1
00:00:06,280 --> 00:00:09,260
Welcome to the Aerospace Village at DEF CON Safe Mode.

2
00:00:09,260 --> 00:00:10,760
My name is Kaylin Tricon.

3
00:00:10,760 --> 00:00:19,780
I'm the Director of Communications at the Aerospace Village and Vice President at RockSolutions, a public affairs agency where I lead the firm's cybersecurity practice.

4
00:00:19,780 --> 00:00:25,140
I am thrilled to be moderating this panel on Hacking Cybersecurity Aerospace Regulation.

5
00:00:25,140 --> 00:00:29,900
The aerospace industry is highly regulated with a great deal of focus on cybersecurity.

6
00:00:30,200 --> 00:00:39,860
Aerospace regulators play a key role in understanding risk and putting in place the legal frameworks in creating rules, regulations, and best practice around good faith research.

7
00:00:39,860 --> 00:00:48,080
Today's panel will look at how the aerospace industry is approaching cybersecurity regulation and its relationship to good faith hackers and researchers.

8
00:00:48,080 --> 00:00:55,000
We will look at how other sectors have approached regulation and partnered with this community to increase resilience and highlight vulnerability.

9
00:00:55,160 --> 00:00:58,640
Now I'd like to introduce our esteemed panelists.

10
00:00:58,760 --> 00:01:00,640
Nikki, will you kick us off?

11
00:01:00,880 --> 00:01:03,460
Sure, so my name is Nikki Keeley.

12
00:01:03,460 --> 00:01:08,450
I'm the Head of Cybersecurity at the oversight of the UK Civil Aviation Authority.

13
00:01:09,180 --> 00:01:21,000
So I work for the UKCA and as the UK's aviation regulator, we're responsible for overseeing the implementation of cyber requirements in regulation for regulated aviation organizations.

14
00:01:21,000 --> 00:01:28,600
So that could vary from airlines, through to airports, through to air navigation service providers, or even drone operators.

15
00:01:28,600 --> 00:01:42,100
And it's really important for us that we have a proportionate and effective approach and that most importantly we enable aviation to manage their own cyber security risks without compromising aviation safety, security, or resilience.

16
00:01:43,760 --> 00:01:44,540
Thanks.

17
00:01:44,540 --> 00:01:45,400
Harley?

18
00:01:45,860 --> 00:01:50,720
Hi, I'm Harley Geiger and I'm Director of Public Policy at Rapid7.

19
00:01:54,180 --> 00:01:56,100
With offices around the world.

20
00:01:56,100 --> 00:02:01,640
I'm in the DC area and I run Rapid7's public policy and government engagement activities.

21
00:02:01,640 --> 00:02:10,400
I've worked in privacy and cyber security technology policy and law for about 10 years and I'm excited to be here.

22
00:02:10,400 --> 00:02:12,260
Thanks for having me.

23
00:02:12,400 --> 00:02:13,240
Thanks.

24
00:02:13,240 --> 00:02:14,100
And Saulo?

25
00:02:14,940 --> 00:02:17,420
Well, thanks Katelyn for the invitation.

26
00:02:17,420 --> 00:02:19,120
My name is Saulo da Silva.

27
00:02:19,120 --> 00:02:21,320
I work for ICAO.

28
00:02:21,320 --> 00:02:30,460
ICAO is the United Nations Agency responsible for the regulatory framework of aviation on a global basis.

29
00:02:30,460 --> 00:02:34,500
I'm particularly chief of the global interoperable systems section.

30
00:02:34,500 --> 00:02:51,340
It's a weird name, but basically what we do is take care of regulations regarding information management, operational and safety critical information management, including the aspects related to cyber safety and resilience.

31
00:02:51,340 --> 00:02:59,520
Basically keep the system going no matter the type of problem that may happen coming from our new actors.

32
00:02:59,520 --> 00:03:00,440
Thank you.

33
00:03:01,640 --> 00:03:03,060
Thanks, Saulo.

34
00:03:03,060 --> 00:03:04,940
All right, let's get started.

35
00:03:04,940 --> 00:03:12,500
I think it only makes sense to start with where the industry is right now when it comes to aerospace cyber security regulation.

36
00:03:12,500 --> 00:03:21,920
Nikki, I know that the UK has made significant strides when it comes to building bridges between security researchers and industry and how that helps drive regulation.

37
00:03:22,000 --> 00:03:27,960
I'd love if you could kick us off and talk a little bit about that evolution and where the UK is today.

38
00:03:28,660 --> 00:03:29,960
Sure, thanks.

39
00:03:29,960 --> 00:03:32,220
I don't know about significant strides.

40
00:03:32,220 --> 00:03:36,500
I think we are starting to build the bridge, which is positive.

41
00:03:36,500 --> 00:03:48,420
So in terms of lessons learned, I'd say the first hurdle that we really had to overcome was this misconception that all a regulator wants to do is fine people, which is absolutely not the case.

42
00:03:48,660 --> 00:03:51,400
At the end of the day, we're all here for the same reason.

43
00:03:51,400 --> 00:03:57,200
We know that our industry and good faith hackers ultimately want to make aviation safer and more resilient.

44
00:03:57,220 --> 00:04:00,020
So I think it's about breaking down that misconception.

45
00:04:00,860 --> 00:04:04,720
I think the second hurdle is around how do you actually report?

46
00:04:04,720 --> 00:04:10,380
What mechanisms do you give individuals and good faith hackers to actually report things?

47
00:04:10,380 --> 00:04:12,200
And we're lucky in one sense.

48
00:04:12,200 --> 00:04:18,480
In Europe, there's a regulation which is focused on what we call mandatory involuntary occurrence reporting.

49
00:04:18,540 --> 00:04:29,000
So that's all about making sure that safety information is reported, that it's collected, protected, analyzed, so that appropriate safety action can be taken.

50
00:04:29,000 --> 00:04:41,440
And where there's a cyber vulnerability or a cyber incident, and that would impact on those safety critical environments, then we believe that it's really important that that information should be reported and acted on.

51
00:04:41,540 --> 00:04:51,020
And for organizations who aren't in scope of that regulation, I just mentioned, then we also have a whistleblowing option available in the UK under the Public Interest Disclosure Act.

52
00:04:51,020 --> 00:04:53,200
So that's all available on our website.

53
00:04:53,200 --> 00:05:00,280
So I think the starting to build that bridge was making sure that it was clear that we want people to get into contact.

54
00:05:00,280 --> 00:05:02,420
It's not about taking punitive action.

55
00:05:02,420 --> 00:05:12,260
It's about starting that dialogue and conversation, and then showing that there's a mechanism for them to be able to do that, and making those options available for contact.

56
00:05:13,620 --> 00:05:16,200
So I think that's really important for us.

57
00:05:16,460 --> 00:05:17,080
That's great, Nikki.

58
00:05:17,080 --> 00:05:21,880
Has there been any significant challenges in communicating that message to the community?

59
00:05:21,880 --> 00:05:24,060
Do you think that's where the hurdle lies?

