> 00:13:06,500
So, we are seeing companies quickly adapting, changing their policies and methods to do remote pen testing whenever possible.

117
00:13:06,500 --> 00:13:13,600
Obviously, this is going to be a challenge when it comes to systems and products with physical interfaces.

118
00:13:13,820 --> 00:13:18,080
But we still see a rapid evolution coming in this area.

119
00:13:18,080 --> 00:13:25,360
So, COVID is actually knocking down some of the previous barriers when it comes to embracing the GoodFaith hacking community.

120
00:13:25,680 --> 00:13:34,260
To summarize, these changes have increased the number of assets that need protection while also increasing the number of threat vectors.

121
00:13:34,340 --> 00:13:42,760
At the same time, we see the aviation community's attitude and view on embracing the GoodFaith hacker is changing.

122
00:13:42,760 --> 00:13:45,520
This means now is the time to do this.

123
00:13:45,520 --> 00:13:51,620
It's time to embrace the GoodFaith hacking community and look at changing the traditional approach to cybersecurity.

124
00:13:52,660 --> 00:13:59,600
Now, I'll hand it over to Nathalie to talk about how we can do this in collaboration with the GoodFaith hacking community.

125
00:14:00,340 --> 00:14:01,860
Thank you, Laurent.

126
00:14:02,180 --> 00:14:03,380
You're right.

127
00:14:03,420 --> 00:14:09,900
We need to see more on how to integrate those hacking activities in our engineering and operations.

128
00:14:09,900 --> 00:14:18,020
So, I will use the NIST framework, which is what we are following, to explain our constraints about that.

129
00:14:18,260 --> 00:14:26,400
So, when we discuss with Laurent on when in this cycle it will be easiest to integrate GoodFaith hackers.

130
00:14:27,400 --> 00:14:36,640
During the identify and protect phase, it's more where we do risk assessments, not the theoretical part, not that easy.

131
00:14:36,640 --> 00:14:46,580
But definitely during the design phase, it's important, and more naturally into the in-service phase.

132
00:14:46,620 --> 00:14:53,420
So, those two phases, the during design phase and in-service phase, seems natural to me.

133
00:14:54,380 --> 00:15:01,240
Today, it's obviously during in-service that we have already interactions with hackers.

134
00:15:01,240 --> 00:15:08,560
I will tell a little story about a CV that has been published on the Thales Cabin product.

135
00:15:09,340 --> 00:15:22,120
And we all know that there is room for improvement in this area to render this interaction more fruitful and this dialogue more fruitful between industry and hackers.

136
00:15:22,120 --> 00:15:25,020
We will discuss that afterwards.

137
00:15:25,020 --> 00:15:30,240
Now, I would like definitely to focus on the during design phase.

138
00:15:30,240 --> 00:15:31,300
Why?

139
00:15:31,300 --> 00:15:37,840
Simply because for us, it's where it is the easiest to patch and to remediate.

140
00:15:38,160 --> 00:15:48,540
And this is also the good place where we can confront the theory of the attack path that we imagine with the real practice with hackers.

141
00:15:48,620 --> 00:15:51,680
And have the good coverage about it.

142
00:15:51,680 --> 00:16:02,580
And the most we spend time on cyber robustness, the most we are saving also money, to be honest, in the operational phase and in the in-service phase.

143
00:16:02,900 --> 00:16:11,620
So now, when we think about how we can manage this during design phase, it's not easy.

144
00:16:11,620 --> 00:16:24,900
Today, I have no example of our airborne system being virtualized and put in a cloud and accessible through a web portal for you to do pen tests.

145
00:16:24,980 --> 00:16:33,360
As explained by Lawrence, we are performing our own pen tests directly in our labs.

146
00:16:33,360 --> 00:16:36,740
So you need to imagine fully representative labs.

147
00:16:36,740 --> 00:16:47,940
For example, Cabin, you have an instance of the economy class, first class, business class, and it's big halls run by us.

