start	end	text
4730	7810	Hello everyone, this is Mike Vangardi with the Boeing Company.
7890	10470	And I'm here to talk to you about product cybersecurity,
10470	16050	specifically the Secure Airplane Development Lifecycle used within Boeing Commercial Airplanes.
18900	22500	And as a short primer on what I'll be talking about today,
23260	27600	everybody I think understands that the aviation industry is focused on safety.
28340	31060	Everybody in the Boeing Company works hard to achieve this.
31380	34740	We also have a new concept called the E-Enabled Aircraft.
34740	39820	And what I mean by that is that we now have airplanes that have off-board connectivity,
39820	46520	that may employ the use of commercial off-the-shelf software and services like the Internet Protocol Suite.
48080	50680	But so with the good comes the bad though, right?
50960	55540	Because of this, we now need to contend for cybersecurity threats.
56260	60740	And so the way airplanes are developed now need to take this into consideration.
60740	65680	And so malicious intent via cyber methods is an air concern that needs to be accounted for
65680	68200	during design, development, test, and analysis.
72530	77850	So developing a product that is both safe and secure is of the utmost importance to the company.
77850	84610	We also need to protect our airline customers, protect our brand, and the aviation system as a whole.
84990	87830	In order to do this, we need to secure the airplane,
87830	91590	but we also need to secure those data links, that connectivity,
91590	96770	and build a company culture that puts security right up there where safety is today.
96870	101290	Only then can we truly have an airplane that's secure throughout its entire life cycle.
105610	110770	Now it sounds simple, right? So let's talk about the complexity and what this really means.
111130	116450	Now this chart really kind of shows that aviation is pretty large in scope,
116450	119830	and you can have all the security you want on the aircraft,
119830	124630	but if we don't do our part to the rest of the ecosystem, meaning the ground systems,
124630	131130	maintenance, you know, the federated systems that might come in through STATCOM or Global Navigation,
131130	134590	then we're not as secure as we need to be.
134590	142050	And so Boeing is spending a lot of effort and time working across these different parts of aviation.
142710	148470	And again, we'll talk about some of that stuff here in the next few slides.
150790	157470	And so as I kind of talked about connectivity, we have seen a growth in this in the enabled aircraft.
158170	163670	Unfortunately, with all the good, you know, comes the need to drive cyber protections now.
163910	167990	And so this is a new norm within aviation.
168090	173530	Like there was a time when cybersecurity wasn't a big deal, but those days are long gone.
173570	177570	And so this is going to require protections that are both on the airborne assets,
177570	180830	you know, the avionics, the airplane systems, and those type of devices,
180830	185930	as well as processes and controls on the ground-based systems.
186390	191650	To achieve this, you know, because airplanes are a global commodity that fly all over the world,
192090	194890	information sharing is one of those key enablers.
195030	201070	You know, we partnered with the Aviation Information Sharing and Analysis Center to get some good threat intelligence
201070	205150	and basically just to build trust and relationships.
205150	211930	So in the case of a cyber event, you know, that can affect multiple stakeholders in this industry,
211930	216530	we have those relationships to be able to, you know, share that data.
216730	219650	And we're actually getting to the point where with the connectivity,
219650	226330	we're now going to need a way to manage all these connectivity solutions and basically the networks,
226330	228850	just like we do on traditional ground systems.
229310	231410	So that's definitely going to be the norm.
231410	237930	Then I got a couple of these line charts to just show the relationship right now between safety and security.
237930	240290	So on the left, we have safety events.
240290	245050	And what you'll see is that over time, those safety events become less common.
245050	250830	And actually, you know, based on good learning from mistakes, learning from history,
250830	254070	you know, they tend not to re-show up or repeat themselves.
254850	259830	Conversely, though, on security, though, you know, we know that they attack surface grills over time.
259830	265430	And so in the case of an aircraft, which typically has a life cycle of, you know, close to 30 plus years,
265430	269950	if you were to never update, you know, the systems on the airplane,
269950	277210	what kind of security issues might have popped up in between the initial certification and that time frame?
277210	280090	So we know that that's an issue to solve.
280090	281770	And we are working towards that.