60
00:05:24,540 --> 00:05:28,180
Yeah, I think it's, you know, all regulators are different.

61
00:05:28,180 --> 00:05:32,940
I can only talk about aviation, but different regulators might have different approaches.

62
00:05:32,940 --> 00:05:36,500
And I think it has been about how do you get that message out there?

63
00:05:36,500 --> 00:05:41,820
And I think that's been developing slowly through our relationship with industry.

64
00:05:41,820 --> 00:05:45,680
We started to build a really positive relationship with our industry.

65
00:05:45,960 --> 00:05:52,540
You know, we've tried to make it clear that we want them to engage with us and collaborate with us.

66
00:05:52,540 --> 00:05:56,460
And that it's not the case of never having a cyber incident.

67
00:05:56,460 --> 00:06:01,600
We expect that organizations will have cyber incidents, and will find vulnerabilities.

68
00:06:01,600 --> 00:06:08,900
And it's more about, you know, following what we call just culture in the safety sense, and reporting those that they can be fixed.

69
00:06:10,600 --> 00:06:11,480
Thanks.

70
00:06:11,700 --> 00:06:22,500
And just keeping with, you know, laying the landscape out, Saulo, from a global perspective, how do you think states are dealing with the challenge of aerospace cybersecurity regulation?

71
00:06:22,540 --> 00:06:26,080
You know, what are some of the greatest challenges you think the industry faces?

72
00:06:27,740 --> 00:06:29,000
Thanks, Kayleigh.

73
00:06:29,000 --> 00:06:35,740
You mentioned actually two important words here, that regulations and a challenge.

74
00:06:36,080 --> 00:06:42,360
And I would put a little bit of spice and add one more, that is interoperability.

75
00:06:42,360 --> 00:06:50,420
That for us in the aviation industry, is actually a bigger problem than just cybersecurity regulation.

76
00:06:50,420 --> 00:06:55,820
It's really, it's really, how can I say, it's a problem of divergence.

77
00:06:55,820 --> 00:07:11,200
So when we talk about unity in aviation in ICAO for the future, we need to consider the impact of this digital transformation that is happening, and that we are living right now, this digital evolution.

78
00:07:11,200 --> 00:07:22,680
And it's something that comes because we have several economic drivers that are basically encouraging this digital transformation of the business.

79
00:07:22,680 --> 00:07:27,940
So this will happen if we want or not.

80
00:07:27,940 --> 00:07:31,140
And we have to be prepared for that.

81
00:07:31,140 --> 00:07:36,020
We have to have this increased digital data and information exchange.

82
00:07:36,020 --> 00:07:43,140
We know that this is necessary to guarantee not only safety, but also to improve the efficiency of the system.

83
00:07:43,140 --> 00:07:51,720
And of course, we know that everybody's taking actions to secure their part of the system.

84
00:07:51,720 --> 00:07:56,260
But as I mentioned before, it's a problem of divergence.

85
00:07:56,260 --> 00:08:26,020
So one example of a divergent digital process, we can say that, for example, manufacturers who needed to upload software critical parts onto their craft, they are doing everything they should do to secure, for example, the supply chain and to guarantee that they have a certified identity and the integrity of the data being uploaded.

86
00:08:26,020 --> 00:08:33,740
So if you, for example, want to connect to the cockpit of the aircraft, you will do the same thing.

87
00:08:33,740 --> 00:08:37,340
You take the actions to connect on a secure way.

88
00:08:37,340 --> 00:08:46,640
If you want to connect to the back of the airplane, also you're going to do things to connect to the back using a different certificate system.

89
00:08:46,640 --> 00:09:01,260
So if you are one manufacturer of avionics, for example, and if you are using different ways to connect it to the supply chain or to the equipments on board, we know, for example, also airports.

90
00:09:01,260 --> 00:09:06,540
Airports are also establishing their system to guarantee the security of the operation.

91
00:09:06,540 --> 00:09:14,860
So basically, you have everybody doing what they think is correct, what they need to do.

92
00:09:14,860 --> 00:09:30,820
So we are going to a point that we are finding ourselves with thousands of different certificates floating around the ecosystem with little or sometimes completely no compatibility.

93
00:09:30,820 --> 00:09:36,280
And that's when the issue of compatibility or interoperability comes.

94
00:09:36,280 --> 00:09:48,500
And we believe that these certificates, they, like other things, they have to be maintained along hundreds of different processes and procedures.

95
00:09:48,500 --> 00:09:59,660
And the big challenge is to create a convergence on all these important activities that are being taken nowadays.

96
00:10:00,220 --> 00:10:04,960
I don't want to say in an uncoordinated way, but in a very loose way.

97
00:10:04,960 --> 00:10:15,380
So the challenge for the states right now is to have a global harmonized regulations through coordination and cooperation.

98
00:10:15,380 --> 00:10:26,920
The coordination and cooperation to face this challenge to have a global harmonized regulatory framework is really necessary because aviation is international by default.

99
00:10:26,920 --> 00:10:28,860
Airplanes do not recognize borders.

100
00:10:28,860 --> 00:10:34,180
I keep saying that we have checkpoints on the ground, but we don't have checkpoints in the air.

101
00:10:34,180 --> 00:10:42,140
So cooperation and coordination to develop a harmonized set of regulations is a big challenge that states are facing right now.

102
00:10:42,580 --> 00:10:54,860
And, you know, that's a really interesting point is that challenge of it being so global and each kind of state having its own rules, regulations, you know, that framework that you're talking about.

103
00:10:54,860 --> 00:10:58,700
Are we currently in a process where that's being discussed and worked on?

104
00:10:58,700 --> 00:11:05,100
Or is it still in the stages of, you know, it would be a nice to have and we need to work on it?

105
00:11:05,980 --> 00:11:16,920
From an international perspective, the International Civil Aviation Organization is working on that with the help, obviously, from the states, because that's where the expertise relies.

106
00:11:17,300 --> 00:11:22,360
And we have Nikki here with us, who is helping us a lot on that subject.

107
00:11:22,360 --> 00:11:25,200
But this effort is already ongoing.

108
00:11:25,320 --> 00:11:27,900
It's not an easy effort.

109
00:11:27,900 --> 00:11:38,100
As you mentioned, we have a challenge because we have national security requirements, we have national culture, we have national ways of trust.

110
00:11:38,300 --> 00:11:45,500
And when we have to expand this to a global environment, it keeps us awake.

111
00:11:45,660 --> 00:11:57,760
But we are sure that cooperation and coordination with the help from experts from the states like Nikki, who is here with us, we will face and we will win that challenge.

112
00:11:57,760 --> 00:11:58,520
We'll get there, Zalo.

113
00:11:58,520 --> 00:11:59,800
We'll get there eventually.

114
00:12:01,220 --> 00:12:02,140
Yeah, let's do it.

115
00:12:02,140 --> 00:12:06,460
Do you have anything to add to that, just from your perspective?

116
00:12:06,460 --> 00:12:09,340
Yeah, I think Zalo raises a really good point.

117
00:12:09,340 --> 00:12:12,700
And sometimes it's easy to forget this.

