Avionics News November 2022 - 39

routers that Collins Aerospace has introduced over the past 10
years or so, which have all featured increasingly sophisticated
cybersecurity technologies as part of their design.
" If we go back to 2012 or so since we started introducing
connectivity to the aircraft, as an avionics manufacturer,
we have had what is termed 'new and novel' technology
guidelines to consider, " he said. " Because connectivity has
become so ubiquitous and valuable, our regulatory partners
in the FAA, EASA and ANAC (Brazil's aviation regulatory
agency) are all creating special conditions with which these
systems must be compliant.
" To help streamline the process, an aviation rulemaking
advisory committee was formed in 2014 to recommend a new
regulation for air transport systems, which would set a common
design target for suppliers. We expect that new rule to hit the
FAA's books in early 2023. "
Morrissey said that, in short, the new rule states the OEM
or supplier must consider cybersecurity as part of the aircraft's
overall safety risk assessment.
" Ultimately, we have to ensure the operational safety of the
aircraft, " he said. " We have to make sure it is resilient to any
intrusion or interference. The solution is really making sure that
when you design and build any component, you've taken every
threat into consideration and layered mitigations for them all.
" In addition, the new rule also states that you have to provide
operational guidance that tells the operator how to maintain
the ongoing security of that system. When we develop any
kind of digital connectivity component today, we're not only
engineering functional hardware and software but also designing
in the security technologies which ensure that those systems
remain cyber-resilient during operation. "
Keeping your bits from
becoming a pirate's booty
While all the new industry rules and cybersecurity
equipment guidelines are great, what can you do today to
help keep your personal and company information from
falling into the wrong hands?
One excellent resource is the NBAA's Connectivity
Subcommittee (learn more at https://bit.ly/3fAFHcV). The group
provides various insights and guidelines to help you answer your
cybersecurity questions.
" Practicing good cyber hygiene is something everyone can
easily do and is a nice start, " Bartolotta said. " However, securing
the cabin, logbooks, flight deck, and maintenance access with
consistent monitoring is the next step we must take. It's a whole
new area for most pilots and aircraft owners.
" To help provide guidance, there's a new standard in the final
stages of development called ED-206, Guidance on Security
Event Management. It's a great resource for civil aviation
authorities and the aviation industry to address information
security threats that can affect aviation safety. "
Bartolotta explained that the new standard would also have
procedures for identifying and reporting security events, which
most operators don't. They just sweep security issues under the
rug, which is a mistake.
According to leading cybersecurity providers, data about
when, where and how a system is hacked is critical to helping
create better security protocols and defense systems.
While ramping up cybersecurity awareness and protocols
is a much-needed effort, realistically, it's just adding one more
layer to a pilot's already stacked to-do list. It's no wonder that
cybersecurity is low on an operator's to-do list.
SystemX marks the spot
Bartolotta said that CCX Technologies, an Aircraft
Electronics Association member company since 2018, has an
onboard platform cybersecurity solution called SystemX that
seamlessly and automatically handles the majority of onboard
cybersecurity processes.
" It's a monitoring, detecting and alerting system for aviation
onboard platform cybersecurity, " he said. " It protects an
aircraft's onboard network, including the ARINC 429 databus,
and provides a robust intrusion detection and prevention system
for all of the connected components.
" It has an open design for the software, so it easily interfaces
with all aircraft connectivity systems. It operates in both
bandwidth- and latency-restrictive channels, including satellite
and terrestrial networks. Overall, it's an easy, unobtrusive way to
greatly improve the aircraft's cybersecurity posture. "
Cybersecurity begins at home
Of course, while the new cybersecurity capabilities that
Collins Aerospace, CCX Technologies, and others build into
their new connectivity components are all great, they're just
pieces of solving a complex cybersecurity puzzle.
" One of the most valuable things an operator can do is
to maintain the cybersecurity health of all their supporting
ground systems, " Morrissey said. " For example, your
laptops, iPads, data loaders, and all digital equipment used to
maintain the aircraft's digital network need to be kept clean
from digital contamination.
" Not that it's a significant risk, but it's one thing you have
direct control of, so don't use those units for anything but
working on that aircraft. If you need to download information
for the aircraft, ensure it's from a 100% trusted and secure
source. Even the USB drives you use to transfer information
should be handled in a controlled fashion. "
Continued on following page
avionics news * november 2022 39
https://bit.ly/3fAFHcV
Avionics News November 2022

Table of Contents for the Digital Edition of Avionics News November 2022