148
00:16:47,940 --> 00:16:55,180
And they are running 24 hours a day and 356 days a year.

149
00:16:55,180 --> 00:17:11,520
So you can imagine how it's not easy to organize a pen test sequence in such labs, which are used to improve our product and ensure customer new functionalities.

150
00:17:12,620 --> 00:17:37,640
So, to be clear, there is also, due to the fact we are on special technology, if you want to get good-faith hackers working with us, for example, through a bug bounty program, then there is an investment to be done on hacker side, because you need to enter into specific technology dedicated for aviation.

151
00:17:37,660 --> 00:17:40,500
For example, we don't have Ethernet.

152
00:17:40,500 --> 00:17:43,860
We have AFDX, which is a rank 664.

153
00:17:44,860 --> 00:17:48,320
This is Ethernet-oriented for safety.

154
00:17:48,320 --> 00:17:54,130
And there are lots of examples of that on protocols, on operating systems.

155
00:17:54,420 --> 00:18:00,300
And this is driven by safety-related requirements.

156
00:18:00,300 --> 00:18:22,290
So when we discussed about bug bounty company on how to organize better interactions with good-faith hackers, they mentioned to us they have already this kind of program for ICT suppliers or, for example, automotive system providers.

157
00:18:23,250 --> 00:18:39,430
But with the change in paradigm, as mentioned by Lawrence, I think that we are now moving to virtualized simulation benches and labs, more connected simulation benches and labs.

158
00:18:39,510 --> 00:18:47,590
And this is a kind of cyber train, and I think it's promising.

159
00:18:47,590 --> 00:19:02,070
For ground system and ground infrastructure, we just need to follow what is a good practice in other sectors, since they are more IT-related, and we can easily move to classical bug bounty programs.

160
00:19:02,070 --> 00:19:10,110
So to summarize on how we can work together during the design phase, I think there are two tracks we can work on.

161
00:19:10,110 --> 00:19:18,010
The first one is dedicated bug bounty programs, where you come to our big halls and labs.

162
00:19:18,010 --> 00:19:42,150
And the second would be more to develop, and it is more on our shoulder, cyber twins, which are helping for doing those patents and perhaps being more agile, doing it more often, and with better coverage, and not one or two persons during some days or weeks.

163
00:19:42,890 --> 00:19:45,110
So okay, I hope it's clear.

164
00:19:45,210 --> 00:19:52,650
Now we'll go for the second phase, which is the in-service phase, to explore what we can do.

165
00:19:52,650 --> 00:19:55,790
So here, this is another story.

166
00:19:56,170 --> 00:19:59,550
You see the title, we call that managing continuous security.

167
00:19:59,550 --> 00:20:12,530
It's not for you, it's for our customers, for them to understand that security is a long road where you need to update regularly due to the fact that new attacks are coming.

168
00:20:13,170 --> 00:20:18,810
And in the in-service phase, the NIST framework is beginning by the detect.

169
00:20:18,810 --> 00:20:33,950
This detection comes to us either through our customer services, which is seeing an incident reported by a customer, or this might be an event found on the internet.

170
00:20:33,950 --> 00:20:54,170
You know, we have a threat intelligence team and services like that, that help us in graphing kind of videos that may be published by hackers, but also more in a standard way, CV, that could be published on our products.

171
00:20:54,550 --> 00:20:58,330
So to explain what are the issues today, I will give you an example.

172
00:20:58,330 --> 00:20:59,810
I think it's the best.

173
00:20:59,810 --> 00:21:05,250
It was a story that happened to us, I think, last year.

174
00:21:05,710 --> 00:21:13,190
And in fact, it was a CV published with a high score of 8, which is high specificity.

175
00:21:13,190 --> 00:21:17,070
The CVSS is between 1 and 10.

176
00:21:17,610 --> 00:21:23,090
And so it was on the in-flight entertainment systems.

177
00:21:23,090 --> 00:21:32,990
So first of all, I would like to recall that in-flight entertainment systems are non-critical systems if we consider safety.