118
00:12:12,700 --> 00:12:17,400
I did cyber for an operator back in the day before I joined the regulator.

119
00:12:17,600 --> 00:12:21,920
And sometimes you can think of it just in terms of that one organization.

120
00:12:21,920 --> 00:12:35,200
But when you're having to talk about regulations and international frameworks and standards, and you have to think about what's proportionate and appropriate, not just for me as the state, all of the airports of all sizes that we regulate.

121
00:12:35,200 --> 00:12:45,600
But if you look at it from Zalo's perspective, at an international level, for all the states, all the organizations, all the aviation entities, it does become a challenge.

122
00:12:45,600 --> 00:12:47,960
But I think the work is well underway.

123
00:12:47,960 --> 00:12:49,420
So I'm hopeful.

124
00:12:50,960 --> 00:12:52,020
That's great.

125
00:12:52,020 --> 00:12:53,340
Thank you both.

126
00:12:53,840 --> 00:12:56,140
And I'm just turning to Harley.

127
00:12:56,160 --> 00:13:07,120
We've talked a little bit about building bridges between the security researcher community and regulators in order to help the disclosure process, help things become more transparent and safe and effective.

128
00:13:07,120 --> 00:13:16,680
And, you know, can you talk a little bit just about, you know, the current disclosure process and environment for security researchers when it comes to this in this particular industry?

129
00:13:18,560 --> 00:13:19,920
Sure.

130
00:13:20,000 --> 00:13:29,660
So, overall, the security vulnerability disclosure environment is greatly improving.

131
00:13:30,460 --> 00:13:43,540
There's a lot more adoption of coordinated vulnerability disclosure within government agencies for themselves, recognition that it is valuable in industries, in the different sectors that those agencies regulate.

132
00:13:43,560 --> 00:13:50,900
And it is becoming more accepted as a basic cybersecurity practice, both in the United States and I would say internationally.

133
00:13:50,900 --> 00:14:00,840
And two great examples of agencies that are doing this are the FDA and the Department of Justice, CISA within DHS.

134
00:14:00,840 --> 00:14:06,460
Within the aviation industry, our experience is that it is not yet quite normalized.

135
00:14:06,480 --> 00:14:09,720
It is still somewhat difficult.

136
00:14:10,060 --> 00:14:24,700
And there is a, I think, in part because it is such a highly regulated industry, and because the potential negative effects on the industry of undermining passenger confidence can be so negative, so catastrophic.

137
00:14:25,600 --> 00:14:34,860
And unfortunately, we have a media environment that when it comes to anything related to aircraft safety, tends to sensationalize it.

138
00:14:34,860 --> 00:14:41,620
But in part for these reasons, our experience is that aviation has a ways to catch up.

139
00:14:41,660 --> 00:14:46,300
And it's unfortunate because there is a great deal of innovation that is happening in aviation right now.

140
00:14:46,300 --> 00:14:55,980
And the systems that are put in place in the sky and satellites, a lot of them stay in place for many years, as long as a generation.

141
00:14:55,980 --> 00:15:00,420
And so you have rapid innovation where security issues might be missed.

142
00:15:00,420 --> 00:15:05,360
And then you have equipment that stays in operation for a very long time.

143
00:15:05,360 --> 00:15:09,580
And then you have legacy issues with those security problems.

144
00:15:09,580 --> 00:15:13,940
So we think that this is an area where security research can really play a valuable role.

145
00:15:13,940 --> 00:15:22,460
But it is important to integrate security researchers and cybersecurity community into the manufacturer design.

146
00:15:22,780 --> 00:15:27,580
And once they're deployed, the vulnerability disclosure processes.

147
00:15:30,780 --> 00:15:32,040
Thanks.

148
00:15:32,320 --> 00:15:48,820
You brought up a point about just sensationalization and how the media, you know, can catch wind, or certain entities catch wind and kind of make this out to be something bigger than it actually is to kind of get the headlines and get the hype.

149
00:15:49,060 --> 00:15:54,700
Do you think that that is a barrier when it comes to wanting to disclose?

150
00:15:54,820 --> 00:16:04,600
Or do you think that there's kind of two tracks where people want the flash and they want the publicity, so they they do kind of make it a little bit more sensationalized than it is?

151
00:16:04,600 --> 00:16:11,320
Or do you think there's also that, I don't want to say anything because I don't want that to happen.

152
00:16:11,320 --> 00:16:21,340
I don't want my words to be misconstrued and turned into this sensationalized like, oh, you can get into the to the TV on the plane and it's going to crash down.

153
00:16:21,520 --> 00:16:24,520
So our impression is that it's both.

154
00:16:24,520 --> 00:16:30,360
You know, it depends on the individual researcher, their risk tolerance and sort of what their goals are.

155
00:16:30,380 --> 00:16:40,220
If there is a legitimate vulnerability in an aircraft, I don't think that sensationalism is really necessary in order to get headlines.

156
00:16:41,100 --> 00:16:49,220
And if you're just disclosing it for flash purposes and credibility purposes, then question whether you're disclosing it for the right reasons.

157
00:16:49,220 --> 00:16:56,100
That doesn't necessarily mean that it's not a security vulnerability and that there's not attention that should be paid to it, but it is really not the way to build trust.

158
00:16:56,180 --> 00:17:05,040
And it is, I think that it's also very much a barrier to engagement with the industry and the agencies with the security research community.

159
00:17:05,040 --> 00:17:07,420
So I think that there's work that has to be done on both sides.

160
00:17:07,420 --> 00:17:12,820
I will say that, you know, I don't want to let the agencies off the hook and just say that sensationalism is the issue.

161
00:17:12,920 --> 00:17:17,260
I mentioned the FDA, DOJ and other agencies earlier.

162
00:17:17,280 --> 00:17:33,960
Those agencies have made great strides in the past couple of years to engage a security research community, including attending DEF CON and just working within those agencies, areas of jurisdiction, like FDA for medical devices and DOJ, they're being more transparent on things like coordinated disclosure,

163
00:17:33,960 --> 00:17:38,380
prosecutions and researcher protection under DMCA.

164
00:17:38,440 --> 00:17:41,760
Shout outs to Leonard Bailey and Suzanne Schwartz.

165
00:17:41,780 --> 00:17:47,460
But FAA and the aviation industry have a ways to go.

166
00:17:47,460 --> 00:18:02,340
I know that there's good work on cybersecurity being done at FAA, like by Susan Kaebler, but they're not really being clear, in our opinion, publicly clear, that they care a lot about cybersecurity and that they want to build relationships with the cybersecurity community.

167
00:18:02,340 --> 00:18:03,740
It's just not clear.

168
00:18:03,740 --> 00:18:13,640
It's quite difficult right now to find much cybersecurity specific guidance on aviation systems from FAA, both on manned aircraft and unmanned aircraft.

169
00:18:13,640 --> 00:18:20,520
Unmanned aircraft being a huge area of concern since that is consumer level devices.

170
00:18:20,640 --> 00:18:26,300
And there's even less information out about how security researchers can work with these agencies.

