Specific Air Traffic Management Cybersecurity Challenges: Architecture and Supply Chain

Abstract

Cybsersecurity is without doubt becoming a societal challenge. It even starts to affect sectors that were not considered to be at risk in the past because of their relative isolation. One of these sectors is aviation in general, and specifically air traffic management (ATM). New developments in technology and the---ever increasing---trend to interconnect systems have drastically changed this landscape. Like many safety relevant sectors, the general attitude in aviation is rather conservative. Safety practitioners prefer slow changes, which conflicts with the "rapid response" requirements coming from the (cyber)security area. Air traffic management systems are large socio-technical systems, a fact that adds an additional dimension to the cybersecurity complexity. In this paper I will address a subset of sector specific challenges that we have to address in the ATM domain. The number of challenges is quite substantial and topics like security policies, risk assessment methodologies and vulnerabilities in specific areas (e.g. ADS-B) can be found in the literature. This paper will look at two challenges that have received, so far, less attention: architecture and supply chain.