With multiple threats looming and industry standards lacking, Air Traffic Controllers need to take responsibility for their cybersecurity. How vulnerable are your systems and data?
With the continued digitization of the Air Traffic Control industry, cyberattacks are an ever-growing threat looming over us.
The industry as a whole has been relatively slow in their response to what can no longer be considered a “new threat”, with no industry-wide standards to govern data integrity and security.
GuardREC recently hosted a webinar on cybersecurity, and based on the response we got from our audience the information we shared was an eye-opener. Many were unaware of some of the threats to their systems, how vulnerable their systems are, and the solutions for preventing and withstanding cyber threats.
What is cybersecurity?
Albeit an oft-used trope, nothing is more valuable than data. This rings especially true in our rapidly more digitalized society, where everything is connected and the risk of a security breach is ever-growing.
Cybersecurity is the protection of the privacy, integrity, and accessibility of devices, networks, systems, and data information.
The definition may vary slightly depending on its source, but what it boils down to is that cybersecurity is about protecting your data services from a potential cyber threat and being able to recover if an attack should occur.
Types of cybersecurity
Cybersecurity is not a single application, but rather a system of processes and protocols working in tandem to protect your information and services from potential breaches and disruptions.
A solid cybersecurity set-up may include:
- Critical infrastructure security
- Application security
- Cloud Security
- Data loss preventions
- End-user education
Cybersecurity in Air Traffic Control
Air Traffic Control serves a critical function at any airport, and society in general, and is therefore subject to being targeted by attacks.
Due to the potential threat to national security, attacks on airports – both physical and digital – are met with harsh penalties to deter criminal engagement. As a result of this, cyberattacks on ATC are still relatively uncommon, however, there are still multiple examples of security breaches, loss of personal data, etc.
Protecting OTAs and controllers
OTAs and air traffic controllers are exposed persons who are important to protect. This was tragically exemplified a few years ago, when the personal information of an air traffic controller, who was pinned as responsible for an accident in which two planes crashed into each other, was leaked to the public.
A Russian man, who lost his family in the accident, tracked down the controller and murdered him.
Cybersecurity standards in ATC
While there are defined standards for cybersecurity in general (i.e. ISO/IEC 27000 series and the NIST Cybersecurity Framework), ATC lacks industry-wide cybersecurity standards and has a long way to go to handle cyber threats in a satisfying manner.
Cyber threats: Targeting your most valuable assets
Cyber threats are a major concern for all companies and organizations worldwide, or at least they should be. Losing control of your most valuable assets – your data – could have potentially devastating ramifications – which is exactly why cyberattacks are becoming more and more common.
Cyber threat categories
Cyber threats are typically divided into three main categories:
- Threats to confidentiality:
These attacks are designed to steal personal information, such as bank account information, credit card information, social security information, etc.
- Threats to integrity:
Attacks by cybercriminals that access and release sensitive information to the public, to expose the data, and influence people to lose trust in a company or individual.
- Threats to availability:
Attacks on availability aim to deny access to systems and data. This category of attacks can be divided into two distinct sub-groups:
- Ransomware: Attackers encrypt the original owners’ data, and demand a ransom for decrypting and releasing it.
- Denial of Service: A typical method is the use of botnets to flood servers to take them down.
Crime, attacks, and terrorism
There are several types of cyber threats, generally defined by the motivation behind, and the potential gain of, the attack:
We generally use this term for threats posed by one or more individuals who target systems to cause havoc, or for financial gain. Threats to availability are often linked to cybercrime.
Cyberattacks are often carried out for political reasons, or, quite simply, for fun, rather than being motivated by financial gain. Cyberattacks typically entail the collection and distribution of sensitive information.
A progressively more common tactic, cyberterrorism generally focuses on breaching electronic systems to instill panic or fear in specific targets or the public in general.
Several of the major cyber threat incidents recently have been traced back to national agencies. Depending on the type of attack, such threats may be defined as either cyberattacks or cyberterrorism.
A wide range of methods
Hackers and cybercriminals use a plethora of methods to poke holes in security measures and gain access to systems and sensitive data.
Common methods include:
- Social engineering
Social engineering is psychological manipulation to trick users of a targeted system into making security mistakes and giving away sensitive information.
One of the most common methods is phishing – usually committed by sending emails that appear to be from legitimate companies and asking unknowing and unwary victims for sensitive information. The focus of these types of attacks is usually to collect credit card information etc.
- Advanced Persistent Threats (APT)
APTs are sophisticated efforts to gain backdoor access to systems for a continuous period, often to broaden the attack and gradually gain access to other systems.
Another well-known method is malicious software and code, often referred to as malware. There are several types of malware – such as spyware, ransomware, viruses, and worms.