171
00:18:26,380 --> 00:18:29,020
So our advice is twofold.

172
00:18:29,020 --> 00:18:41,780
One, for researchers to work to gain understanding about the unique context and pressures that the aviation industry is under, to be respectful, manage media to avoid sensationalism and work to build trust.

173
00:18:41,780 --> 00:18:50,320
But our advice also to the FAA is to encourage the aviation community to build bridges with the security community and to actually facilitate that engagement.

174
00:18:50,320 --> 00:18:59,580
Make clear that you are making an effort to bring in experts from the cybersecurity community, not just the aviation industry, for input on their guidance and their activities.

175
00:19:00,600 --> 00:19:02,360
Carly, thank you so much for that.

176
00:19:02,360 --> 00:19:05,300
You make a great point just about building trust.

177
00:19:05,300 --> 00:19:19,520
And you know, at the Aerospace Village, that is our core mission is to build the bridges of trust between the security researcher community and the aerospace industry itself to kind of formulate those relationships so that we can have these conversations.

178
00:19:19,520 --> 00:19:28,820
And so I'd like to kind of spend some time talking with you all about, you know, what we can do to forge those relationships in order to build that trust.

179
00:19:29,340 --> 00:19:41,620
You know, Nikki, I know in a prior conversation, we had talked about, you know, how in the UK industry has acted as, you know, a conduit between GoodFaith, the hacking community and the regulators.

180
00:19:41,760 --> 00:19:53,640
And, you know, I wonder if you think this approach is sustainable, or do you hope that that, you know, relationship evolves to where that community feels like they can go straight to the regulator?

181
00:19:53,640 --> 00:19:57,180
Because right now, it seems like if you have that conduit, it's working.

182
00:19:57,260 --> 00:20:02,180
But I wonder if you hope that it evolves so that they go directly to you.

183
00:20:02,380 --> 00:20:04,160
Yeah, that's a really good point, Caitlin.

184
00:20:04,160 --> 00:20:07,120
And I think Carly's raised some really good points as well.

185
00:20:07,120 --> 00:20:19,460
And at the moment, we have had reports come to us, largely through researchers or cyber specialists that have been asked by our industry to perform specific testing.

186
00:20:19,580 --> 00:20:27,740
And that's great, because that shows that we're building that relationship with our industry, that they trust us and want to report to us about issues like that.

187
00:20:27,880 --> 00:20:35,240
But going forward, I'd absolutely love to have the research community feel like they can get in touch with us.

188
00:20:35,660 --> 00:20:43,580
And I think importantly, and Harley, you mentioned, you know, customer confidence and passenger confidence, which I think is so important.

189
00:20:43,580 --> 00:20:48,620
And I think the media and sensationalism element doesn't help.

190
00:20:48,620 --> 00:20:52,580
And I have to admit that as a safety regulator, you know, we do get nervous.

191
00:20:52,680 --> 00:20:55,940
When it's safety critical systems, we do get nervous.

192
00:20:56,740 --> 00:21:00,680
So I think it's about how the reporting is done and how that engagement works.

193
00:21:00,680 --> 00:21:07,080
But for me, you know, my absolute perfect scenario would be to have early engagement with researchers.

194
00:21:07,140 --> 00:21:24,600
Like, you know, when you're planning on what research you want to be doing, having a good conversation then, because sometimes there are aviation contextual elements that might be helpful for the researcher to know about, because it might impact how they decide they want to do that research even.

195
00:21:25,220 --> 00:21:31,700
You know, there's an air navigation service provider guy that I talk to, and he always goes, well, Nikki, that's not an issue, because I can just look out the window.

196
00:21:31,700 --> 00:21:38,040
So sometimes there are, you know, non-technical, but aviation contextual elements that could be helpful in that research.

197
00:21:38,620 --> 00:21:41,480
So I think, you know, earlier the better.

198
00:21:41,480 --> 00:21:51,000
And it'd be great to be part of that discussion about focusing on areas that need more research, because either industry aren't able to do it themselves, or we aren't able to do that.

199
00:21:51,000 --> 00:21:53,880
And we need that research community to help with that.

200
00:21:53,880 --> 00:22:03,340
But to have those good conversations early on between the operators and the manufacturers and ourselves and the researchers, that can be kind of well planned.

201
00:22:04,100 --> 00:22:16,400
I was just thinking, so the Oxford University published a really great research paper on pilot reactions to hacked avionics, and had a great conversation with the researchers afterwards.

202
00:22:16,400 --> 00:22:19,780
And they were talking about ideas for the next research paper.

203
00:22:19,780 --> 00:22:28,140
And, you know, it's something we'd love to get involved in and help support, and see how we can, at the end of it, end up with a safer aviation environment.

204
00:22:28,140 --> 00:22:30,720
So I think that would be great.

205
00:22:30,920 --> 00:22:38,220
Nikki, I'm so glad you brought up that talk, as it is going to be featured, or that research is going to be featured in the Aerospace Village.

206
00:22:38,220 --> 00:22:43,740
So if you are interested, there will be a discussion and a presentation on that.

207
00:22:43,740 --> 00:22:45,140
So thank you for the plug.

208
00:22:47,240 --> 00:22:55,540
Salo, I do know that, and Pete Cooper tipped me off to this, that ICO has released a cybersecurity strategy.

209
00:22:55,540 --> 00:23:00,040
And in there, there's a line about security researchers, and how you'll work together.

210
00:23:00,040 --> 00:23:06,980
And just kind of curious to your thoughts about how that will work, and kind of what's being done to bring that to life.

211
00:23:08,000 --> 00:23:09,020
Thanks, Kaylee.

212
00:23:09,020 --> 00:23:15,700
And just before addressing that point, that is, it's very, it's such a good provocative question, actually.

213
00:23:15,700 --> 00:23:21,540
And I'm a researcher myself, so I like that point, because I'm playing on both sides.

214
00:23:21,540 --> 00:23:37,700
But just to just add one point that Harley mentioned before, I think sometimes we don't have much information nowadays about aviation, and the cyber aspects related to aviation, because lots of the concepts and decisions are still to be made.

215
00:23:37,700 --> 00:23:45,360
There are lots of ongoing developments right now, lots of, let's call, like we call in IKEA, some uncertainties.

216
00:23:45,360 --> 00:23:55,940
And sometimes it's better not to to spread some information that's not mature to the community, because it may create lots of confusions.

217
00:23:55,940 --> 00:23:58,140
So we try to spread the information.

218
00:23:58,140 --> 00:23:59,740
I'm not trying to defend FAA.

219
00:23:59,740 --> 00:24:11,020
I'm just saying that sometimes we do not spread the information, just to avoid the creation of a situation that may actually not be helpful to our system.

220
00:24:11,020 --> 00:24:25,900
But coming back to what you said, and I mentioned to you that it's a very provocative question, and I can't, honestly, I hope I can be short in my answer, although I really think that this would be the specific discussion.

221
00:24:25,900 --> 00:24:28,760
I'm going to talk about research and trust.

