start	end	text
3420	9240	... aerospace systems, a changing paradigm and how you can help.
10100	14260	First, let me quickly introduce you to our presenters from TALIS.
14260	21420	We have Yannick LeRae, Head of Pre-Sales and International Development for Cybersecurity Consulting and Operations.
21560	28700	We also have Lawrence Rowell, who is the Director of Product Cybersecurity for our Connected Cabin and In-Flight Entertainment Systems.
28700	36420	And finally, we have Natalie Faith, who is Chief Information and Product Security Officer for Global Avionics Systems.
37520	52020	The focus of today's session is to show how industry design, attack, learn, and improve critical aerospace systems to cybersecure avionics, passenger systems, and air traffic management systems.
52020	58000	First, we will speak to the changing requirements and what digital transformation has done for cybersecurity.
58580	64880	Then, we will explain our paradigm shift with respect to the design of our systems.
64980	71380	And finally, we will talk about how we integrate good faith hacking and create a chain of trust.
71960	76820	So, let's start with Yannick to talk about digital transformation and cybersecurity.
77200	78440	Yannick, over to you.
78440	87700	Thank you, Adam. We wish we would be there physically. However, due to COVID-19, we're having this virtual presentation.
87700	93960	Hopefully, we'll be there all together next year for the next DEF CON.
93960	96920	So now, let's talk about digital transformation and cybersecurity.
97140	101220	Today, aviation sector is leading to digital transformation.
101220	108400	This playground represents an international and complex ecosystem with a wide threat surface exposure for attackers.
108560	113280	As you can see in this slide, there are many targets to be protected.
113760	119520	And some of them, we can talk about the air traffic control and air navigation systems.
119620	127500	We can talk about the connected aircraft, the airport, the airline maintenance control center, as well as the UAVs and drones.
127500	132940	These targets are associated with multiple risks and have risk exposure.
132940	140280	And therefore, we need to be coherent and with a global approach to better understand and reduce the risk.
142950	150430	As I said previously, aeronautics environment is leading to digital transformation with an open and connected world.
150430	155970	Digital transformation leads to data-driven organization and therefore cybersecurity.
155970	160250	Knowing that, for aeronautics, safety is the first priority.
160250	168630	We must secure stakeholders' trust as well as safety-critical aeronautics system putting the passenger as our first priority.
168630	172810	No digital transformation without trust. No trust without cybersecurity.
173430	178260	This connected environment raises two challenges for aerospace ecosystem.
178260	189760	First, safety and security stake, requiring to keep up in a safety environment, setting up cybersecurity conditions across all system lifecycle.
190000	197440	And second, business continuity, needing to value cybersecurity to help prevent business operational disruptions.
197440	200540	Now, let's talk about the hackers in this environment.
200780	204620	We're going to talk about ethical, good-faith hackers.
205360	208780	We aim to provide the best possible practices.
209580	216820	And we want to make sure our solutions and services as well as our customers' infrastructures are cyber-secure.
216900	223700	And therefore, we perform, for example, risk analysis and pen test using our own hackers.
223700	228800	And for sure, we're talking about ethical hackers and ethical-talent hackers.
228800	231380	These hackers can act through the Internet.
231380	244280	For example, from one of our air navigation service provider customer, we've been able through some services that we provided to them through a contract.
244280	248840	We've been able to penetrate their power generation systems.
248840	259420	And this was enabling us to go into their server, which turned on and off the whole air traffic center.
259420	269540	All this through our own facilities in France, going in their own air traffic control, where it was not for sure in France.
269580	275540	And other tools that we have are specific simulation environments.
275540	280040	As you can see in this slide, we have the red team versus the blue team.
280040	285020	With our simulation environments, we're able to implement the infrastructure of our customer,
285020	289860	their operational infrastructure, where the red team is our own hackers,
289860	294860	which mission is to, of course, attack the vulnerabilities of the system.
294860	297020	And the blue team is our customers.
297020	305180	Our customers in this environment are there to be trained and see if they are cyber secure.
305180	307480	Also, their system is cyber secure.
307480	313140	More and more, we need ethical hackers able to master specific sector expertise.
313460	316100	This sector expertise is very specific.
316100	318420	We're not talking about only ISIT.
318420	321420	We're talking about operational technologies.
