Aviation Cybersecurity with Serge Christiaans

Aviation cybersecurity is becoming an urgent priority as modern aircraft increasingly rely on complex digital systems for navigation, communication, and engine performance. These systems were once isolated but are now interconnected and vulnerable to cyber threats ranging from GPS spoofing to ransomware attacks on airline infrastructure. As nation-state actors and criminal groups grow more sophisticated, the aviation sector faces a rapidly expanding attack surface, with life-or-death consequences. Understanding and addressing these risks is essential not only for passenger safety but for the resilience of global transportation networks. Serge Christiaans https://www.linkedin.com/in/serge-christiaans/ is a former Dutch Air Force pilot with a background in electronic and hybrid warfare. He later flew commercially for Singapore Airlines and is now the Lead Instructor and Program Director at the Aviation Cyber Academy https://www.aviationcyber.academy/. He joins the podcast with Gregor Vand to discuss the convergence of aviation and cybersecurity, the aircraft as a digital attack surface, hybrid warfare, the urgent need for aviation cyber resilience, and much more. https://i0.wp.com/softwareengineeringdaily.com/wp-content/uploads/2023/11/Gregor-Vand.jpegGregor Vand is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance and general software engineering companies. He is based in Singapore and can be found via his profile at vand.hk or on LinkedIn. Sponsorship inquiries: [email protected] https://cms.megaphone.fm/organizations/619b680e-d813-11ea-9750-e7ecac406436/podcasts/e60108fe-e328-11ea-b2b6-1348249f900a/episodes/3913370a-bc44-11ed-ace6-8b1f96d82bba/[email protected] The post Aviation Cybersecurity with Serge Christiaans https://softwareengineeringdaily.com/podcasts/aviation-cybersecurity-with-serge-christiaans/ appeared first on Software Engineering Daily https://softwareengineeringdaily.com.

• 0:00Speaker 00

  Aviation cybersecurity is becoming an urgent priority as modern aircraft increasingly rely on complex digital systems for navigation, communication, and engine performance. These systems were once isolated but are now interconnected and vulnerable to cyber threats, ranging from GPS spoofing to ransomware attacks on airline infrastructure. As nation-state actors and criminal groups grow more sophisticated, the aviation sector faces a rapidly expanding attack surface with life-or-death consequences. Understanding and addressing these risks is essential, not only for passenger safety, but for the resilience of global transportation networks. Serge Christians is a former Dutch Air Force pilot with a background in electronic and

• 0:45Speaker 00

  hybrid warfare. He later flew commercially for Singapore Airlines and is now the lead instructor and program director at the Aviation Cyber Academy. He joins the podcast with Gregor Van to discuss the convergence of aviation and cybersecurity, the aircraft as a digital attack surface, hybrid warfare, the urgent need for aviation cyber resilience, and much more. Gregor Van is a security-focused technologist, having previously been a CTO across cybersecurity, cyber insurance, and general software engineering companies. He is based in Singapore and can be found via his profile at van.hk or on LinkedIn.

• 1:38Speaker 01

  Hello, welcome to Software Engineering Daily. My guest today is Serge Christians. Welcome, Serge.

• 1:45Speaker 02

  Hi, Gregor. Thank you very much for the invitation.

• 1:47Speaker 01

  Yeah, this is a very interesting one for us to do today, as we're going to get into, based on the fact that you are a practicing pilot, but you're also a practicing CISO as well. So we're going to get into how this has all come about. So I think that's kind of where we should start. We always kind of start with guests' career journey, if you like to call it that. It almost feels like you have two careers, both that you've managed and you're still doing both today. So tell us about how are you doing these two jobs effectively?

• 2:17Speaker 02

  Okay, well, I started my career at the military academy in the Netherlands, in the air force, and then flying in the Netherlands for the Dutch air force for about 16 years. I was also involved in electronic warfare, hybrid warfare, and plenty of operations and NATO operations abroad. Then I moved to commercial aviation, flying 737s in the Netherlands. But as an ex-military pilot, that was so insanely boring. I started my own IT company parallel to that. And that company actually started growing into more cybersecurity as cyber became an issue around 2010, 2011, when we saw the first cyber attacks. I was still flying then, but also in my spare time, serving customers, mostly SMEs,

• 3:02Speaker 02

  and managing their infrastructure. Then at some point, I moved to Singapore, flying for Singapore Airlines, or Scoot actually, for the Airbus 320. Covid happened, I took that opportunity to do a masters in cybersecurity, and then during Covid, I had several full-time CISO roles responsible for Asia-Pacific regions, stock-listed multinationals, which was very different from flying, but I'd say my military academy management skills were very useful. It was, again, very interesting, I learned a lot. But then at some point, I looked in the mirror and I thought, nah dude, you want to fly again, you miss it, and I did. So I started flying again, but now all the knowledge that I had on cybersecurity and my CISO experience, I found myself in the middle of aviation cybersecurity.

• 3:45Speaker 02

  And when digging into that, it's actually a very small world. Not many people are in that intersection, and I really felt I needed to do something with the knowledge I have on both sides. So I'm helping the aviation industry on plenty of different occasions. I speak a lot at conferences, raising the flags on awareness, but especially airplane cyber and the threat service that an airplane poses, because there are many people also... High level management of airlines that actually do not understand this risk and what we need to do, which is actually comparable to what I found when as a CISO working for large companies. It's the same problem all over.