222
00:24:28,900 --> 00:24:33,240
It's a specific discussion that needs to start, that needs to have.

223
00:24:33,240 --> 00:24:51,000
And I would start just making a small statement, or what you call an observation, on how, and I think Nick mentioned that point, or you mentioned too, and how trust affects that relationship between different stakeholders.

224
00:24:51,000 --> 00:24:53,600
Because this is really important to be aware.

225
00:24:53,600 --> 00:25:02,320
And we see trust like a form of faith in the outcome of another's actions.

226
00:25:02,320 --> 00:25:04,000
So we have to think about that.

227
00:25:04,080 --> 00:25:17,380
Trust exists in a context of kind of imperfect knowledge, like not mature or imperfect knowledge, and also thinking about a possible future contingency.

228
00:25:17,380 --> 00:25:24,640
And as I said, you know, it is a form of belief despite uncertainties.

229
00:25:24,640 --> 00:25:26,760
That's how we see trust.

230
00:25:26,760 --> 00:25:45,460
And also, since the beginning of the century, but in all modern society, trust has been conceived as a mechanism that will help us to reduce the bureaucracy, the complexity, and enhance, obviously, communications between or among different stakeholders.

231
00:25:45,600 --> 00:25:59,160
And also, we can use the trust to reduce the need of a very strict regulation, like a contract, for example.

232
00:25:59,160 --> 00:26:07,080
So in the international aviation, there is a very sensitive ecosystem.

233
00:26:07,080 --> 00:26:09,920
You know, aviation, it goes to the headlines.

234
00:26:09,920 --> 00:26:15,620
You know, aviation, the media does not forgive us.

235
00:26:16,100 --> 00:26:22,600
The small incident goes to the first page, goes to any media headline.

236
00:26:22,600 --> 00:26:29,680
So we have to be conscious that the ecosystem is really sensitive to that.

237
00:26:29,680 --> 00:26:42,580
And we see in aviation, from an international perspective, the human element of it is the core, is in the core, at the core of cybersecurity.

238
00:26:42,700 --> 00:27:03,200
It is critically important for the international aviation community that, obviously, the civil aviation sector increases the number of personnel that is qualified and knowledgeable in both, and Harley correctly mentioned, that's not only aviation, but also aviation and cybersecurity.

239
00:27:03,260 --> 00:27:05,420
And this is a new area that is coming now.

240
00:27:05,420 --> 00:27:10,240
For example, I have to be honest, I'm 36 years in aviation, so I know a lot about aviation.

241
00:27:10,240 --> 00:27:11,780
I know a lot about aviation.

242
00:27:11,780 --> 00:27:16,640
But the last five years, that's when I started learning about cybersecurity, actually.

243
00:27:16,640 --> 00:27:19,520
So I can't consider myself a cybersecurity expert.

244
00:27:19,520 --> 00:27:20,560
No, I cannot.

245
00:27:20,560 --> 00:27:26,140
I can't consider myself an aviation expert, for sure, but not a cyber.

246
00:27:26,140 --> 00:27:32,100
And we have to have disqualified people in aviation and cybersecurity.

247
00:27:32,160 --> 00:27:39,900
And this, obviously, you have a different process to achieve that through recruitment, through education, training.

248
00:27:39,980 --> 00:27:44,160
But one significant way to advance is through research.

249
00:27:44,160 --> 00:27:45,380
Research is very important.

250
00:27:45,380 --> 00:27:50,700
And that's why I decided to go back to the research community, and I've been doing research with these states.

251
00:27:50,700 --> 00:28:08,300
And as such, as part of the ICAO strategy, as part of the international strategy, we, the International Civil Aviation Organization, we encourage all these states to set up the appropriate mechanisms for cooperation with what we call the good faith, you know,

252
00:28:08,300 --> 00:28:24,940
the good faith research, which is basically the research activity that's carried out in an environment that is appropriate, and is designed to avoid affecting what we, for us as a part of all that is safe, the security, and like we are seeing nowadays,

253
00:28:24,940 --> 00:28:26,920
the continuity of operations.

254
00:28:26,920 --> 00:28:30,760
So, ICAO encourages states to do that approach.

255
00:28:30,760 --> 00:28:35,480
But obviously, again, we go back to the aspects of trust.

256
00:28:35,480 --> 00:28:38,120
They are different in different societies.

257
00:28:38,120 --> 00:28:40,160
There are different ways of cooperation.

258
00:28:40,160 --> 00:29:00,300
So, we have to encourage and help the states to do that, because at least from this area that we see nowadays, cybersecurity research is the one will allow us to advance faster and achieve the results that we want to keep safety and continuity of operations as we have been doing for the last 100 years.

259
00:29:02,900 --> 00:29:13,140
Thanks, I think that's a great answer and also gives me a lot to think about too, just in terms of how, you know, the point about everybody thinks about trust differently in different communities.

260
00:29:13,140 --> 00:29:21,060
And so, you know, when we say that, oh, it's important to build trust, you know, what does that actually mean to the different stakeholders in the different groups?

261
00:29:21,060 --> 00:29:29,500
Harley, I'd be interested to get your thoughts on this, as we talk about, you know, what needs to happen and where we need to go.

262
00:29:30,240 --> 00:29:38,840
From your perspective, you know, what are some things that the aviation industry can do to kind of build that bridge and that trust?

263
00:29:39,180 --> 00:29:56,220
So, first of all, I think the aviation industry, there's a number of things, but focusing just on the relationship with security researchers, mentioned a few things before, but it would really be helpful to have guidance for researchers on vulnerability disclosure.

264
00:29:56,320 --> 00:30:02,920
And this can come in the form, perhaps ideally, in the form of model guidance from the FAA.

265
00:30:02,920 --> 00:30:10,020
Essentially, something that tells people what the FAA wants them to do in a situation where they have a vulnerability to disclose.

266
00:30:10,020 --> 00:30:20,560
What is the mechanism for the FAA to know about a vulnerability, since it is, you know, just the FAA that can decide whether a vulnerability is safety critical.

267
00:30:20,820 --> 00:30:32,020
And unfortunately, there's a, you know, the alphabet soup of agencies in the United States kind of makes understanding what the agency roles are a bit difficult , right?

268
00:30:32,020 --> 00:30:40,760
So, FAA is safety critical features in aviation, but CISA and DHS is the lead cybersecurity agency.

269
00:30:40,760 --> 00:30:44,400
So what, you know, where do researchers go if they're trying to disclose?

270
00:30:44,400 --> 00:30:45,300
Is it both?

271
00:30:46,140 --> 00:30:54,880
You know, this is not something that researchers who, you know, are focused on technical subjects and not necessarily on managing government bureaucracy should have to try to figure out on their own.

272
00:30:54,880 --> 00:30:57,160
There should be clear public guidance about that.

273
00:30:57,260 --> 00:31:07,280
And FAA, in particular, can play a great role in leading the charge on distributing that type of guidance and encouraging industry stakeholders to do it as well.