- Man-in-the-middle attack
Man-in-the-middle attacks are a method used to intercept communication between two or more sources to obtain sensitive, and often classified information. Unsecured WiFi networks are some of the most common targets.
- DoS: Denial of Service
As previously mentioned, DoS attacks are designed to shut down systems, networks, and/or servers by flooding the target with information, essentially barring users from accessing their data.
The common denominator of all these different cyber threat methods is that they are all designed to take advantage of the weaknesses and security gaps in the victims and their systems. This highlights the need for cybersecurity and protection.
ATC cyber threats and mitigations
The ATC industry is vulnerable to a range of cyber threats, suchs as threats to data integrity and confidentiality, malicious code, physical attacks (drones, lasers, etc.), and DoS attacks (GPS/frequency jamming and UHF/VHF transmitters).
Building a solid cybersecurity system is difficult – and protecting yourself from all external threats is borderline impossible.
To succeed you need to have good routines on how to handle threats and breaches, foster a culture of security, test your applications, and perform exercises to increase knowledge of potential threats and security risks.
Last, but not least, you have to have the right tools to secure your data.
Secure your data with guardREC® ATC
GuardREC has extensive experience in mitigating security risk and protecting your data.
Our guardREC® ATC recording solution provides several cybersecurity layers to prevent loss or misuse of data and protect exposed persons and personnel.
Encryption of data is one of the most important measures to mitigate the risk of man-in-the-middle attacks.
We recommend always using HTTPS/WSS, i.e. SRTP/SIPS, services when possible – or setting up a VPN.
The guardREC® ATC system encrypts all stored data, databases, and files, and offers hash stored passwords to prevent outsiders from gaining access to sensitive information.
Role-based access control
Role-Based Access Control separates admin and user roles and restricts resource permissions to authorized users only.
Traceability is key to fixing security issues, identifying suspicious activity, tracing attackers, and recovering quickly from an attack.
The guardREC® ATC system offers several functions to improve traceability within your system:
When suspicious activity occurs, you will want to be alarmed. Our system offers both audible and visible alarms and allows you to define severity levels. All alarms, and triggering actions, are traceable and manageable.
Should an attack occur, it is important to understand what happened. How did the intruder get into the system? What actions were performed?
GuardRECs logging function logs all actions performed within the system, allows you to filter log levels based on severity (critical, error, info, debug) and stores information securely to prevent leaks of user data.
- Audit Trails
The guardREC® ATC audit trail allows you to see exactly what the user did in the system, and when. You are provided with a complete trail of every single action, assisting you in identifying why and how the problem arose.
Your cybersecurity system is only as strong as its weakest link
Out of all cybersecurity measures, end-user education may be the most important of all. Your system is only as strong as its weakest link and in cybersecurity, the weakest link is very often the end-user.
The main reason for this is as simple as it is unsurprising: Weak passwords.
Here is an indisputable fact: Many of us are not very good with password security (and quite a few are downright awful at it).
Ensuring that your employees have the necessary knowledge and tools to create secure passwords is imperative to your overall cybersecurity, as even the tiniest puncture can blow open a massive hole.
A minimum length of eight characters for passwords is a good place to start. Longer passwords are generally harder to crack, but be cautious not to require passwords that are too long.
Studies show that people tend to repeat words and terms if the password requirement is too long, creating passwords such as “passwordpassword” or “duckduckduckduck”.
Similarly, if you require passwords to include symbols, the reaction from users is often to replace an “S” with a dollar sign, an “E” with the number “3” or an “A” with “4”. This technique is transparent for hackers and adds very little value to your password security.
Additionally, if you ask your employees to change their passwords periodically, people tend to simply adjust a digit to the next increment, e.g. “mypassword1” becoming “mypassword2”, etc.
Ban common passwords
There are lists available online containing the most commonly used passwords, as well as passwords known to have been cracked previously. Cyberattackers use these lists to crack passwords almost instantly.
Run passwords against the lists and ban them to prevent employees from using them.
You should also educate your users to not system and organization passwords for non-work related purposes, and vice versa. An employee who uses work passwords for webshops and online services is typically the first one to be attacked – compromising your entire system.
Multi-Factor Authentication adds another step to the login process, requiring users to confirm their identity through a secondary authentication mechanism.
Common MFA mechanisms are codes sent through email and SMS, token generators, biometrics, and third-party authenticators.
GuardREC’s password policies
The guardREC® ATC recording solution offers several password policy options to help guide users in creating secure passwords.
Criteria are divided into four sections:
- Password requirements (length, lowercase/uppercase, digits, unique characters, etc.)
- Idle Config (What happens when a user is idle?)
- Lockout policy (Timed or admin reopen when the wrong password is entered X amount of times.)
Password history (Set a specific number of previous passwords to be remembered and unable to use.)