Our approach to Aviation Cyber Security Assessment

Our approach is focused on Information Technology (IT) and industry-specific operational technology (OT) systems.

1

Pre Engagement

The attack surface of an airport is complex, and the single most significant challenge in aviation cyber security is the sheer volume of different entities requiring access: passengers, crews, airline staff, security personnel, Police, Customs, and other government agencies, freight, and meal service, to name a few. As a result, gathering requirements, arranging meetings, and gathering information are all critical components of this stage.

2

Classification of Critical Assets

Identify the critical information assets and identify them appropriately to create a separate inventory of them.

3

Risk Assessment

HackersEra performs in-depth risk assessments of aircraft architecture and provides customers with a prioritized list of risks, as well as potential consequences and mitigation strategies. Our evaluations are carried out in accordance with ISO 27005, NIST SP 800-30 or other customer-specified standards.

4

Assessment of Aircraft in operation

We conduct cyber security assessments and testing onboard your aircraft, which includes visual inspections of the systems and their surroundings, crew interviews, and system and network testing.

5

Risk Treatment

We assist you in closing cyber security gaps efficiently through the formulation of improvement plans that consider systems, the human aspect, and management procedures, all of which are based on a methodical assessment.

6

Vulnerability Analysis

Our aviation security expert identifies potential flaws in aircraft architecture and recommends steps to mitigate the risk.

7

Penetration Testing

Our aviation security professionals work in black, grey, and white box modes to determine whether and how attackers can compromise, manipulate, and steal data from aircraft components and systems (e.g. IFE & IFC systems, cabin management systems, Access, Departure and Passport Control Systems, Reservation Systems, Hazardous Materials Transportation Management,e-Enabled ground and onboard systems, Flight traffic management systems, Airplane Information Management System, Aircraft Communications Addressing and Reporting System, etc.).

8

Employee Training

Our classroom instruction includes classes on general awareness, management, technological skills, and hacking. Our e-learning solution may be delivered onboard or in the office, enabling your personnel to address critical components of any cyber security system – including the human factor.

9

Emergency Response Exercise

For cyber security incidents that require immediate attention, our experienced emergency response team provides real-time support to airframers and airlines. The HackersEra team conducts an event analysis, recreates the attack scenario, and initiates the remediation procedures. The HackersEra team can greatly reduce reputational damage and possibly eliminate the need for costly recalls by strengthening the client's ability to respond on both a technical and managerial level.

10

ISO/IEC 27005 Certification Preparedness

HackersEra evaluates and assists you in improving current documentation in order to assist you in preparing for certification.

11

Report Submission

Once the assessment is complete, a detailed written report outlining each observed and or exploited vulnerabilities, along with the root cause analysis and categorisation along with mitigation and confirmatory retest certificate if the need arrives.

12

Support

What really makes us stand apart is our excellent and round the clock support, making sure our clients never have to witness hurdles in the business.

What we offer

IoT Device Penetration Testing

Embedded Device Security Assessment

SDR Exploitation

ICS / OT / Security Assessment

WEB / API / Mobile Application Security Assessment

Secure Code Review

Firmware Security Assessment

Red Teaming

Physical Pentest

Scenario-Based Penetration Testing

End-User Device Testing including Kiosks

Coordination and Assistance for Third-Party Risk Advisory Certification

Coverage

  • Assessment of the Aircraft Passenger Domain
  • Domain Assessment of Aircraft Information Services
  • Assessment of the IFE/security IFC's
  • Security Assessment of Satellite Terminals
  • Assessment of Aircraft Domain Segregation
  • Assessment of Gatelink wireless security (aircraft and/or airside)
  • Reverse engineering of avionics hardware
  • Evaluation of avionics network protocols
  • Assessment of aviation radio frequency security
  • Inspection of data loading / maintenance crew equipment security
  • Inspection of e-enabled ground and onboard systems
  • Security Review of Electronic Flight Bags (EFB)
  • Customized Red Team exercise at the airport.

Why

Aviation Cyber Security Assessment

In recent years, we have seen significant attacks on large organisations, critical infrastructures of various types, governments, and SMEs with varying degrees of sophistication and severity of impact.

As one might expect, the aviation industry is no exception. However, significant distinctions exist between financial services, insurance, and e-commerce, to name a few. Transportation, particularly aircraft, has a critical life safety issue. If a cyberattack is successful, it can result in the death of many people, resulting in a total disaster. If that weren't enough, it could jeopardise trust and, consequently, the brand.

Aviation cybersecurity is a subset of general cybersecurity but with the added risk of losing a life.

Additionally, aviation and aerospace systems must display real-time behaviour and be extremely reliable. These systems are mission-critical, necessitating rigorous certification and cybersecurity measures.

Why

HACKERSERA?

Creating a security strategy will assist you in shoring up your position. We have some of the best cyber security researchers on our team, which means we are familiar with airports, planes, and other hardware attack surfaces, as well as their associated risks. Our aviation cyber security experts can assist you in identifying vulnerabilities and process gaps, enabling you to more effectively defend against the numerous threats you face. We can conduct tactical security audits of your aircraft, hardware, and land-side operations by simulating bad actors in order to identify short-term security 'quick wins.' System and software reviews prior to deployment to an airline fleet can result in significant time and cost savings.