274
00:31:07,280 --> 00:31:18,140
A note of caution, though, for the industry as well as for the FAA is that there may be an impulse to say, well, aviation is special because there is, you know, safety components.

275
00:31:18,140 --> 00:31:21,280
Well, true, but that also exists for vehicles.

276
00:31:21,280 --> 00:31:23,060
It exists for medical devices.

277
00:31:23,440 --> 00:31:24,800
This has been done before.

278
00:31:24,800 --> 00:31:34,500
It's not going to be viewed, you know, by researchers as being so special that they would willingly submit to a process that is completely locked down, right?

279
00:31:34,500 --> 00:31:51,120
So if you are looking at having a vulnerability disclosure process and having it completely under NDA and, you know, restricting the ability of researchers to do anything with their research or to disclose in the event of a disagreement and so forth, that could very well backfire.

280
00:31:51,160 --> 00:31:53,840
I think the research is going to happen sort of regardless.

281
00:31:53,840 --> 00:31:57,060
Many of these components can be purchased on the second-hand market.

282
00:31:57,060 --> 00:32:02,820
Certainly when it comes for unmanned aircrafts, those are increasingly easy to purchase.

283
00:32:03,460 --> 00:32:14,420
And so the research is going to happen, you know, the key is going to be building an engagement that both sides can live with, not one that locks down researchers and then violates the trust that you're supposed to be trying to build in the first place.

284
00:32:15,380 --> 00:32:24,820
So I think you bring up a really good point about, you know, the second-hand market and like the research is going to happen with or without the industry.

285
00:32:24,820 --> 00:32:38,460
And I wonder if, you know, from my perspective, I feel like that should change and there should be this, you know, we don't want you going to get older equipment or second-hand equipment that's already been used.

286
00:32:38,460 --> 00:32:46,060
We want you to get the stuff before it's being used to identify, you know, what challenges or problems, vulnerabilities lie within.

287
00:32:46,160 --> 00:32:53,680
And I wonder, you know, from both your perspective, where do you think that barrier comes from?

288
00:32:53,680 --> 00:33:06,820
And then from, Nikki or Salo's perspective, you know, why isn't industry or regulators like approving, oh yeah, we want you to take a look at these components before they get put into use.

289
00:33:06,820 --> 00:33:10,880
And I wonder if that's back to Salo's earlier point of digital transformation.

290
00:33:10,880 --> 00:33:19,440
It happened ahead of security, it appears in a lot of cases across many industries, but now we're trying to play that catch up.

291
00:33:19,440 --> 00:33:26,780
But it's, is it a fear that, oh, we've been using this stuff and we don't want to know what's, you know, vulnerable.

292
00:33:26,940 --> 00:33:33,340
And so I just, I'd love to get all three of your perspectives on, you know, what you think needs to happen to kind of stop that.

293
00:33:33,340 --> 00:33:38,460
Oh, we have to go somewhere else besides the source to get the information to do the research.

294
00:33:39,640 --> 00:33:44,140
So Kaylin, just one, one thing, I think that it's maybe important to note here.

295
00:33:44,140 --> 00:33:50,640
So ICAO have published a cyber security strategy, which was published fairly recently.

296
00:33:50,640 --> 00:33:52,720
Salo probably knows this better than I do.

297
00:33:52,720 --> 00:34:03,540
But, but one of the things that's clearly called out in there is that states should be enabling mechanisms so that good faith researchers can collaborate.

298
00:34:03,860 --> 00:34:06,460
So, you know, ICAO recognize the importance of that.

299
00:34:06,460 --> 00:34:10,420
Hopefully more states will be recognizing the importance of that.

300
00:34:10,420 --> 00:34:11,940
I mean, Harley, I, you know, I get your point.

301
00:34:11,940 --> 00:34:15,860
Sometimes it is confusing and it's not always clear who you're supposed to report what to.

302
00:34:16,600 --> 00:34:28,920
But I think it's, you know, hopefully that's something that that is a quick win that many states can implement fairly easily, you know, to start kind of building at least the mechanisms for reporting in.

303
00:34:28,920 --> 00:34:30,780
So just my two cents on that one.

304
00:34:30,780 --> 00:34:32,780
Hopefully that's something we can move forward.

305
00:34:33,340 --> 00:34:40,040
So I don't want to diminish the fine work of ICAO and others in producing those types of guidance.

306
00:34:40,260 --> 00:34:43,660
I mean, I guess part of the point is that states should implement that guidance.

307
00:34:43,660 --> 00:34:46,520
Yeah, yeah, totally agree, totally agree.

308
00:34:47,860 --> 00:34:52,000
Yeah, I know that, Harley, you have a good point.

309
00:34:52,000 --> 00:34:56,240
And I want to say from a global perspective, we cannot enforce.

310
00:34:56,780 --> 00:35:03,340
We have to encourage the states to take actions and help them to take the necessary actions.

311
00:35:03,340 --> 00:35:06,820
That's what the International Civil Aviation does.

312
00:35:06,820 --> 00:35:15,860
But I may have a different perspective from you when we talk about cooperation and collaboration at a global level.

313
00:35:15,860 --> 00:35:18,460
As I'm saying, I'm a researcher myself.

314
00:35:18,680 --> 00:35:25,560
And I see mainly in Europe, a lot of cooperation and cooperation going on a lot of coordination.

315
00:35:25,620 --> 00:35:35,480
I participate every year in some what we call innovation days in Europe, where we put all the research community together, and we discuss several subjects.

316
00:35:35,480 --> 00:35:40,160
And last year, I was there to talk about exactly this subject.

317
00:35:40,160 --> 00:35:43,240
And I see the community very engaged on that.

318
00:35:43,240 --> 00:36:04,600
I can't specify to you now to the community how this happens all over the world, state by state, because again, there are some regional differences, there are some national differences, there are some different ways to produce regulation and to deal with the research community.

319
00:36:04,600 --> 00:36:10,700
But from a global perspective, I can tell you that the cooperation is ongoing.

320
00:36:10,700 --> 00:36:25,840
Obviously, sometimes there are some, although you may not agree with that aviation is a special industry, but I keep saying the same thing that thousands of people die on car accidents every day.

321
00:36:25,840 --> 00:36:27,840
And nobody knows and nobody cares.

322
00:36:27,840 --> 00:36:41,940
If you have one aircraft who crashes for a small thing that could be and kill 50 people, it will be on the first page of any newspaper, it will be on the headlines of any television channel.

323
00:36:42,080 --> 00:36:51,760
So that's what we call aviation as a special industry, because we are doing something that goes against the nature, right?

324
00:36:51,760 --> 00:36:53,840
We're not made to fly, okay?

325
00:36:53,840 --> 00:36:56,460
We are not made to fly, and we fly, and we fly.

326
00:36:56,460 --> 00:36:58,780
We're doing something against the nature.

327
00:36:58,780 --> 00:37:03,080
So this calls the attention of the community, because we're doing something that is special.

328
00:37:03,080 --> 00:37:05,380
We are flying and we are not made to fly.

329
00:37:05,540 --> 00:37:07,200
So that calls attention.