• 4:29Speaker 02

  They don't understand the business risk of cyber, which is the largest risk that any company has, not even aviation or an airline. Cyber is your biggest risk. If you don't understand that, that your company can go down in a week, regardless of how great your clients feel about you, or how low your prices are, or how great your product is, you will go down if you have a ransomware attack that you haven't prepared.

• 4:55Speaker 01

  Yeah, I mean, I think probably quite obvious to many, but worth calling out is just the stakes are incredibly high in aviation because you just don't have the same kind of time to deal with the problem. So we're going to get into kind of what that even means, cyber in the air. Just before we kind of go there, a couple of questions, I guess. I have quite a few pilot friends actually, and there's obviously a lot of downtime between where you fly to and from. So I guess this is how you're able to kind of do both at once. And is it kind of difficult to mentally switch between flying and then being a CISO? Like, how does that look?

• 5:27Speaker 02

  Well, not for me. It's like switching languages. If you speak both languages well, you switch without knowing. You sometimes even think in the other language without knowing. Or compared to driving in Singapore, I drive on the left side. Here in Europe, I drive on the right side. I just get in a car and I just do it. Sometimes if I'm tired, I approach around about, I need to think, okay, left or right? What is it? But in general, I don't have that problem because I speak both languages good.

• 5:54Speaker 01

  I think that's a good way of describing it. And then if we just sort of think about, just to kind of lay the land here, like cybersecurity in aviation, how would you describe? I mean, you've touched on it, I think, Justin, what you were saying a few minutes ago, but how would you describe kind of the maturity of cybersecurity compared to other critical infrastructure sectors?

• 6:18Speaker 02

  Well, actually, we have statistics on that. There is research on that, and it seems that aviation is about in the middle, which aligns with my experience as well. In general, of course, the financial sector, the financial services, healthcare, energy sector, they're more mature in general, and manufacturing is way less mature in general. And we're about in the middle. And one of the main reasons is of course that in the aviation industry, we focus on physical security threats in general, and we don't like change because everything we change might change our safety posture as well. It's all about safety. What we do now is safe and everything we change might compromise that safety because in aviation, safety is

• 7:00Speaker 02

  written in blood, we say. It's based on experience. With an open culture, we want to learn of everything that happens so we can prevent it from happening again. So then, when everything is balanced, is coordinated, and it works like this, and we have a high safety level, you don't want to change it a lot because you're introducing more risks. And that's a part of our culture that doesn't help getting more cyber resilience. That's one of the things I'm fighting at the moment.

• 7:29Speaker 01

  Got it. Okay, that makes a lot of sense. So let's dive into what it even means cyber security in aviation. Some of our listeners will be familiar with the term attack surface, like in terms of just conventional, you know, what an attack surface in cyber security, i.e. what an attacker might see and be able to think about attacking. How does that look in terms of aircraft? Like, what does an attack surface of an aircraft even look like? And what are things that people might just not realize even exist as part of that attack surface?

• 8:02Speaker 02

  Okay, let's start with describing a modern aircraft as a flying server room with hundreds of computers on board. If you look at it like that, that is a huge attack surface on its own. There's a lot of digital stuff on board, but also cyber physical elements that are hybrid. And it's the hybrid things and the hybrid attacks, by the way, as well, and hybrid warfare that's actually falling in between. Nobody understands that one except the ex-military guys. It's not cyber, and it's not warfare, and it's not in the newspapers. But that's a different topic. Talking about threat surfaces of my airplane, it's all the computers, all my navigation systems, my flight management systems, big and small

• 8:46Speaker 02

  computers, GPS receivers, A-CAR, ZETCOM. It can all be spoofed, it can all be exploited. Even my maintenance systems can be compromised. And one of my biggest worries where nobody talks about is actually my engines. My airplane, half of the price goes, half of the money goes to the engines. These things are insanely complex. If I open up a few of these hatches, you're going to be amazed what you see there. It's a miraculous piece of high-tech and these things are constantly sending data to the manufacturer. So this is also part of my threat service. If somebody could switch these things off in flight, then I'm not an airplane anymore. I can do without a computer. I have backups on this, backups on that. We have workarounds.

• 9:31Speaker 02

  That's all fine. As long as I'm still an airplane, I have fuel and I have a landing gear to land on, then I'm fine. But without engines, I'm a glider.

• 9:41Speaker 01

  So that's an interesting one. Let's just stick on engines for a second. You mentioned that the engines are sending telemetry to the manufacturers. So in theory, is there a risk around that communication the other way around? Where something goes wrong at the manufacturer and is able, some kind of communication is able to be sent to the engine that does something nefarious? I mean, is that a possibility?

• 10:06Speaker 02

  Theoretically, yes. It's the same as your phone. Somebody could switch it off. Somebody could de-dos it or make it unusable or find a switch. What nation-state threat actors are doing right now with our critical infrastructure, mainly China. They're creating switches that they can push. So they create chaos.

• 10:24Speaker 01

  Yeah, interesting. So I mean, looking at sort of general connectivity, could you actually explain? I believe there's this acronym, A R I N C, systems. Perhaps you could just explain, A, what does that stand for? And it's, I believe it's a protocol and like, could we maybe just dive into that protocol a little bit? And like, how has that increased the threat landscape as well?

• 10:45Speaker 02

  So Airing is a protocol that was, I think, in 1927, the last century. Radio communication protocol that was designed for standardization purposes. And in airplanes, we have an Airing 429er. That was the first communication bus, actually, let's call it a communication bus, that was built into the digital backbone of airplanes to communicate, to enable communication between different systems onboard. The Air Wing four two niner was designed in the seventies, last century. Long time ago, there were not really physical wars going on, the cyber didn't exist. The first computers, I think we had MS-DOS back then, just came out, the word cyber security didn't even exist.

