The aviation industry is focused on cybersecurity risks , but recent revelations about risks in Boeing 's supply chain have highlighted the critical need to mitigate these risks, according to SecurityScorecard.
The report comes at a time when regulators around the world are strengthening cybersecurity requirements in the aviation sector. The US Transportation Security Administration introduced new mandates in March 2023, while EU Regulation 2023/203 will come into effect in 2026, setting a new standard for managing information security risks in aviation
Read also: Fake X accounts are defrauding airline customers
As the aviation sector faces increasing threats to the supply chain, it is critical to fully understand the extent and impact of these risks in order to develop effective response strategies.
The aviation sector is rated a "B" in terms of cybersecurity
The aviation sector has an average cybersecurity score of "B." Companies with a "B" score face 2.9 times greater risk of falling victim to a data breach than those with an A score.
Software and IT suppliers specifically related to the aviation sector score the lowest, at 83, which poses significant risks to their airline customers. Customers, in turn, may pose risks to their suppliers. This research provides three recent examples of airline breaches that exposed sensitive information about their aerospace and aviation suppliers. Overall, software and other IT services account for up to 75% of third-party breaches across industries.
Seven percent of companies surveyed reported public breaches in the past year. Additionally, 17 percent had evidence of at least one compromised machine. Airlines experienced 4 percent more breaches than the industry benchmark, largely due to vulnerability to lower-scoring vendors, which increases third-party risks.
See more: Boeing's Starliner can't return to Earth
Developed economies, such as Western Europe and Australia, perform better in the cybersecurity sector, with significantly higher scores. Cyber threats from states such as China indicate that serious disruptions are expected in the future.
Airlines that receive the best ratings from airline and travel industry analysts, as well as customers, have above-average safety records. Average ratings for budget airlines are almost on par with those for full-service airlines.
Ransomware is a significant threat
Application security is the area where airlines often score the lowest. The most common issues that negatively impact these scores include the use of HTTP in redirect chains and the lack of two key features in session cookies.
The absence of “secure” attributes allows cookies to be transmitted over HTTP connections, increasing the risk of interception by hackers who can exploit them to gain access. Also, the lack of the “HTTPOnly” attribute allows client-side scripts, such as JavaScript, to access these cookies, increasing the risk of attacks such as cross-site scripting and other forms of session hijacking.
Ransomware is the dominant theme in public reports of attacks in this sector. Ransomware operators actively targeting the aviation industry include the BlackCat , LockBit , BianLian , and Dunghill Leak groups.
Read also: Are Play and LockBit ransomware joining forces?
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Physical security technology is a critical target for this sector, given the strict restrictions on airline ground operations and the sensitivity of aircraft equipment. A notable example is the third-party data breach suffered by French aerospace manufacturer and aviation services provider Thales in June 2023, through its physical access control system supplier Automatic Systems, based in Belgium.
Top airlines, as ranked by industry and consumer standards, have safety ratings that exceed average.
"The aviation industry operates within a complex web of partnerships, but a company's safety depends on its weakest link. Our research shows that airlines are flying blind, ignoring third-party risks.".
See also: The Paris Olympics are facing cyber threats
"It is time for the industry to take action and prioritize robust security measures across its entire ecosystem before the turmoil turns into a disaster," said Ryan Sherstobitoff, SVP of Threat Research and Intelligence.
Source: helpnetsecurity