330
00:37:07,200 --> 00:37:16,100
So sometimes in the aviation industry, we try to be very conservative in our approach, just to avoid people.

331
00:37:16,180 --> 00:37:18,760
I will use killing as an example.

332
00:37:18,780 --> 00:37:21,180
I don't want killing going on a holiday.

333
00:37:21,180 --> 00:37:32,540
I don't want you guys going to the airport thinking, oh my gosh, am I going to arrive to my destination today or not?

334
00:37:32,880 --> 00:37:34,720
We don't want you to think about that.

335
00:37:34,720 --> 00:37:36,880
I want you to go to the airport like you go today.

336
00:37:36,880 --> 00:37:46,920
You go there and say the maximum reward is my flight is going to be 30 minutes late, 10 minutes late, one hour late, but you never think about the safety of flight.

337
00:37:46,920 --> 00:37:54,080
You never think about that, because you know that our industry has a high level of safety and is very conservative.

338
00:37:54,080 --> 00:38:07,260
I have to be honest to you, and we are evolving, we are improving this, but we are very conservative because of the attention that the industry attracts from the media when something goes wrong.

339
00:38:07,260 --> 00:38:17,640
But I think I see the research community coming very, very closer to the aviation stakeholders and producing very good material.

340
00:38:17,640 --> 00:38:28,220
And I always give the example of Europe, although I'm not European, but I always give the example of Europe because I can see the cooperation going there.

341
00:38:28,220 --> 00:38:36,580
And I'm quite happy with the scenario that I see there in terms of cooperation, industry and research community.

342
00:38:36,620 --> 00:38:46,240
Just to clarify, so the comment about aviation not being special, that was more from the researcher's perspective on whether they're going to perform the research or not.

343
00:38:46,240 --> 00:38:56,700
I absolutely agree that the way the media handles safety issues with aviation is different from things like cars, like vehicles.

344
00:38:56,700 --> 00:39:14,380
And that is something that I think is important for researchers in particular to consider as they're conducting their research, and I think it requires special outreach from both the researcher as well as whoever's facilitating the disclosure, whether it's FAA or CISA,

345
00:39:14,380 --> 00:39:18,680
to help manage the media to avoid unnecessary sensationalism.

346
00:39:18,860 --> 00:39:22,860
And on the collaboration point, I don't want to sound all doom and gloom.

347
00:39:22,860 --> 00:39:25,220
Remember, I opened with saying that I do think it is changing.

348
00:39:25,220 --> 00:39:29,540
It is changing, and it's changing in a lot of different industries, aviation included.

349
00:39:29,540 --> 00:39:34,800
The fact that we have an aerospace village at DEFCON is proof positive of that.

350
00:39:35,080 --> 00:39:43,680
It's just there is a sense that it is lagging behind in some other industries, I do think medical devices being a really good example.

351
00:39:44,160 --> 00:39:45,600
But it is happening.

352
00:39:45,600 --> 00:39:48,420
The collaboration is increasing, and I do think that that's very positive.

353
00:39:49,640 --> 00:39:59,880
And Harley, I know that within, I believe, the last year, you know, your organization has worked with the aviation industry and the aerospace industry on a disclosure.

354
00:40:00,140 --> 00:40:10,900
And so I'd be interested just to get your perspective on that process, and if it was what you expected, or if it was better than you expected, or, you know, just kind of talk us through, you know, that process.

355
00:40:11,100 --> 00:40:18,100
Because I do think, you know, it gives a good picture of where things stand now, and hopefully where they'll go.

356
00:40:18,380 --> 00:40:22,040
Okay, well, so it's a happy story.

357
00:40:22,040 --> 00:40:24,120
It's a positive ending.

358
00:40:25,920 --> 00:40:29,940
And ultimately, you know, vulnerability disclosure ought to be a positive thing.

359
00:40:29,940 --> 00:40:39,180
It ought to be a, hey, we, you know, an independent genius found a security flaw, and worked with the industry, and worked with regulators, and now it's fixed, and everybody's safer.

360
00:40:39,180 --> 00:40:41,360
That's the ideal scenario.

361
00:40:41,360 --> 00:40:43,500
And ultimately, that's how it went for us.

362
00:40:43,500 --> 00:40:51,780
One of our brilliant researchers, Patrick Kiley, who is also a pilot, discovered a flaw in CANBUS.

363
00:40:51,780 --> 00:40:57,240
So, of course, that's, you know, the network standard that enables control over vehicle launches.

364
00:40:57,260 --> 00:41:10,440
And he demonstrated that it was possible to send false messages through CANBUS that could, among other things, display incorrect information to the pilots, such as compass, and altitude, and engine data.

365
00:41:10,440 --> 00:41:12,220
And that can have a serious impact.

366
00:41:12,220 --> 00:41:20,320
So, Rapid7 worked for about a year to coordinate the vulnerability disclosure with government agencies, as well as the industry.

367
00:41:20,320 --> 00:41:24,340
There wasn't, you know, like a single manufacturer whose CANBUS is used so widely.

368
00:41:24,340 --> 00:41:33,820
And it involved a lot of collaboration with the FAA, with CISA, and the aviation ISAC, and, as I mentioned, with the media.

369
00:41:33,820 --> 00:41:37,640
And honestly, our experience was a bit mixed.

370
00:41:37,640 --> 00:41:52,000
Initially, the ISAC and the FAA were inclined to dismiss the CANBUS flaw, because to exploit it required some level of physical access to the craft's wiring.

371
00:41:52,000 --> 00:41:57,680
But that could be done, for example, by compromising an existing device on the craft.

372
00:41:57,900 --> 00:42:05,200
But the ISAC and the FAA had argued that their physical security controls around aircraft prevented this from ever happening.

373
00:42:05,340 --> 00:42:18,120
And from our perspective, you know, this was us learning about this and learning, you know, learning more about the, you know, the unique other controls that are around aircraft, but also deciding that they were right that physical controls reduce the risk,

374
00:42:18,120 --> 00:42:27,300
but that physical controls alone were not a complete substitute for secure network design, and that relying just on physical security was unwise.

375
00:42:27,300 --> 00:42:34,400
And, you know, unfortunately, to be real frank, at least in the early days, it felt like the priority was avoiding that pressure of the industry.

376
00:42:34,840 --> 00:42:43,180
On the other hand, we found CISA, within DHS, to be excellent facilitators of the coordinated disclosure process.

377
00:42:43,180 --> 00:42:51,420
And they actually went out of their way to independently verify Rapid7's findings and to put out their own advisory on the CANBUS flaw.

378
00:42:51,420 --> 00:43:00,820
And this lent additional credibility to the seriousness of our research, which was ultimately helpful in getting buy-in from the industry, from the ISAC, from FAA.

379
00:43:00,820 --> 00:43:05,900
And importantly, Rapid7, we were also, you know, very responsible as researchers.

380
00:43:05,900 --> 00:43:30,880
We, you know, worked privately with these entities and worked under embargo with the media long before going public in order to put the findings into context and to note that the risk was reduced because of physical security controls to avoid sensationalism and so that we could come go out publicly when there was a greater understanding of what exactly the issue was and what mitigations were possible.