• 11:27Speaker 02

  So these things were designed for reliability and not for message injection or spoofing attacks. Now, next to that, the long operational life cycles we have in aviation means that we have a lot of vulnerable old systems flying around for many years to come. That doesn't mean there's no improvement, there are developments, we have the Air Wing six two niner, which is more secure, more safe. And we have the six six four, the AFDX, which is a full duplex, which can handle encryption, which all is a big improvement, but it's only for the newer airplanes.

• 12:01Speaker 01

  So for example, when you say newer airplane, are we talking like A three fifty or does it have to be? I guess A three fifty is one of the newest aircraft, but do A three twenties have that newer? Like if they rolled out the factory today, do the A three twenties get that new protocol or a new bus?

• 12:15Speaker 02

  Yes, that's a funny thing. Every time I ask Airbus, they don't tell me.

• 12:18Speaker 01

  Right, okay.

• 12:19Speaker 02

  And every time I ask Boeing, they don't tell me. And the same goes for Embraer. I visit a lot of aviation events, talk to the chief pilots and the test pilots of these airplanes. But I think you can imagine that this is proprietary information and they're not gonna give it out to the first idiot with a Boeing cap visiting their booth. It's very difficult to find out. We have to believe that they are doing their absolute best and that they have a very well-equipped cyber team, then they're looking at it. But at the end of the day, I cannot do a penetration test on my airplane, because for that, it actually needs to be in the air. You can understand, it's physically, no pun intended, air-gapped, that nice. But if you wanna do a pen test, you have it in the hangar, you need to have the engines running as well, because then you know all the systems are online.

• 13:04Speaker 02

  And even then, the air-ground switch will be on the ground side, not all will be working. So it's very difficult to do that.

• 13:10Speaker 01

  Yeah, okay, interesting. So let's talk about actual cyber attacks mid-flight. So I mean, I believe you do actually train pilots to understand what a cyber attack might look like. Medair and I guess how to sort of deal with that. So could you just walk us through your sort of what kind of things do you teach pilots in this sense? Like what are they looking out for? And then crucially, what are they supposed to then like? What are some at a high level, like what kind of steps are they supposed to step through to help mitigate that whilst they're literally flying a plane at thirty five thousand feet?

• 13:42Speaker 02

  Yeah. Well, first of all, there's only about twenty percent of pilots globally that receive actual training in this. All the other ones receive memos. It's not being trained in simulators for the simple reason that aviation authorities are not asking for it. We do what we need to do to be compliant. We don't have time for other stuff. When I'm in a simulator for four hours, there's a very intense program. There's no ten minute space to have a look at GPS spoofing or jamming. It's just not in the program. And that's exactly the same reason because the upper management doesn't understand this is needed. There is no awareness of the risk, the business risk of cyber. So it needs to be top down.

• 14:25Speaker 02

  The board needs to decide, yes, we need to train this. Then it goes to the training department. They will make a training program. Then we go in the simulator and then we learn how to react on this. Until that happens, nothing happens. And there's only twenty percent of pilots that are being actually trained. The other ones, all, and there's also scientific interview data on that one. The other ones are uncomfortable in a situation like that because they don't actually know what's going on.

• 14:53Speaker 01

  Yeah. Can you walk us through like just what a cyber attack might kind of present as in the cockpit, for example?

• 14:59Speaker 02

  Yeah. In aviation, we're being trained on emergencies and we practice these emergencies and we learn how to identify them. Quite often, the airplane helps you identifying them. Let's say I have an oil pressure of my left engine is going below limits. And the airplane will pop up a message, a notification, if you will, that says, hey, have a look at your engine pressure because it's not going great. Then I make a decision, we look at it and we take out a checklist or we divert or whatever we feel we need to do to keep the operation and the people and the airplane and my crew safe. Now, cyber attack on your airplane is actually something you never saw before, most likely. By now, everybody has seen a GPS jamming or a GPS spoofing,

• 15:41Speaker 02

  but there are still plenty of pilots who do not understand yet the difference between it because they have not been properly trained. Or the results or the long-term effects on your airplane of a spoofing attack. So what we normally do, the basic rules for handling any emergency in any airplane, anywhere in the world, is aviate, navigate, communicate. The first thing you do, whatever is going on, fly the bloody airplane. Use your primary instruments, keep on flying. Don't focus, don't look inside at instruments or try to get manuals out or start a discussion with your first officer while the airplane is "yeeeee" going down. That's not a good idea. Aviate first, then navigate.

• 16:26Speaker 02

  Where are you going? Where are you heading? Where do you want to go? Make sure you have a heading where you're not going into a mountain, for instance, or you're not going over a busy airport. Get out of dangerous airspace. And then the last one, communicate this. Not only to air traffic control, but to your crew, to your cabin, to your passengers, if you have time, in the right order. Now, for any cyber attack, things will be happening that you don't understand. You will have contradicting information, like this system says, "My position is here", and this system says, "My position is there", so where am I? I don't know. Or, "Hey, suddenly my engine data is blank", maybe your engine is being hacked? I don't know.

• 17:09Speaker 02

  Or in hybrid warfare, maybe your ACARS is spitting out a message from operations that you're not expecting. So you need to think, you need to start thinking. So what we need to do is to isolate, disconnect the suspected system and try to resolve the problem after isolation. And then the last one is to document. We need documentation about this because every... Tech is probably new and because one of the more important things of cyber resilience is sharing cyber threat intelligence. We need to document this so we can immediately tell all the other pilots in the world that this is happening in this area. Most likely by this threat actor. So sharing is caring. It's very important. Stronger together.