281770	286410	And I'll kind of talk a little later about what we've done to help mitigate that.
288490	293370	Now, Boeing Commercial Airplanes has been involved with network security since 1994.
293630	298710	That was when we first released the white paper for the 777 that really looked at what would happen
298710	303730	if you used a tamper maliciously or intentionally tamper with software.
304570	308930	So we had some lessons learned from that. It kind of opened the eyes to some of our designers.
309470	313590	Then came the 787 with the E-Enabled, the first E-Enabled platform.
313590	320010	And we've actually continued to, you know, add those type of systems to the rest of our fleets.
320010	323790	So the 377s and 777s and 477-8s.
323790	330690	And essentially, the FAA at the time has realized that, you know,
330690	336310	existing regulations did not adequately account for intentional misuse.
336430	338510	And so we have something called special conditions.
338510	342390	Those are the requirements laid on us by our regulator.
342390	344530	They kind of fit into two different buckets.
344530	348670	Protect the aircraft from internal passenger access, those that want to do harm.
348810	353070	Protect the aircraft from those trying to attack it external to the aircraft.
353610	357350	And so right now, we're actually in the 2020 timeframe.
357810	361970	We have some new guidance coming out that is a little more inclusive.
361970	364730	And talking about securing the whole ecosystem.
364730	368210	I'll talk about those standards here in a bit.
370710	376210	And so let's talk about what it means to have a secure aircraft architecture.
376690	382350	And so one of the things that airplanes are built around is something called domain model.
382350	387730	And they're specific to define an A-ring 6-6-4-4-5.
387730	390710	I have a diagram on the next slide that will give a little more explanation.
390710	393470	But essentially, there are three different trust levels on the aircraft.
393470	395770	You have your front of aircraft, the aircraft control domain.
395770	402890	Those are systems that really have a command and control impact to the aircraft.
402890	407450	You have those that sit in the airline information systems domain or services domain.
407450	413070	Those are systems that are used to support maintenance or aircraft efficiencies and whatnot.
413070	418410	Then we got the PIS domain or passenger and information entertainment systems domain.
418670	421550	Now, each of these domains has different trust levels.
421550	427890	And they also have different designs and protections to mitigate any intentional cyber intrusions.
427890	435630	These protections, along with some administrative physical access and operational controls,
435630	439830	are what holistically together provide security for an aircraft.
441290	446050	Now, as I briefly just talked about on the previous slide,
446050	450610	the A-ring 6-6-4-4-5 model is something that's in a published specification.
451750	456530	Actually, this view right here, I kind of broke it into different views.
456570	460670	A security view, responsibility, airline officer roles and functions.
460670	465810	This is similar to a software architecture design pattern, say a 4-plus-1,
465810	471930	where you have different concurrent views to account for different aspects of those domains.
471930	476590	So, in the security view, we have what is done in the closed part of the network, the aircraft.
476590	478330	That's done by the airframer.
478330	485390	We have those responsibilities that are done on the private side, which are those for the airline to control.
485550	488690	And then we have things, you know, the passengers.
488690	494410	As myself, I'm a passenger. I have the freedom to bring my own devices, whether it's a cell phone or a tablet.
494770	501370	If I'm on the ground, I can use AT&T or Verizon, you know, to connect to the Internet or other stuff like that.
501370	507130	So, there's different trust domains. They have different roles, and they each come with their own different threats.
510360	517940	To give a little more granular view on the connectivity and how they relate to the aircraft domains,
517940	522460	this is a pretty busy chart, but it just kind of shows you there's a lot happening right here.
522460	526380	So, on the far left in the red, that's our aircraft control domain.
526380	534060	Those are systems that are, again, needed for safety of flight, typically, and command and control of the aircraft.
534200	538820	Some of the data links that are used on there are your LBAN, SATCOM for safety services.
538820	543940	That would encompass things like ATN-OSI, ACARS.
543940	553480	It will make use of mediums like VHF if you're over terrestrial networks, SATCOM if you're oceanic.
553480	557800	You then have the middle of the airplane, which is AISD.
557800	565260	There's a lot of different ground network interfaces for that, mostly broadband, anywhere from cellular to Wi-Fi.
565300	567740	You also can use SATCOM in that regard.