178
00:21:32,990 --> 00:21:36,370
So this rating is a bit high.

179
00:21:36,670 --> 00:21:50,090
And when our incident response team, our PSIRT, investigated about that, they learned that, in fact, it was a vulnerability exploited on a third-party chat application.

180
00:21:50,430 --> 00:22:03,490
And in fact, the impact was just you at your seat hacking the chat application, crashing, and not propagating to any other seats, just stand alone on the seat.

181
00:22:03,490 --> 00:22:12,350
So it was a bit surprising to us that Mitre, even Mitre, has ranked this vulnerability at a level of 8.

182
00:22:12,350 --> 00:22:22,790
But finally, we get in touch with the hacker, we had a discussion, and we say that this CVSS score was far too high.

183
00:22:23,450 --> 00:22:40,150
And so when you see such a situation, and we generalize it, so from the case like that, what are the drawbacks in such a way of managing vulnerability disclosure?

184
00:22:40,150 --> 00:22:47,790
So today, there is no direct notification to our incident response team, product incident response team.

185
00:22:48,610 --> 00:23:00,110
So as a consequence, there might be a very long time, more than two weeks, before we get in touch really with the good-faith hacker and understand.

186
00:23:00,110 --> 00:23:11,170
And also, as this is illustrated here, our sector is not really understood today.

187
00:23:11,350 --> 00:23:14,110
You have seen the high rating by Mitre.

188
00:23:14,150 --> 00:23:18,690
So we need to have this kind of education.

189
00:23:19,130 --> 00:23:29,510
And hopefully, there are major airlines, and so they are kind enough, since they are doing their own risk assessments, to tune the level of patching.

190
00:23:29,510 --> 00:23:53,710
But if it wouldn't have been the case in this story we had, imagine you need to know the exact configuration, product configuration, which aircraft, replace the exploit on our big labs, find the source code, develop the patch, then again test in the big labs.

191
00:23:53,710 --> 00:23:54,870
And it's not finished.

192
00:23:54,870 --> 00:24:12,210
You need to go to a real aircraft to obtain what is called the field supplier acceptance tense, which is provided by the airline for them to deploy the patch by ensuring it has no secondary effects on the system.

193
00:24:12,590 --> 00:24:19,810
And believe me, the best we did for this type of operation was something like three weeks.

194
00:24:19,810 --> 00:24:40,730
And even today, there are some patches that we delivered, something like more than one year, that are not yet deployed by some airlines, because it's a long process to deploy on all fleets a patch, and knowing that some aircraft are under maintenance and things like that.

195
00:24:40,950 --> 00:24:49,090
So what I would like to have in the future, in a better disclosure program, would be the following.

196
00:24:49,090 --> 00:24:53,830
First, establishing direct exchange with the good face hacker.

197
00:24:53,830 --> 00:24:59,250
I think it's really important for us to understand and for the hacker to understand also better.

198
00:24:59,470 --> 00:25:17,530
Then, establishing clear remediation time and steps before going to publication, because depending on what has been found and what it is impacting, you understand that we don't have the same constraints than in the IT world.

199
00:25:17,530 --> 00:25:20,210
So we need more time in some cases.

200
00:25:20,710 --> 00:25:33,890
So now, if it's better that way, you would say, okay, if I have a vulnerability to disclose, what are my possibilities today and how can I interact with you?

201
00:25:34,270 --> 00:25:43,810
So this is why we have set up first for the whole ecosystem, sharing information capacities.

202
00:25:43,810 --> 00:25:51,270
When I say the whole ecosystem, I mean airport, airlines, aircraft manufacturers, suppliers.

203
00:25:51,810 --> 00:25:55,870
We have very few maintenance operators, but it's becoming.

204
00:25:56,010 --> 00:26:00,770
It has been set up, the first one, more than four years ago.

205
00:26:01,250 --> 00:26:05,990
So now, what are the ones you can use?

206
00:26:05,990 --> 00:26:09,170
I would advise Aviation Isaac.