321420	328800	More and more, we're facing attackers who are aiming at this type of equipment
329300	335880	and trying to be more and more specific to their attacking.
335880	341320	And I know the floor to Lawrence will develop more on what we do in terms of avionics.
341320	342180	Lawrence?
342540	343780	Thanks, Yannick.
343780	347240	Okay, so when we're talking about this changing paradigm,
347240	352500	it's really important to understand the current and historical state of affairs.
352640	357620	In other words, how has security been managed to this point and why?
357620	362080	And then we're also going to talk about what is changing to drive the new paradigm.
362680	369140	So at TALIS, the high-level approach to cybersecurity is defined by nine cybersecurity rules.
369140	372960	One of the rules is really important to this audience in this conversation
372960	376160	because it speaks directly to penetration testing.
377280	382000	Oftentimes, we use a gray box approach with third-party pen testers
382000	384740	and we give them a limited amount of information
384740	389500	so they have some understanding about the system components and overall architecture
390160	393340	and they can test all the threat vectors.
393840	399300	This is good and it's a great start considering where we are today,
399300	405520	but it also serves as a very good example of a security practice
405520	408300	that does not really reach its full potential.
409320	416740	The model I just described is performed by a limited number of people for a limited amount of time.
417480	420600	They also only have a limited amount of information
422320	428800	and it's done in a closed environment that is not really remotely accessible
429160	432740	due to policy and other technical limitations today.
432740	438140	This approach does not really leverage the full power of the good faith hacking community
439100	449920	and ultimately, it results in what can only be called as a limited snapshot into a product's security posture.
451320	460940	And we must admit the culture of aerospace and aviation has really kind of contributed to this approach that we have today.
462160	467080	Vulnerability management in aerospace and aviation is pretty difficult.
467360	471760	Updating the product, in most cases, is not easy.
471840	477400	And this is even true for the non-safety critical part of the aircraft.
477500	484920	It usually takes a lot of time, a lot of money, and usually a lot of lost revenue
484920	489680	to update the system, the aircraft systems.
491460	496360	Historically, this has kind of contributed to a closed type of thinking.
496540	502700	You know, along the lines of, hey, if we don't look hard enough, we'll never find anything
502700	505580	and therefore we must not have a problem.
506360	512160	The good news is that this mentality, we're seeing a change with this.
512160	519700	In a recent Atlantic Council survey, 84% of aviation professionals that were polled
519700	525410	indicated that cybersecurity researchers are good for aviation.
525740	530460	So, now is the time for the industry to improve.
530460	532400	And we can do better.
532400	538900	But first, it's important to understand the factors that are driving this shift in thinking
538900	542800	before we try to answer the question of how we do better.
545670	550550	Let's use the cabin of today's commercial aircraft as an example.
550550	554910	It makes sense to look here first for a couple of reasons.
555150	558890	This portion of the aircraft is not deemed safety critical.
559530	564850	Therefore, it lends itself to the fastest changes and is going through a rapid evolution
564850	571290	in terms of the technologies and systems deployed to satisfy the airline customer.
571750	579390	This means this area of aviation will embrace the good faith hacking community the fastest
579390	581670	and with relative ease.
581670	586090	And it will likely influence other areas of aviation.
586770	592610	So, everyone knows the majority of commercial aircraft are connected to the internet.
592610	596110	Wi-Fi is viewed as critical for today's passenger.
596550	602090	There are also several other changes that are bringing the comforts of the living room
602450	605130	into the cabin in today's passenger.
605790	610510	So, if we take a look at the inflight entertainment system, it's a really good example.
610810	614010	It's becoming much more complex in several ways.
614970	621810	There's an increasing selection of movies and other entertainment content that has not been released to the public.
621810	626050	This requires protection and ongoing security testing.
626050	630510	There's a large influx of third-party applications and games.
630510	637470	And these are games that are not from the Apple App Store or Google Play and have been validated by Apple and Google.
637470	640970	These require ongoing security testing as well.
642030	646930	E-commerce and shopping options are constantly expanding.
646930	652670	Along with more convenient ways to pay for your goods and services.
653430	658210	And this includes the introduction of technologies like near-field communication.
658670	662170	The amount of personal information is increasing.
662170	666090	With airlines providing a much more personalized service.