568600	572040	That SATCOM, though, is a KUKABAN SATCOM.
572040	580080	Again, that domain is mostly for airline operational use to support flight crew, maintenance crews, and cabin crews.
580080	584040	And then at the backside of the aircraft, we have, again, the entertainment domain.
584040	588900	And this is what, as a flying passenger, if you've ever wanted to get internet access while you were flying,
588900	593160	you're going to connect to your IFAC, your flight entertainment connectivity server.
593160	598460	That's going to, again, normally be a third party like Iridium or MRSAT.
598680	600520	That's going to provide that for you.
605020	611120	Now, this Venn diagram right here is to just kind of show the intersection of two main things.
611120	620080	So we all know that aviation safety is by far the main focus of all regulations in commercial airlines or commercial aviation.
620280	628040	But then we also have a lot of these other systems on the aircraft that maybe have nothing to do with safety,
628040	633800	and they're just for quality or passenger experience.
633800	636220	That's the aviation cybersecurity.
636500	640040	Again, there's not a whole lot of regulations around that.
640040	644820	But in that intersection, that inner circle, is where we have our aviation cybersafety.
644820	647540	And these are under purview of the regulator.
647960	657800	And this is really making sure that systems that have a criticality associated with them based on their design assurance level,
657800	662720	that those systems are robust against cybersecurity concerns.
662720	669680	In other words, to say that is to reduce the chance or likelihood of a safety event happening in these cyber lanes.
669680	672440	So that's, again, a new area that's getting a lot of focus.
672440	678680	That's where Boeing and its trusted partners spend a lot of time focusing on.
680740	686300	And so what else is Boeing doing right now to get to that secure and safe aircraft?
687020	689760	We actually do the airplane certification.
689760	698340	Something that is different than a typical airplane certification is now there is a separate activity to account for the security aspects.
698340	704640	So almost like a security certification just to look at the malicious misuse.
705040	712140	This demonstrates the security compliance and verifies that the airplane meets the stringent security requirements.
712140	720840	Also makes sure that any other guidelines and things that the regulator is going to review is also accounted for.
721320	728980	We're spending, like most companies, we're always trying to innovate and find new cool things to make us more competitive,
728980	731560	to make our customers find more value.
731860	734880	And so we're partnering up with both internal and external parties.
734980	736460	Some of these are private entities.
736460	745340	Others are like academia and universities to go ahead and work together to come up with some new stuff.
745520	747460	Things like machine learning and AI.
747460	750600	Blockchain, got to throw that out there because that was the buzzwords of today.
750820	756540	But you kind of look at those and work with those different folks to come up with new solutions.
756820	759500	We have a dedicated team that's looking at air-to-ground interfaces.
759500	765880	How do we get more data off the aircraft so we can do protective maintenance and trending and things like that.
766800	771460	We also spend time doing risk assessments and risk management.
771680	775340	We subscribe to the NIST framework, cybersecurity framework.
775500	782620	This helps us focus on where we're going to, you know, what the big rocks are to go solve and spend money accordingly.
783260	788100	Something else that's kind of aligned to risk management is the use of tabletop exercises.
788280	793660	Red teaming, war gaming, different words to say the same thing as we're going to look at, you know, with different stakeholders
793660	801960	to see, you know, are our assumptions good, where should we be focusing, are there any gaps in those assumptions and whatnot.
802260	812360	And a new thing that our team within Boeing and product security has just stood up is a team dedicated to doing product security incident response.
812360	819620	So as we get more investing partners and working with the security researcher community,
819620	827420	we need folks that are dedicated to handling any issues so that we can mitigate and fix those accordingly.
827600	836980	And also to account for the sustainment. Now, most folks realize that the operational phase of any system is the longer period and the most costly.
836980	850980	So because aircraft, you know, are 30 plus year flying machine, we have to do the security sustainment activities to make sure that those aircraft remain cyber resilient, cyber secure over that life cycle.
851240	860400	To help us, you know, investigate that, we do a lot of testing. And so we have a dedicated secure aircraft cyber test lab.
860400	872940	This lab has a smattering of different systems that we can go use to test, but it also has reachback capability to other parts of the company and different other labs, whether they're different configuration or other systems.