207
00:26:09,170 --> 00:26:17,910
Aviation Isaac is an aviation information sharing community and they are providing support.

208
00:26:17,910 --> 00:26:26,490
They have incident response capacity to facilitate the interactions between the hacker community and the industry.

209
00:26:27,030 --> 00:26:32,310
So it's a good point for you if you need.

210
00:26:32,310 --> 00:26:36,090
Now, a second one, particularly in Europe, is EXA.

211
00:26:36,090 --> 00:26:39,610
It's European Centre for Cyber Security in Aviation.

212
00:26:39,610 --> 00:26:48,670
So they don't have an incident response capacity, but last year for DEFCON, for aerospace delayed, they were okay.

213
00:26:48,670 --> 00:26:56,370
So they set up a portal for you to enter the different subjects you would like to discuss.

214
00:26:56,370 --> 00:27:07,510
And not telling the details, but tell, I don't know, I have something to say about an airport or something to say about a system, an airborne system.

215
00:27:07,510 --> 00:27:18,750
And then they are putting you through the good stakeholders that are referenced at EXA, which is important also.

216
00:27:18,910 --> 00:27:23,690
So I hope it helps and it will be easier for you now.

217
00:27:27,870 --> 00:27:45,540
So to recap, on Thales' side, we are definitely considering that with the changing paradigm, we need to set up plans to embed good-faith hackers in our design and operation phase.

218
00:27:45,540 --> 00:27:49,860
And to do this with a win-win situation for both sides.

219
00:27:50,710 --> 00:28:00,080
To tell you, to be honest, without this COVID crisis, we have scheduled with Lawrence to come to DEFCON.

220
00:28:01,040 --> 00:28:09,020
What was scheduled is to bring to you a mini-lab representative of an in-flight entertainment system.

221
00:28:09,740 --> 00:28:13,090
One of our latest generation.

222
00:28:13,540 --> 00:28:17,240
So that you can have a hands-on exercise on it.

223
00:28:17,240 --> 00:28:20,620
And also you can learn and try.

224
00:28:21,720 --> 00:28:25,560
So now we have done this webinar.

225
00:28:25,560 --> 00:28:32,480
This webinar is there to explain what we do, what are our constraints and challenges.

226
00:28:32,480 --> 00:28:42,980
And you have heard Yannick telling how the aircraft is a part of the whole ecosystem.

227
00:28:42,980 --> 00:28:48,860
And there is not only aircraft to consider, but all the rest of the ecosystems.

228
00:28:49,380 --> 00:28:52,880
Lawrence has explained how is the changing paradigm.

229
00:28:52,880 --> 00:28:56,720
How the paradigm is changing, particularly post-COVID.

230
00:28:56,820 --> 00:29:01,700
With the need of our pen tests to be done in a distant way.

231
00:29:02,900 --> 00:29:12,160
And I've shared my views on how we are seeing the integration of good-faith hackers in our design.

232
00:29:12,160 --> 00:29:20,700
And how to improve the vulnerability disclosure for you, for us and for our industry.

233
00:29:20,700 --> 00:29:27,600
So I'm sure that good-faith hackers can be part of the chain of trust in aviation.

234
00:29:27,600 --> 00:29:34,260
And we need to keep in mind that we are talking about a safety-critical system.

235
00:29:35,140 --> 00:29:45,400
So now I will tell you that if we want to get in touch with us, we have a dedicated address.

236
00:29:45,400 --> 00:29:47,580
You can see it on the screen.

237
00:29:47,700 --> 00:29:48,780
So it's short.

238
00:29:48,780 --> 00:29:51,240
I mean it's products, security and citizens' response.

239
00:29:51,240 --> 00:29:55,280
So it's really dedicated to what we are delivering.

240
00:29:55,980 --> 00:29:58,120
I hope it helps again.

241
00:29:58,140 --> 00:29:59,840
So thank you for your attention.

242
00:29:59,840 --> 00:30:02,340
And now I let you the floor for the questions.