• 17:52Speaker 01

  Yeah, we're going to get on a bit to sort of culture in a bit as well. This is the idea of just culture versus blame culture, but we'll get there. So yeah, I think that's very interesting just to sort of think for a second, just about yeah, that situation where as you're calling out a pilot. Can never know for sure if what's going on is an attack. And so that's like half the problem. And then the second problem is then that distraction and your overarching way of training the situation is, as you say, like fly the plane. That's the first thing. Don't take your eye off what you should just be doing, which is flying the plane. But obviously you're having to make a whole bunch of other mental assessments. I mean, you mentioned ACARS, which I'm a hobbyist sim flyer.

• 18:34Speaker 01

  So that's the sort of like messaging system, I guess, where literally an airline can, or I mean, I think pilots can also send messages like, you know, toilet broken. So when they land, people know to come and fix it and that kind of thing. Yeah.

• 18:45Speaker 02

  The ACARS is our onboard fax, very old system. It's not encrypted. Anybody can read it. I can build a little soft radio here and you can even receive it and read it. There's no classified information going over that thing, but operational information for sure. And you can also send up. And imagine the chaos. You can do that with false messaging that are not verified. In the military, we verify all messages. In civil aviation, not like that yet, working on it.

• 19:12Speaker 01

  So we're going to move on to, I mean, you've been using this phrase a lot, hybrid warfare. I think I'd just like to understand that one a bit more, like what are we, you know, when we talk about like critical infrastructure, hybrid warfare. Let's start with kind of, you've touched on obviously nation states already, Russia, China, Iran, for example. I mean, we're not maybe here to dig into exact nations so much, but just sort of the understanding. What is this landscape and what is hybrid warfare at all? And I guess, how does especially commercial? I mean, I guess, are we talking commercial aviation comes into this or military aviation drones? Like just what is all this?

• 19:48Speaker 02

  Okay. Classic warfare, we call kinetic warfare. Kinetic warfare is when things are kinetically flying around like missiles, bullets, rockets, and it's about destruction.

• 19:59Speaker 02

  Hybrid warfare, there's actually nothing flying around. It's not peace, but it's also not kinetic warfare. So it's everything in between. Cyber warfare is a part of hybrid warfare, but there are many other gray shades in hybrid warfare, like disrupting transport train systems in a country. Quite often, the goal of hybrid warfare is disruption. It's showing power below the threshold of war, which means that in NATO it's going to be very difficult to call out Article Five if it's hybrid warfare. We need to agree on that, all of the member states, which is a problem, because for some, this might not be an act of war. For others, it's a very clear act of war.

• 20:44Speaker 02

  So blowing up a bridge might be an act of war, but a cyber attack on the bridge control system might not be. But both have the same effect. The bridge is unusable for logistics and for ammunition and to go to the front line. So that is hybrid warfare, creating chaos. And a cyber attack on my airplane is probably not aimed at killing us, but creating chaos about showing, hey, look, see what we can do. Better be careful. It's threatening. And it's what Putin is doing all the time, of course. He's threatening with nuclear weapons, but he's also attacking the whole digital infrastructure, critical infrastructure of every country in Europe, next to all the disinformation campaigns that he's throwing out.

• 21:29Speaker 02

  That is also warfare. It's hybrid warfare, but it's still warfare.

• 21:33Speaker 01

  I understand. And I mean, especially given a lot of airlines today are still effectively extensions of countries. Most countries have a national airline. I mean, in the UK, British Airways is not owned by the government, but I think most people still associate British Airways as sort of being the national airline, for example. And then obviously, we have the big nation players like Emirates, Qatar, etc. So does that play into it where, as you say, causing chaos, showing a signal through cyber warfare on commercial aircraft is by extension targeting a government, for example?

• 22:06Speaker 02

  I would say so, yeah. It's a show of force, definitely. Don't forget, in China, all Chinese companies are owned by the Chinese government. Well, not owned, but at least controlled. And if you look now at Flight 24, you see Chinese airplanes just flying over Russia, no problem at all. So we need to avoid conflict zones, conflict areas, because there are trigger happy people down there with high-tech equipment built to shoot you down, and that has happened before. And it will happen again.

• 22:36Speaker 01

  And I mean, if we sort of look at the cyber side, does proximity come into this as well, as you call it, flying over, flying in certain airspace? I think it's clear why flying in an airspace would make you more at risk of a literal missile, for example. But does it then also increase sort of that attack surface in terms of where you are flying?

• 22:59Speaker 02

  Actually, it doesn't, because these missiles are able to fly hundreds of miles. I don't even have to fly near the border. They can even hit me here over at Amsterdam if they want. But that must be an intentional order given by some high-up commander. Quite often, it's just trigger happy, untrained soldiers on the ground that see a target and think, oh, crap, this is not ours, and they fire. So if your military is badly trained and with a corrupt command and control structure, which we have in Russia, everybody's trigger happy. There's no discipline.

• 23:32Speaker 01

  Yeah. So moving away from pure aircraft for a second, actually looking at airports as well. Now, I mean, I think maybe the one that our audience might be aware of recently, which was not a cyber attack, but it clearly showed the, what could happen, was obviously CrowdStrike, and how CrowdStrike managed to inadvertently take out airports, control sys-, well, not control systems, but a lot of display systems and just sort of logistic systems, so people simply couldn't fly. Is that something you advise on or deal with as well? So not in the air, but actually on the ground as well?

