Aviation Week Op-Ed: Embry-Riddle President Explores Front Lines of Aviation Cybersecurity
In his latest Aviation Week essay, Embry‑Riddle Aeronautical University President P. Barry Butler, Ph.D., addresses the need for collaboration among various professionals to secure aviation and aerospace systems. He emphasizes the crucial role of higher education in fostering such collaborations, conducting long-term research and developing a workforce skilled in cyber resilience. Through the Hunt Library, the Eagle community can log onto ERNIE to freely access the op-ed. Alternatively, subscribers to Aviation Week can log on here to access the essay, which is also provided below.
Hackers have targeted a major airport, infiltrating systems ranging from airline kiosks and baggage tracking to air traffic control and even the avionics of an aircraft in flight.
Teams work to root out the hackers, identify issues and make necessary repairs.
Fortunately, this worst-case scenario occurred in the context of a Capture the Flag (CTF) competition on the Prescott, Arizona, campus of Embry-Riddle Aeronautical University. In this April 2024 contest, students from different institutions competed to devise the best defenses to mitigate the hypothetical attack.
With increasing technology in planes, more aircraft entering the airspace, and a fast-growing space sector, our nation’s aerospace systems are only becoming more complex.
Making these systems resilient to real-world cyberattacks requires more collaboration than ever from a broad spectrum of professionals, including engineers, supply chain specialists, airport personnel, information technology workers, intelligence experts, white hat hackers, government officials and pilots. Additionally, higher education institutions and their faculty are crucial in conducting long-term research and building a workforce skilled in cyber resilience.
“By bringing together industry, government and academia, we can identify the growing challenges of aviation cybersecurity,” Arizona Senator Mark Kelly told participants in a video message during the aviation cybersecurity workshop at the Prescott Campus.
With new connectivity in aircraft comes new vulnerabilities. “A plane has hundreds of boxes that have IP addresses, and that is the problem,” said Dr. Krishna Sampigethaya, chair of Embry-Riddle’s Cyber Intelligence and Security Department and the conference’s organizer.
Because of the risk of “zero-day attacks,” or unanticipated vulnerabilities, Sampigethaya stressed that aviation systems need to be cyber resilient, operating safely even while under attack — not unlike how a pilot navigates in a storm.
Moreover, cyberattacks in aviation can be insidious — targeting a system’s behavior while not appearing to affect its functioning. A prime example is the spate of GPS spoofing incidents occurring near war zones, where false signals have thrown aircraft navigational systems off course.
Protecting aviation systems is further complicated by a mixed-criticality environment, in which systems of lesser and greater risks are intertwined.
Sampigethaya said that Embry-Riddle’s forums on aviation cybersecurity provide an opportunity to communicate “the uniqueness of the aviation system,” bringing together IT professionals who are well-versed in cybersecurity challenges and people traditionally responsible for aviation safety and security.
During the April workshop on the Prescott campus, experts shared best practices and explored new risks, such as those pertaining to autonomous systems and advanced air mobility. The presenters discussed pressing challenges, such as studying pilots' cyber readiness and securing space infrastructure, including increasing numbers of commercial satellites and rockets.
Companies are rightly concerned about divulging proprietary technology and the reputational risk of exposing vulnerabilities. This is where organizations like the Center for Aerospace Resilient Systems (CARS) at Embry-Riddle come into play. CARS is a university-wide research center that addresses critical aerospace systems challenges, including cybersecurity. By collaborating with industry and government stakeholders on joint research projects, the center enhances information sharing and establishes frameworks for anonymized and protected data.
Dan Diessner, executive director of CARS, said that forward-looking researchers have the advantage of addressing big challenges and systemic dangers, irrespective of company-specific architecture.
A pipeline of professionals who can track down malicious actors, conduct forensic investigations, and improve aerospace systems to safely withstand cyberattacks is also urgently needed.
The White House has prioritized building a robust cybersecurity workforce to safeguard critical infrastructure, including in aviation. Scholarship programs like those provided through the National Science Foundation (NSF) are key to this effort.
Industry, meanwhile, provides students with the latest platforms for hands-on training.
At the Aviation Cyber Initiative (ACI) Cyber Rodeo, hosted at Embry-Riddle’s Daytona Beach, Florida, campus in February, a different Capture the Flag contest featured teams of students competing alongside industry experts to address an aviation cyber emergency. They hunched over computers and took hold of a flight simulator’s controls.
A team of Air Force Reserve Officer Training Corps cadets from Detachment 028 at the Prescott Campus came in first. Cadet Carson Tucker, the team’s leader, is on track to become an officer next year — and one of our nation’s newest aerospace cyber defenders.
“I am very excited to use all the skills I've honed in our cyber program as I enter the Air Force,” he said.
P. Barry Butler is president of Embry‑Riddle Aeronautical University.
Posted In: Institutional News | Security Intelligence and Safety