Game On: Boeing, Embry-Riddle Work to Enhance Cybersecurity in Capture the Flag Competition

Protecting aircraft against cyberattacks is serious business, and Embry-Riddle Aeronautical University students are stepping up to the task by experimenting with avionics cybersecurity using capture-the-flag scenarios.

In a Boeing-sponsored multiyear project begun last fall, students from several departments of the two residential campuses of Embry-Riddle, Daytona Beach and Prescott, have developed a virtual simulation of interconnected avionics networks, each purposefully embedded with security flaws. Once the game begins, it becomes the task of the competing team to find those flaws in the network and exploit them.

“Capture-the-flag competition is a great method for learning, as it creates a game-like project environment for students and pushes them to be creative,” said Dr. Ilhan Akbas, assistant professor in the Department of Electrical Engineering & Computer Science. “Cybersecurity is a flag race between hackers and developers in real life, so students learn more effectively as they put themselves in the shoes of both.”

The project began, said Dr. Krishna Sampigethaya, associate professor and chair of the Department of Cyber Intelligence and Security, to fill an “increasingly important” need for an aviation cybersecurity workforce.

This project — its goals, scope and outcomes defined through a collaboration between Embry-Riddle and Boeing — “will streamline the workforce into the industry,” said Sampigethaya.

Brian Jaury, who graduated from Embry-Riddle in 2019 and works as a product security engineer in Boeing Commercial Airplanes, is the lead coordinator of the Boeing team organizing such projects, as well as the Daytona Beach Campus project mentor. Embry-Riddle alumni Brandon Nepute and Dai Ibrahim are also Boeing product security engineers and project mentors. Jaury says the collaboration between Boeing and Embry-Riddle can provide an onramp for students into employment at Boeing.

“Students can apply the knowledge they have gained in school to work on real-world problems affecting the commercial aviation industry,” Jaury said. “Students are paired with Boeing mentors who can help provide technical and professional mentoring. Boeing mentors also assist students in navigating the hiring process for careers with Boeing.”

Five of six participating students from Embry-Riddle’s Prescott Campus major in Cyber Intelligence and Security and began their involvement in the project by learning about avionics systems, touring the Embry-Riddle flight line and having aircraft controls and systems explained by a subject matter expert, said Sampigethaya. They also gained perspective on the actual use of avionics from Embry-Riddle pilots and met with avionics cybersecurity experts from Bell Flight and Collins Aerospace.

“With a stronger understanding of avionics, we were able to spend the second semester developing a set of software-based avionics,” said Ethan Nadzieja, a senior in Cyber Intelligence and Security, adding that the capture-the-flag competition, which was held in April, “created a clear pathway of how one would begin to understand what avionics systems are hosted on the network and how they can be taken advantage of.”

The simulation developed by Prescott students for the April capture-the-flag competition involved a maintenance laptop connected to a commercial aircraft, Nadzieja said. In the competition scenario, the maintenance laptop was considered one of the weak links in the aircraft maintenance. With remote access enabled to the maintenance laptop, Daytona Beach students were tasked as cyber defenders to locate avionics accessible from the laptop and identify any exploitable vulnerabilities.

“I gained hands-on experience in system design and integration within a team,” Nadzieja said. “This required a high level of communication between members to create detailed requirement documents and to eventually integrate purpose-built systems into a single environment. Overall, this project prepared my colleagues and me for a future career in aviation cybersecurity.”

Matthieu Privat, a senior in Computer Science with a minor in International Studies, gave the project “100 percent” as a learning experience.

“It has introduced me to new tools, new applications of tools I knew, has made me professional contacts and has given me experience on actual team projects that could be seen in the industry,” Privat said.

Jesse Chiu, instructor of Cyber Intelligence and Security and the main faculty mentor for the project, summed up the work’s impact as training students to fill an important need for industry.

“We are training the next-generation talent for enhancing aircraft security against potential cyberattacks,” said Chiu, “a critical need in the industry today.”

Posted In: Computers and Technology | Engineering | Security Intelligence and Safety