• 24:08Speaker 02

  Well, I think one of the basics of cybersecurity, all CISOs will preach that, is stay away from single points of failure. It's not aviation-related. It's a single point of failure, and you need to have a plan B. And remember the, I think it was Heathrow that shut down for a few days due to an Electrical substation.

• 24:28Speaker 01

  Yes.

• 24:29Speaker 02

  Single point of failure, very effective didos actually, but not intended like that.

• 24:35Speaker 01

  Yeah.

• 24:35Speaker 02

  So those are basics. In general, whenever I am consulting anybody in aviation, we fall back to the basics. It's basic cyber hygiene and that's not only in aviation, that's in every sector, every industry, everybody needs to go back to basics, simple vulnerability reduction, simply identity management. It's not rocket science. We have all the knowledge, we have all the tools, we can implement it, but somebody has to put the money aside, organize it and say, this is how we're gonna do it. And up till then, we are vulnerable, everybody, not only aviation. Back to basics, basic cyber hygiene is what we need to focus on for the next couple of years.

• 25:18Speaker 01

  Yeah, I think that's very interesting where people maybe think it's more complicated than it needs to be, quite frankly, to keep on top of this stuff where even though it's an airport and it's a critical piece of infrastructure in a country, the people actually running the airport unfortunately might still be a bit behind when it comes to, as you call out, just basic cyber hygiene. So very interesting. Let's move on to, I know that you've got a sort of a lot of thoughts around leadership and culture in this space. And I think this is very interesting, this sort of crossover here where the way that the aviation industry operates, cybersecurity could probably learn a few things. So I think the big one here is this idea of just culture, which is juxtaposed with blame culture. So I think let's go there and maybe you could

• 26:03Speaker 01

  help us understand what is just culture? Why has it sort of been in aviation a while? How does that maybe translate over to, or should be translating over to cybersecurity as well?

• 26:13Speaker 02

  A very interesting crossover. I gave a presentation last year at Blackhead about what cybersecurity teams can learn from aviation just culture. And it's actually very simple. Just culture is a culture where you encourage incident reporting without fear of punishment to enable the organization to learn and to improve because humans make mistakes. We are. Human, we make mistakes by default and that is okay as long as you don't do it intentional. Basically, there's a gray area in that, but this is basically what it is. So if I make a hard landing, I make a mistake, okay, then I report it.

• 26:52Speaker 02

  So other people can learn. If I am being spoofed with a new system and I see data that I've never seen before on my instruments before. I report it so everybody can learn. And then I don't want it to stay inside my company. I want the companies to share, I want the aviation sector to share and not only sovereign, I need global sharing. That's why we need C I I sex to get all this information out there with our friendly allies. But back to just culture, that's basically what it is. And we see a lot in large companies, not aviation companies, but maybe also aviation companies like airports. Where people are clicking a phishing email and, oh, I think that was wrong. Oh, I better go home now, maybe nobody sees it, right?

• 27:36Speaker 02

  And then without knowing it, within seventeen minutes, your whole network is compromised and infected. If this person would have called their CISO, they might have been able to mitigate and keep it within the house.

• 27:48Speaker 01

  Yeah.

• 27:48Speaker 02

  So it's about the culture and the culture goes top down. It's leadership by example.

• 27:53Speaker 01

  I think that's a good, good way of explaining it. There's a website that some of the audience may know called Aviation Herald, A V Herald. And that's sort of, at least that's where I as a layman go to just sort of check up on reported incidents. You know, they get classified, crash, obviously being the worst, and then, you know, I think accident and then incident or something like that. And the funny thing is, I've noticed how the airline, again, let's just say British Airways, for example, a lot of things pop up from British Airways. And some people might look at that and go, wow, they have so many issues. And actually, I am much happier seeing that than the airline I never see. I don't know which one to name, but you know, there are certainly airlines that virtually never pop up.

• 28:34Speaker 01

  And that to me is, that's a reporting problem. So actually, there's just safety in reporting effectively.

• 28:40Speaker 02

  So how often do you see a Chinese or a Russian airline pop up? Or an airline that is part of any dictatorship? Doesn't happen because they carefully cherish their ego and their image and their reputation. And of course, let's not forget A V Herald. I think it's a British publication, isn't it?

• 28:57Speaker 01

  It could be, yeah, I'm not actually super sure, but yeah.

• 28:59Speaker 02

  Anyway, they are well linked with information into British areas, apparently, which might give you as a reader the wrong idea. Luckily, there is a global international cap statistics to keep it all within proportion.

• 29:11Speaker 01

  I mean, we see this in obviously cybersecurity. To some degree, we've got obviously the Verizon C B I R, which comes out every year. I think the thing there though is like it's less attributed to specific companies. Or at least in the report, it's more about stats, but the point is that can only exist because of reporting, like someone in a company has reported the incident or the breach, what happened. But I think it's fair to say, right, we're still way off in cybersecurity in terms of reporting.

• 29:42Speaker 02

  Oh, yes. So in cybersecurity, I see the traditional blame culture, which discourages reporting of security incidents. Prevents the organization from learning and you're unable to improve your defenses. And I see it a lot in Asia as well, not only in aviation, but blame culture is pretty much standard, especially behind closed doors. There's no learning, um, there's no wanting to learn. It's all about K P I's and making money. And it's often very subtle, it's very difficult to see as an outsider as well, blame culture. Because people are being laid off, being fired on the spot. Then you ask them, why are you fired? Ah, yeah, you never find out really, because they don't want to lose face as well. But the blame culture is pretty much standard. And in aviation, like I said before, aviation safety is written in blood.