873520	883300	This allows us to do penetration testing, both in house as well as with, you know, trusted third parties that we brought on board or collaborated with to go look at stuff.
883300	892480	And then lastly, we have these public and private partnerships that we are doing. You know, we're only as good as the folks we surround ourselves.
892480	899420	And so we take an interest in leading industry standards activities, working with their European counterparts.
899600	905180	One of the initiatives that we're tied into is their aircraft cyber initiative.
905180	910800	And that's a tri-chair with the FAA, DHS and DOD and working with some of those special programs.
910820	917020	And then I talked about the aviation ISAC. And that's something that we're heavily involved with.
919380	923980	And so I just kind of talked about our secure lab. We call that our SCORE lab.
923980	928920	And that stands for our Secure Center for Operational Research and Experimentation.
929180	934920	We do a lot of different things in here from R&D to incident response, forensics if needed.
934920	942400	Again, this is just one of the capabilities that, you know, as the airframer having access to the embedded avionics,
942400	952880	the different avionics buses and having all those broke out into a way we can have access to them really helps with demonstrating, you know, the security of the airplane.
956010	963110	And again, as part of that new focus on working together again with the folks like yourselves here at DEF CON,
963110	968870	we've stood up a vulnerability disclosure kind of program. We didn't have one.
969130	976130	And so, you know, that's something we just stood up. You can see it there on the URL right there.
976150	980290	That helps us and, you know, folks that do responsible disclosure.
980290	990230	Also trying to partner with, again, the Aerospace Village and other organizations that are really focusing on making good partnerships,
990230	997610	education and teaching each other, you know, both sides of the desert, the aviation side and the security side.
998050	1007630	And again, those partnerships I just talked about, like the ACI working with different national labs, airlines, consultants or whatnot.
1007690	1018430	Again, the goal is to do all of this work together to identify new issues, new gaps, things that maybe we didn't think about so that we can make our products better, safer, more secure.
1021790	1029830	So speaking about a secure airplane development, I wanted to talk about some of the processes that we use to go do that.
1029830	1037630	So we have the concept of a System Engineering V and System Engineering, but we focus on a System Security Engineering V.
1037850	1043830	And what that really means is it still describes the same systematic process for doing design and development,
1043830	1049510	but adding those security activities as an abstraction layer on top of the normal system development.
1049510	1056690	And so what that means is, you know, we'll do system security analysis, we'll make sure, we'll do requirements verification,
1057210	1064750	make sure that those systems have all the right requirements to reduce the risks based on those type of activities.
1065390	1070950	Threat modeling, attack surface analysis, similar to how we do fault trees and fault hazard assessments,
1070950	1079290	we do the same thing for security through a threat tree and looking at the anode gates that could lead to a security event.
1080110	1086110	Those all aggregate up to what we do then at the airplane level. So we do this for each system on the aircraft,
1086110	1091630	but then what does that look like? You know, maybe you don't have a significant risk at a single system,
1091630	1098190	but if you were to aggregate all these different risks across the integrated aircraft architecture, does your analysis change?
1098190	1104610	And so we do it at the airplane level as well. And then we also do the testing on some things you can't analyze away,
1104610	1110450	you can't do through analysis. And so especially when we're talking about robustness and resiliency,
1110450	1116330	we do a lot of the testing at the system and aircraft level, and that covers your traditional requirements based testing,
1116330	1121950	as well as those type of more invasive, the penetration testing, the robustness,
1121950	1126650	and then looking for vulnerabilities and things that have already been documented.
1128850	1132970	Kind of talked about the security standards, and there's a whole lot of them in aviation.
1133110	1138010	The top three are probably the most centric to aviation cybersecurity right now.
1138010	1145310	And those are DL-326, DL-355, and DL-356 and their European counterparts and Euro-K.
1145450	1151150	Those are all centered on how to do security risk assessments, how to do aircraft secure design.
1151150	1159090	And actually, they're going to become the new methods of compliance on how to certify aircraft from a security standpoint.
1159390	1166230	I listed a couple others, ARINC 811, that's an older, it's a little stale, but still has good information on it.