666090	668890	With more convenient payment systems.
668890	678190	And this also includes the introduction of advertising that is targeted to specific passengers with their demographic information.
678190	687210	In order to support all of this, the number of interfaces on the aircraft that are accessible by the passenger from their seat is increasing.
687330	694710	This includes things like USB, Bluetooth, touchscreen, near-field communication, and Wi-Fi.
694710	698910	Now consider this is only part of the overall equation.
701980	710920	All of these solutions I just described to support e-commerce, entertainment, and personalization are supported by a constantly expanding ground infrastructure.
711260	716060	And this ground infrastructure, it has similar cybersecurity risks.
716060	720900	It's exposed to the same regulatory requirements like PCI and GDPR.
721260	723440	But there's a big difference.
723440	728680	These environments look and feel much more like a traditional IT environment.
729780	740820	So, one positive aspect of this is that IT-oriented DevOps teams have already started to embrace practices like crowdsourced pen testing.
741580	751520	So, in the case of aviation and aerospace, this will be a force that will drive the overall industry towards engaging the GoodFaith hacking community.
752620	761340	So, before I finish, there's one last thing I'd like to mention about how we are seeing COVID, the COVID pandemic, impact this paradigm shift.
762080	771680	Third-party pen testers who were previously required to be on premise to pen test certain products and solutions cannot travel and be on site to do this.
771680	774340	Yet, the pen testing still must be conducted.
775330	786500	So, we are seeing companies quickly adapting, changing their policies and methods to do remote pen testing whenever possible.
786500	793600	Obviously, this is going to be a challenge when it comes to systems and products with physical interfaces.
793820	798080	But we still see a rapid evolution coming in this area.
798080	805360	So, COVID is actually knocking down some of the previous barriers when it comes to embracing the GoodFaith hacking community.
805680	814260	To summarize, these changes have increased the number of assets that need protection while also increasing the number of threat vectors.
814340	822760	At the same time, we see the aviation community's attitude and view on embracing the GoodFaith hacker is changing.
822760	831620	This means now is the time to do this. It's time to embrace the GoodFaith hacking community and look at changing the traditional approach to cybersecurity.
832660	839600	Now, I'll hand it over to Nathalie to talk about how we can do this in collaboration with the GoodFaith hacking community.
840340	849900	Thank you, Laurent. You're right. We need to see more on how to integrate those hacking activities in our engineering and operations.
849900	858020	So, I will use the NIST framework, which is what we are following, to explain our constraints about that.
858260	866400	So, when we discuss with Laurent on when in this cycle it will be easiest to integrate GoodFaith hackers.
867400	876640	During the identify and protect phase, it's more where we do risk assessments, not the theoretical part, not that easy.
876640	886580	But definitely during the design phase, it's important, and more naturally into the in-service phase.
886620	893420	So, those two phases, the during design phase and in-service phase, seems natural to me.
894380	901240	Today, it's obviously during in-service that we have already interactions with hackers.
901240	908560	I will tell a little story about a CV that has been published on the Thales Cabin product.
909340	922120	And we all know that there is room for improvement in this area to render this interaction more fruitful and this dialogue more fruitful between industry and hackers.
922120	925020	We will discuss that afterwards.
925020	930240	Now, I would like definitely to focus on the during design phase.
930240	937840	Why? Simply because for us, it's where it is the easiest to patch and to remediate.
938160	948540	And this is also the good place where we can confront the theory of the attack path that we imagine with the real practice with hackers.
948620	951680	And have the good coverage about it.
951680	962580	And the most we spend time on cyber robustness, the most we are saving also money, to be honest, in the operational phase and in the in-service phase.
962900	971620	So now, when we think about how we can manage this during design phase, it's not easy.
971620	984900	Today, I have no example of our airborne system being virtualized and put in a cloud and accessible through a web portal for you to do pen tests.
984980	993360	As explained by Lawrence, we are performing our own pen tests directly in our labs.
993360	996740	So you need to imagine fully representative labs.
996740	1007940	For example, Cabin, you have an instance of the economy class, first class, business class, and it's big halls run by us.
1007940	1015180	And they are running 24 hours a day and 356 days a year.