• 30:25Speaker 02

  We learn from accidents. If we don't learn from accidents, then there's more blood gonna be needed to write, and that's not good.

• 30:32Speaker 01

  Yeah, I mean, obviously I've worked in Asia Pacific for a while now and certainly in cybersecurity was challenging on the basis that companies don't even sometimes want to help with an issue because they simply don't even want to talk about the issue.

• 30:45Speaker 02

  Exactly, yeah. And losing face is more dangerous than solving a problem.

• 30:49Speaker 01

  Yeah. So, yeah, I mean, obviously props to Verizon, you know, I mean, I think, I believe the Verizon D B I R came out with the fact, well, it had its own pretty major hack at one stage and instead of. Sort of sweeping it under the carpet, so to speak, they went completely the opposite side and said, look, we're going to be the people that hold the the flag for reporting. So I think that's very interesting. And as you call out, aviation has had to, or at least aviation outside of, say, dictator, state, country sponsored airlines, they kind of have to learn from each other. Otherwise, as you call, unfortunately, people literally die. And that's sort of why it's been so critical.

• 31:29Speaker 02

  So how these airlines in authoritarian regimes often learn is by reading our open source reports and learn from that. So they learn from us, they leech. And internally, if somebody makes a mistake, that person is simply being fired on the spot. That's how a blame culture solves problems.

• 31:46Speaker 01

  Yeah. So we're going to move along to, we always have to talk about AI these days. But here, this is not bad. We've gone well over half an hour without even mentioning AI. But where are you seeing AI, especially, obviously, we're talking here about cybersecurity, cybersecurity in aviation systems. Is there anything kind of being rolled out here to do with AI in terms of threat detection or anything along those lines? I mean, what are you seeing in that space?

• 32:14Speaker 02

  Well, splitting the aviation industry in two parts, one, the airplane and the other one, just simply the rest, the airport, the airlines, which are also just buildings with people and computers and networks and their own vulnerabilities. On the airplane side, I do not see any AI being implemented. From where I can see it, I'm sure Boeing and Airbus and Embraer, they're all working on it. But I do not at the moment see any implementation of it in my airplane systems today. Having said that, on the other side, of course, airports, airlines are working on their own AI applications. For airlines, that is mostly about efficiency, operational efficiency, fuel efficiency. And on the other

• 32:59Speaker 02

  hand, of course, client retention, passenger retention, passenger appreciation, and all that side of the business. As in cyber, I think the same again for any other industry. We're trying to use AI to threat detection, behavior analysis, threat intelligence processing, automated incident response, same as in every other industry. But again, for my airframe, I don't see anything yet.

• 33:24Speaker 01

  Okay, moving on from say AI, but 5G, you know, 5G.

• 33:27Speaker 02

  Yeah.

• 33:28Speaker 01

  I believe is rolling out, well, is 5G rolling out within the airframes themselves? Or is it more just that 5G has a standard, is having effects on say instrumentation? Or what does 5G do in this case?

• 33:40Speaker 02

  I can imagine that engine manufacturers are very happy with it because with 5G chips in their engines, they can send loads of data way faster. And that's all telemetry they need for preventive maintenance, of course. It's very important data. Furthermore, I don't see this in or around my airplane a lot. I guess most of the data when I'm airborne or all data will not go by 5G because at 12 kilometers, there's simply no reception. So it will go via ground stations and then it might be further on routed by a 5G. But those are our ground systems. I don't consider that aviation systems at all, just a ground based communication system with all the risks that come with it. Because imagine if you can, let's say you can control all the hardware being used for 5G with backdoors, wouldn't that be great?

• 34:25Speaker 02

  What a great threat service that is. I'm just saying, whoa, why?

• 34:29Speaker 01

  Yeah, I mean, it's widely reported, obviously, that that's could be quite a threat, you know?

• 34:34Speaker 02

  Unfortunately, still a lot of people that don't understand. Below the radar, it's hybrid warfare. It's not warfare, but it's still hybrid warfare. And we need to understand that we are being threatened. We need to understand who is the enemy here. And that's where threat intelligence is crucial and sharing threat intelligence.

• 34:51Speaker 01

  Yeah. And moving on from 5G, so we're just sort of hitting the key emerging technologies in this space. Drones, you know, we can't ignore drones. So let's just talk about those for a second. And we're not necessarily talking about military drones, we're very much commercial drones as well. But like they're kind of being integrated into controlled airspace these days. You know, I mean, certainly I find it fascinating in Singapore, I see so many commercial drones now, you know, they're used for surveying, you know, there's one, I live near some water and one pops up. Every morning to kind of survey the water stations or something to that effect. I mean, these things are huge. How is that affecting sort of especially again in the cybersecurity lens? Like what kind of extra threats or sort of challenges is adding?

• 35:35Speaker 02

  Well, stepping away from cybersecurity and just for aircraft safety. Like birds, you don't want drones next to your airplane. Now, anybody can buy a drone for a hundred dollars or euros or pounds or whatever and fly this thing around. And it's amateurs flying this cheap stuff around airplanes that is the real risk. In Singapore, we love our technology. It's widely being implemented for the benefit of the whole society, but it's all controlled. It's very tight controlled. There is no airport in the world allows drones close by, but how do you check until it's too late? I have quite often I hear on the radio, somebody reports a drone nearby. And it's just some idiot with a camera trying to make a great shot for his Instagram feed or whatever.