1166470	1172570	But this kind of risk assessment guide and risk management framework, although not aviation centric,
1172570	1181030	they still have a lot of good information. A couple of these are just specific to how to do security event logging,
1181030	1186290	832, 835 is how to do secure software loading using PKI and digital signatures.
1186550	1193970	Spec 42 is used within aviation as more of a digital information and certificate policies and whatnot.
1194690	1201710	So these are just, again, some of the industry best standards that we use to help build and design secure aircraft.
1203210	1213630	Some of the principles that are called out, like in, say, DL-356A, and again, other places within industry are kind of listed on the slide here.
1213630	1217870	So we do get a derived benefit from having such a strong safety culture.
1218450	1224230	That means that, you know, typically we want to be safe by default, but we're working toward being secured by default.
1224530	1230130	Now these can be at odds sometimes. And so there's always de-confliction and trays that have to happen.
1231050	1236190	Integrity monitoring, defense in depth, you know, availability, network segmentation.
1236190	1242590	These aren't really new, or these aren't specific to aviation, but again, the principles still apply to us.
1242890	1247670	Something that I think is a little more unique on aviation is configuration management.
1247930	1253390	So we have the ability to do maintenance and do what we call data loading and install new software on the aircraft.
1253390	1259110	Now to protect that against misuse, we have a lot of different inhibits and interlocks that prevent that.
1259110	1269550	Some of this is discrete logic. We might use a mechanical interlock or an avionics label or bus, like 429, that you need to be in a certain state to accomplish that.
1269830	1277410	We do look at systems at design assurance level for their criticality as called out on DL-170AC.
1277410	1282610	We also are now looking at security assurance level that is called out on DL-356.
1283150	1291270	And then access control and authentication, least privilege. Again, these aren't unique to aviation, but we're still leveraging them the best we can.
1294480	1302820	And then just to plug to the AISAC, the Aviation Information Sharing and Analysis Center, I kind of talked to them a little bit before.
1303140	1309440	But again, when we're talking cybersecurity and we're talking an industry like this where it has such a global impact, right?
1309440	1319920	If you have, say, an aircraft was to get hacked or have some major issues, you would need to know that because that could propagate through a fleet of aircraft across the world.
1319920	1325600	And so to help mitigate that, again, we're part of the Aviation AISAC. We help stand that up.
1325640	1338060	We engage regularly with both airline customers, our supply base, other industry and government partners, again, to collectively build a better and more secure industry.
1340620	1343840	And so just a couple more slides here.
1344140	1359740	So managing ongoing risk, I talked about us doing tabletops. We tend to do this through multiple iterations, whether it's an existing system that's been out there for a while or a new system that we want to bring online.
1359820	1368400	But essentially, we want to bring the right people and stakeholders together, get different views and what that really means, understand what our threats are.
1368400	1373780	What do we need to do in the future to build more resilient aircraft?
1374040	1382120	And so that's really pushing us towards, again, getting folks aware of why cybersecurity on aircraft matter and building that new cybersecurity culture.
1384360	1392820	So in summary, just wanted folks to understand within communities like this is that we don't just stick stuff on an aircraft.
1392820	1398460	We actually spend a lot of time looking at cybersecurity and it's looked at across the ecosystem.
1398460	1402360	We're leveraging the industry best standards and practices.
1402520	1409660	We embed security throughout the entire product development lifecycle.
1409980	1419700	One of the ways that we help to be more secure is collaboration with our stakeholders, because that's really the way that we can reduce risk collectively.
1419700	1423580	We do take a proactive stance on managing ongoing risk.
1423580	1427540	And so it just doesn't happen by itself.
1427540	1432060	Cyber safety, cybersecurity, and cyber resiliency are key principles within Boeing.
1432940	1439420	And ultimately, the message I want to share with the folks here at DEF CON and Aerospace Village is we want to proactively work with you.
1439420	1445100	We want to work with the researchers, want to work with folks that are interested in making the industry better and more secure.
1445560	1452720	And so hopefully this gave you a little bit of insight into how Boeing is managing a secure lifecycle.
1452720	1456580	And going forward, hope to work with you all someday soon.
1457120	1459640	Thanks for watching, and we'll talk to you later.