1015180	1031520	So you can imagine how it's not easy to organize a pen test sequence in such labs, which are used to improve our product and ensure customer new functionalities.
1032620	1040620	So, to be clear, there is also, due to the fact we are on special technology,
1040620	1047560	if you want to get good-faith hackers working with us, for example, through a bug bounty program,
1047560	1057640	then there is an investment to be done on hacker side, because you need to enter into specific technology dedicated for aviation.
1057660	1063860	For example, we don't have Ethernet. We have AFDX, which is a rank 664.
1064860	1074130	This is Ethernet-oriented for safety. And there are lots of examples of that on protocols, on operating systems.
1074420	1080300	And this is driven by safety-related requirements.
1080300	1091970	So when we discussed about bug bounty company on how to organize better interactions with good-faith hackers,
1091970	1102290	they mentioned to us they have already this kind of program for ICT suppliers or, for example, automotive system providers.
1103250	1115570	But with the change in paradigm, as mentioned by Lawrence, I think that we are now moving to virtualized simulation benches and labs,
1115570	1127590	more connected simulation benches and labs. And this is a kind of cyber train, and I think it's promising.
1127590	1134850	For ground system and ground infrastructure, we just need to follow what is a good practice in other sectors,
1134850	1142070	since they are more IT-related, and we can easily move to classical bug bounty programs.
1142070	1150110	So to summarize on how we can work together during the design phase, I think there are two tracks we can work on.
1150110	1158010	The first one is dedicated bug bounty programs, where you come to our big halls and labs.
1158010	1169910	And the second would be more to develop, and it is more on our shoulder, cyber twins, which are helping for doing those patents
1169910	1182150	and perhaps being more agile, doing it more often, and with better coverage, and not one or two persons during some days or weeks.
1182890	1192650	So okay, I hope it's clear. Now we'll go for the second phase, which is the in-service phase, to explore what we can do.
1192650	1202590	So here, this is another story. You see the title, we call that managing continuous security. It's not for you, it's for our customers,
1202590	1212530	for them to understand that security is a long road where you need to update regularly due to the fact that new attacks are coming.
1213170	1218810	And in the in-service phase, the NIST framework is beginning by the detect.
1218810	1233950	This detection comes to us either through our customer services, which is seeing an incident reported by a customer, or this might be an event found on the internet.
1233950	1245650	You know, we have a threat intelligence team and services like that, that help us in graphing kind of videos that may be published by hackers,
1245650	1254170	but also more in a standard way, CV, that could be published on our products.
1254550	1259810	So to explain what are the issues today, I will give you an example. I think it's the best.
1259810	1273190	It was a story that happened to us, I think, last year. And in fact, it was a CV published with a high score of 8, which is high specificity.
1273190	1283090	The CVSS is between 1 and 10. And so it was on the in-flight entertainment systems.
1283090	1292990	So first of all, I would like to recall that in-flight entertainment systems are non-critical systems if we consider safety.
1292990	1303670	So this rating is a bit high. And when our incident response team, our PSIRT, investigated about that,
1303670	1310090	they learned that, in fact, it was a vulnerability exploited on a third-party chat application.
1310430	1323490	And in fact, the impact was just you at your seat hacking the chat application, crashing, and not propagating to any other seats, just stand alone on the seat.
1323490	1332350	So it was a bit surprising to us that Mitre, even Mitre, has ranked this vulnerability at a level of 8.
1332350	1342790	But finally, we get in touch with the hacker, we had a discussion, and we say that this CVSS score was far too high.
1343450	1360150	And so when you see such a situation, and we generalize it, so from the case like that, what are the drawbacks in such a way of managing vulnerability disclosure?
1360150	1367790	So today, there is no direct notification to our incident response team, product incident response team.
1368610	1380110	So as a consequence, there might be a very long time, more than two weeks, before we get in touch really with the good-faith hacker and understand.
1380110	1394110	And also, as this is illustrated here, our sector is not really understood today. You have seen the high rating by Mitre.
1394150	1409510	So we need to have this kind of education. And hopefully, there are major airlines, and so they are kind enough, since they are doing their own risk assessments, to tune the level of patching.
1409510	1433710	But if it wouldn't have been the case in this story we had, imagine you need to know the exact configuration, product configuration, which aircraft, replace the exploit on our big labs, find the source code, develop the patch, then again test in the big labs.