• 36:21Speaker 02

  But it's not safe and we shouldn't do that. But it's more a legal problem because we need regulations on that. And next to that, we also need tools to punish the people who do. I would be great if we could have a laser gun shooting down illegal drones around my airplane. Preferably automated, that would be great, problem solved. But we don't have the legal tools for that yet. So the legal frames are still in the making. But the next couple of five years, we're going to see a lot of regulations around drones. It's still all very much in the beginning of the development. And then I'm not even talking about warfare and hybrid warfare drones that are being used for surveillance,

• 37:00Speaker 02

  intelligence gathering or just disrupting with GPS jamming and spoofing, just fly around around an airport and jam everything for a couple of hours. ADS-B interference, of course, there's a lot you can do with a drone to create chaos and to disrupt. And disrupting an airport is disrupting the economy very directly.

• 37:20Speaker 01

  Yeah, so we're going to move along to more of the training and education side. I mean, I know this is something that you work in a lot. I think you said sort of towards. The beginning of the episode, just that a lot of pilots are simply not getting any kind of training when it comes to the cyber side of things. But I believe there is some form of simulator based cyber training. Could you just speak a bit to that and like, how realistic is this to actually mimic the problems? And just where does it kind of even start in terms of bringing cyber training into the simulator side of things? And I mean, I guess for those who are not super familiar with aviation simulator training has always been a huge part of modern flying.

• 38:03Speaker 01

  You know, you have to do sort of set hours, I believe, on simulators and practice catastrophic situations and this kind of thing. But that's sort of, to my understanding, always been, or until recently, without this lens of, but it could be a cyber attack. It's just, oh, my engine failed and for pure mechanical reasons and now we need to deal with that, which is different to my aircraft is under cyber attack. So yeah, could you just speak a bit to that?

• 38:27Speaker 02

  Yeah, you say correctly that simulator training is actually the only way that pilots learn. You need to see, feel and do it. We do a lot of CBT training as well, but that is basically all compliance. You don't learn much from that. That's just not how it works. Not everybody is a visual learner, especially pilots, since there are a lot of complex procedures. You need to hands on train these procedures. Only then you will fully understand what it means, how it works and why the procedure is designed as it is. So if we need to train cyber scenarios or hybrid warfare scenarios, we need to do that in a simulator. That is very obvious. Unfortunately, nobody does that in the world yet.

• 39:10Speaker 02

  And for that reason, I started last year, the Aviation Cyber Academy in Singapore with a curriculum for our masterclass in cybersecurity for pilots where we start with the basics. Then we talk about airplane threat services. We identify it all. Then we move over to your specific airplane and then we do scenario based training, two hours in the simulator afterwards. And then gets interesting because the simulators were not designed to simulate cyber attacks and hybrid warfare attacks. So I need to be very creative in showing the right cues and data for them to understand what's really going on. So there's a lot of creativity involved yet, but I'm sure that the simulator builders are now working on

• 39:54Speaker 02

  creating more realistic scenarios in their simulator as well. But yeah, it has to be simulator training. Hybrid warfare scenarios actually have to be recognized and trained as well. Those are actually much easier because I can simulate, of course, a unverified message coming from an illegal sender and non-verified sender. That's much easier.

• 40:13Speaker 01

  And what sort of general uptake or reception have you sort of found? I mean, you're very much on the ground in Singapore doing this training. I mean, are you finding these are pilots coming from other countries to come and do this, or at the moment is it more Singapore-based thing? I'm just curious sort of how the industry is receiving this.

• 40:32Speaker 02

  Okay, well, the industry is actually not receiving it at all at the moment. For the same reason I stated in the beginning that the airline top management does not see cyber yet as a primary business risk. I talked to pilots, they would love to go through the training because we always feel we need to understand what's going on. But then again, they don't pay the training and you need to have it on your roster, on your schedule. The simulator needs to be reserved, you need to have an instructor. The whole training part of that and the organization part of that needs to be done as well. So for now, it's ready to roll and I'm waiting for airlines to show up and tell me that we need this. Because right now, ninety-one percent of crew reports that they are concerned

• 41:16Speaker 02

  about flight safety impacts of not being trained rigorously enough about what's going on here. They just don't understand and I can't blame them because this is quite complex stuff.

• 41:26Speaker 01

  Yeah, that's very interesting. And obviously, I hope as a passenger, as much as anything, that this is taken more seriously by airlines, yeah. So I mean, we're coming up for time a little bit, but I'd just like to get your take on, I guess, sort of the next, I know, this is always a bit of a crystal ball, the next five years, for example, in sort of aviation, cybersecurity, what are some things that maybe you think are very likely to actually advance? And then maybe what is a couple of things that you would like to advance, but you're not convinced that even within five years, they're going to change?

• 42:02Speaker 02

  Okay, well, I'm very much convinced that nation-state cyber warfare will increase because it's a very cheap and below the threshold way of disrupting your enemies. So we're going to see more cyber warfare also affecting aviation. And we can see Putin now is getting more bold. He's now blowing up supermarkets even in Europe. No shame at all. And it's very difficult to attribute that to him. So we will have more hybrid warfare, more nation-state cyber warfare, absolutely, which only makes my point that we need to continue being more resilient and ramping up our security. And for that, of course,

• 42:43Speaker 02

  critical infrastructure ISACs are absolutely necessary, not just get all aviation together. That's way too small. We need to have all our critical infrastructure CISOs together, and we need to start sharing today. It's not a luxury, it's a necessity.