381
00:43:30,900 --> 00:43:35,420
And we recommend that, you know, researchers take a similarly cautious approach.

382
00:43:35,420 --> 00:43:43,580
And so in the end, in the end, after about a year of verification and coordination, the flaw was disclosed publicly in the white paper.

383
00:43:43,580 --> 00:43:56,220
There was not a ton of hype in the media, although it was acknowledged in the media, and we think it was ultimately a win for collaboration, coordinated disclosure, and the value of security research in avionics systems.

384
00:43:58,810 --> 00:44:03,030
Thanks, Harley, for walking us through that and in your experience.

385
00:44:03,090 --> 00:44:07,870
I am glad that we were able to end it on a happy note of success.

386
00:44:08,450 --> 00:44:25,670
Coming from, I'm a media communications person, so I do know how hard it is, you know, in the cybersecurity space, especially, you know, it's hard to get the stakeholders at an organization to get on board with, you know, talking to the media and doing things like that.

387
00:44:25,670 --> 00:44:28,110
And then, you know, that only helps to build trust.

388
00:44:28,110 --> 00:44:36,650
I mean, there's a great core of cybersecurity journalists out there who truly want to get the story right and they want to get the facts out there and they're not about sensationalism.

389
00:44:36,670 --> 00:44:44,670
And so I do think that, you is going to help this process in a lot more ways than once.

390
00:44:44,670 --> 00:44:53,130
I'm glad that you brought it up because I do think there are trusted, you know, media advocates out there that want to get it right because they want to see this happen more.

391
00:44:53,130 --> 00:44:58,630
They want to see, you know, the communities working together, research being disclosed, and then acted on.

392
00:44:58,630 --> 00:45:05,190
And so I'm really happy to hear about your process and the success that you guys had at Rapid7.

393
00:45:05,550 --> 00:45:08,590
We're running up a little bit on our allotted time.

394
00:45:08,590 --> 00:45:13,830
So I just want to make sure that each of you have, you know, a few minutes to say any final parting thoughts.

395
00:45:14,290 --> 00:45:17,250
And again, just thank you so much for taking the time.

396
00:45:17,250 --> 00:45:19,810
It's been just a pleasure speaking with you.

397
00:45:23,090 --> 00:45:24,250
Legs first.

398
00:45:24,970 --> 00:45:25,870
Thanks, Paulo.

399
00:45:25,870 --> 00:45:33,610
I was going to say, Harley, that's, you know, such a great example of Rapid7's research and your own research and such a positive outcome.

400
00:45:33,710 --> 00:45:37,110
And I think, you know, hopefully in future it won't take a year.

401
00:45:37,110 --> 00:45:53,670
Hopefully in future people on both sides will be more aware of, you know, the context and the environment and the requirements, the situation, so that those disclosures can happen faster and you can have, you know, an overall positive experience, not just like partially positive.

402
00:45:53,990 --> 00:45:56,850
But no, that sounds like really, really great work.

403
00:45:56,850 --> 00:46:00,690
And I just want to say thank you to the Aerospace Village for having this panel today.

404
00:46:00,690 --> 00:46:02,110
I think it's really positive.

405
00:46:02,110 --> 00:46:06,430
And I'd also like to thank the GoodFaith researchers out there.

406
00:46:06,430 --> 00:46:08,990
I think that their work is really, really important.

407
00:46:09,770 --> 00:46:10,950
You know, we do need it.

408
00:46:10,950 --> 00:46:13,090
The aviation industry needs it.

409
00:46:13,130 --> 00:46:20,590
And the only ask that I have is that they don't give up on building those bridges and they do reach out and they do try to get in touch.

410
00:46:20,610 --> 00:46:24,230
Because I know, you know, we as a regulator really do want to have those conversations.

411
00:46:24,230 --> 00:46:25,710
So thank you.

412
00:46:28,390 --> 00:46:32,410
Just like to thank you for the opportunity to be here with you guys.

413
00:46:32,410 --> 00:46:33,930
I really appreciate that.

414
00:46:33,930 --> 00:46:51,150
And we encourage the research community to come closer and closer to the regulators, to the avionics manufacturers and the aircraft manufacturers, because they all need the work the research community does.

415
00:46:51,150 --> 00:46:53,630
For example, in ICAO, you also need.

416
00:46:53,630 --> 00:46:59,830
The only difference is that papers presented to ICAO, most of the time, they are not scientific papers.

417
00:46:59,830 --> 00:47:01,270
They are more technical papers.

418
00:47:01,270 --> 00:47:13,150
So you have to adequate the language because the community is a very broad community that sometimes they will not get if you go on the scientific language.

419
00:47:13,150 --> 00:47:21,450
So I really encourage anybody to come to us and present whatever research you're doing.

420
00:47:21,450 --> 00:47:25,710
We are always open to receive information from different sources.

421
00:47:25,710 --> 00:47:27,110
And we really appreciate that.

422
00:47:27,110 --> 00:47:27,930
And we need that.

423
00:47:27,930 --> 00:47:30,130
As I said, I'm a researcher by myself.

424
00:47:30,130 --> 00:47:42,230
And I really appreciate when I have to cooperate with my peers in the academia and translate what they are saying into international civil aviation language and put to the community to be discussed.

425
00:47:42,230 --> 00:47:43,510
I really appreciate it.

426
00:47:43,510 --> 00:47:45,290
And thank you for the opportunity again.

427
00:47:47,680 --> 00:47:50,000
And they kind of said it all.

428
00:47:50,700 --> 00:47:57,040
So at the risk of repeating, but thank you very much for having us on the panel.

429
00:47:57,040 --> 00:48:01,780
Thanks for hosting the aerospace village at all and DEFCON.

430
00:48:01,780 --> 00:48:05,880
Thanks for working so hard to build bridges between these different communities.

431
00:48:06,200 --> 00:48:09,500
Also thank you to the security researchers for the work that they're doing.

432
00:48:09,500 --> 00:48:14,660
The aviation industry for slowly changing, for changing and accepting this community.

433
00:48:14,660 --> 00:48:18,820
I know that it's painful and they're not always the easiest community to deal with.

434
00:48:19,340 --> 00:48:34,680
And I guess one last thing, I suppose, it's kind of poignant that we're doing this remotely and that everybody's under a lot of stress and probably missing this annual gathering of such a unique and colorful community.

435
00:48:34,680 --> 00:48:37,720
So just much love to that community and stay safe.

436
00:48:38,580 --> 00:48:40,200
Thank you all so much.

437
00:48:40,200 --> 00:48:50,540
And yes, I hope to Harley's point that next year or the year after we can do this panel again and we can be in person and I can meet all of you.

438
00:48:50,540 --> 00:48:52,520
But thanks again from the aerospace village.

439
00:48:52,520 --> 00:48:58,240
We so appreciate your time and your insights and just have a great rest of your day.

440
00:48:58,240 --> 00:48:59,200
Thanks.