1433710	1452210	And it's not finished. You need to go to a real aircraft to obtain what is called the field supplier acceptance tense, which is provided by the airline for them to deploy the patch by ensuring it has no secondary effects on the system.
1452590	1459810	And believe me, the best we did for this type of operation was something like three weeks.
1459810	1480730	And even today, there are some patches that we delivered, something like more than one year, that are not yet deployed by some airlines, because it's a long process to deploy on all fleets a patch, and knowing that some aircraft are under maintenance and things like that.
1480950	1489090	So what I would like to have in the future, in a better disclosure program, would be the following.
1489090	1499250	First, establishing direct exchange with the good face hacker. I think it's really important for us to understand and for the hacker to understand also better.
1499470	1517530	Then, establishing clear remediation time and steps before going to publication, because depending on what has been found and what it is impacting, you understand that we don't have the same constraints than in the IT world.
1517530	1520210	So we need more time in some cases.
1520710	1533890	So now, if it's better that way, you would say, okay, if I have a vulnerability to disclose, what are my possibilities today and how can I interact with you?
1534270	1543810	So this is why we have set up first for the whole ecosystem, sharing information capacities.
1543810	1555870	When I say the whole ecosystem, I mean airport, airlines, aircraft manufacturers, suppliers. We have very few maintenance operators, but it's becoming.
1556010	1560770	It has been set up, the first one, more than four years ago.
1561250	1565990	So now, what are the ones you can use?
1565990	1577910	I would advise Aviation Isaac. Aviation Isaac is an aviation information sharing community and they are providing support.
1577910	1586490	They have incident response capacity to facilitate the interactions between the hacker community and the industry.
1587030	1592310	So it's a good point for you if you need.
1592310	1599610	Now, a second one, particularly in Europe, is EXA. It's European Centre for Cyber Security in Aviation.
1599610	1608670	So they don't have an incident response capacity, but last year for DEFCON, for aerospace delayed, they were okay.
1608670	1616370	So they set up a portal for you to enter the different subjects you would like to discuss.
1616370	1627510	And not telling the details, but tell, I don't know, I have something to say about an airport or something to say about a system, an airborne system.
1627510	1638750	And then they are putting you through the good stakeholders that are referenced at EXA, which is important also.
1638910	1643690	So I hope it helps and it will be easier for you now.
1647870	1665540	So to recap, on Thales' side, we are definitely considering that with the changing paradigm, we need to set up plans to embed good-faith hackers in our design and operation phase.
1665540	1669860	And to do this with a win-win situation for both sides.
1670710	1680080	To tell you, to be honest, without this COVID crisis, we have scheduled with Lawrence to come to DEFCON.
1681040	1689020	What was scheduled is to bring to you a mini-lab representative of an in-flight entertainment system.
1689740	1693090	One of our latest generation.
1693540	1697240	So that you can have a hands-on exercise on it.
1697240	1700620	And also you can learn and try.
1701720	1705560	So now we have done this webinar.
1705560	1712480	This webinar is there to explain what we do, what are our constraints and challenges.
1712480	1722980	And you have heard Yannick telling how the aircraft is a part of the whole ecosystem.
1722980	1728860	And there is not only aircraft to consider, but all the rest of the ecosystems.
1729380	1732880	Lawrence has explained how is the changing paradigm.
1732880	1736720	How the paradigm is changing, particularly post-COVID.
1736820	1741700	With the need of our pen tests to be done in a distant way.
1742900	1752160	And I've shared my views on how we are seeing the integration of good-faith hackers in our design.
1752160	1760700	And how to improve the vulnerability disclosure for you, for us and for our industry.
1760700	1767600	So I'm sure that good-faith hackers can be part of the chain of trust in aviation.
1767600	1774260	And we need to keep in mind that we are talking about a safety-critical system.
1775140	1785400	So now I will tell you that if we want to get in touch with us, we have a dedicated address.
1785400	1787580	You can see it on the screen.
1787700	1791240	So it's short. I mean it's products, security and citizens' response.
1791240	1795280	So it's really dedicated to what we are delivering.
1795980	1798120	I hope it helps again.
1798140	1799840	So thank you for your attention.
1799840	1802340	And now I let you the floor for the questions.