• 42:58Speaker 01

  Yeah. And I mean, I think you sort of, I guess, touched on it with your cyber simulator training. It's one of these sort of, I guess, chicken and egg problems where you've just sort of predicted that, well, the problem's only going to get worse. So you'd think that there are more opportunities for there to be more, I guess, commercial businesses coming into the space, like the way that cybersecurity has, as an industry, exploded over the last 20 years, an explosion of, say, EDR providers and this kind of thing. Do you see there being a version of the next five years where aviation cybersecurity is suddenly is a hot thing? And, you know, I would say, or I'm questioning, like, the incumbents, let's just take CrowdStrike as an example, like, could you see a CrowdStrike having an aviation

• 43:42Speaker 01

  offering, for example, where an EDR sits on a plane or anything like that?

• 43:46Speaker 02

  Well, yes and no. I don't think CrowdStrike is going to do that because they simply don't have access to the architecture of the airplanes. I would love to say that within five years, I hope Boeing, Airbus, Embraer and all the big names are working very hard on that and can show me at one day a brochure and a diagram saying, "This is how we fix it. This is how we increase our resilience." Very unlikely they'll give me a call, but I really hope they're working on that. On the other side of aviation, the non-airplane side of aviation, of course CrowdStrike can do whatever they do and what they're good at doing by creating more cybersecurity and resilience. That part of the aviation sector I do not find very interesting because it's the same challenges like

• 44:29Speaker 02

  manufacturing, the finance or healthcare. It's just a building with a lot of network and most likely some OT attached to it as well. Which, by the way, OT, operational technology, has their own challenges. But that aside, yeah, I really hope that there will be more vendors, but as you know as well, 20 years of cybersecurity, a multi-million cyber vendor market, and it's all very sexy with nice tools, but we forget the basics. I am teaching cyber hygiene basics. That's what we keep forgetting because it doesn't sell. So the market is created to create money, not to create security. In general, I see a lot of products on the market that are being sold to people that don't need it. Confusing CISOs.

• 45:14Speaker 02

  Maybe they're inexperienced because there's also young CISOs and they walk around on these floors of large cybersecurity events and they're being attacked on all sides by vendor. "You need this, you need that, we can do this, yes, we can do it." Month later, "Oh, actually it doesn't fit. No, cannot connect. No, actually configuration doesn't work. Yeah, sorry boss."

• 45:31Speaker 01

  Yeah.

• 45:32Speaker 02

  Big problem. And once it's connected, it's already legacy because you can't get rid of it anymore. And that's a big problem. And that's why an airplane, like a Boeing or an Airbus, it has a lot of third-party hardware and software as well. And connecting all that stuff is a challenge, absolutely. And that's why there are standards. So changing these standards, again, talking air wing, changing these standards has a huge impact because everybody, every vendor, every third-party hardware and software provider has to adapt. Which costs money, which makes the product more expensive, which makes the airplane more expensive. It's all connected.

• 46:09Speaker 01

  Yeah, I think that's a really good call and we obviously... Saw the, obviously it wasn't cyber related, but it was sort of technology related. We saw sort of the outcome of this in those Boeing 737 MAX crashes where effectively technology had changed, but it changed at a pace that hadn't for various reasons, cost reasons, et cetera. Pilots had been trained on that technology change and the outcome was catastrophic unfortunately. And I think what you're getting at is the fact that for anything to change inside an aircraft, we're not talking like a lead time of like a year, it's like 10 years from sort of start to finish of, especially if we think of, again, let's just go back to the CrowdStrike example for a second.

• 46:51Speaker 01

  It touched the kernel of Windows, which is in theory why it's able to protect things, but it's also in theory why it's actually got the most risk if it goes wrong, because it can sink the whole system. So I think in aircraft, that would obviously be just doubly problematic if you have systems that technically could fail the whole aircraft as well.

• 47:10Speaker 02

  Absolutely. Great example. And then next to that, you buy an airframe for 30, 40 years. We have the same problem like the maritime sector, these big container ships, they've been around for 40, 50 years, man. Most of them still run on MS-DOS. I tell you, MS-DOS, talk about cybersecurity and resilience, I mean hacking on container ship, really, it's not that difficult.

• 47:30Speaker 01

  Yeah, wow. Well, maybe we'll need to find ourselves a maritime expert as well to bring on the show at some point, yeah.

• 47:37Speaker 02

  And then next to that, we're going to have a lot of extra frameworks, new frameworks, regulation frameworks, they will mature significantly, I think. ICAO will probably set the standard and the standards will probably become mandatory with enforcement mechanisms. Right now, it's all more advisory, but we need to enforce because you can imagine, let's say, one country is taking the ICAO standard serious and the country next to it is not, that's not working. We have to do it all together. Cybersecurity is teamwork. So enforcement is going to be needed, otherwise it's not working. And then in Europe, EASA and the FAA, they will also implement, I think, binding cybersecurity requirements for aircraft certification and airline operations. We can't ignore it anymore. We can't afford it.

• 48:21Speaker 01

  Yeah. Well, I think that's a great place to leave this today. I mean, I think this has just been a fascinating conversation and obviously a lot of knowledge and understanding imparted from you today, sir. So I really appreciate you coming on. Software Engineering Daily and I think, I imagine 99% of our audience have learned something new today. So thank you so much for coming on.

• 48:41Speaker 02

  My pleasure. Have any questions, find me on LinkedIn and I gladly answer them.

• 48:45Speaker 01

  Fantastic. Thank you so much.