The aviation industry’s embrace of digital technologies is enabling it to meet growing demand, enhance efficiency, and deliver stakeholder satisfaction. Take biometric data. According to research by SITA, an IT provider for the air transport industry, the use of biometric check-in and bag drop, coupled with the adoption of biometric ID management systems by airlines, will reduce wait times by up to 60% in 2026.
It is benefits like these that led airlines to spend $37 billion on IT last year. Yet these advantages in customer experience, efficiency and sustainability are counterbalanced with risk. The aviation industry is uniquely vulnerable to cyber attacks, and developing a comprehensive and viable approach to cybersecurity is a must. Mindaugas Rainys, Chief Executive Officer at Aerviva, outlines the key challenges cybersecurity presents for the sector, and how companies can navigate them.
What cybersecurity risks do aviation companies face?
“Aviation is vulnerable to cyber attacks from a range of bad actors. These can be hacktivists, criminal hackers, state actors, terrorists and more. Attackers look for vulnerabilities in a system, which could include software, hardware, network connectivity or people, and then either gather information or actually transmit signals or data,” explains Rainys.
The aviation industry has a history of such attacks dating back over a quarter of a century. In 1997, a teenager exposed a weakness in the airport’s system at Worcester, Massachusetts through a denial-of-service attack. In the last decade, hackers have targeted US airport computer and communications systems, disabled flight plans out of Warsaw airport, and shared the credit card and passport details of 9.4 million Cathay Pacific customers. Perhaps most worryingly, in 2015 a cybersecurity consultant was able to hack onboard computer systems to control an engine during flight.
“The threat of cyber attacks has been an issue for decades, and is becoming more acute as digital technologies are now embedded into our sector. Digitalisation is having a big impact on customer experience and behind-the-scenes infrastructure. AI and predictive analytics are delivering significant results in terms of improving sustainability and operational efficiency,” explains Rainys.
This puts pressure on IT systems, especially as passenger numbers increase. 74% of airlines forecast an increase in overall IT spend over the next two years, according to SITA’s 2024 Air Transport IT Insights report, with 66% mentioning cybersecurity as one of their top three areas of focus.
Aviation’s unique cybersecurity challenges
Focusing on cybersecurity is one thing. Getting it right is another, especially when it comes to the aviation sector. “As the ICAO has pointed out in its guidance on cybersecurity, this is a highly complex industry that has very high levels of interconnectivity. This means even a minor cyber attack can have an oversized impact because of knock-on effects,” comments Rainys.
The stakes are also high. Aviation plays a critical role in business and tourism, with whole regions impacted by disruption to continuity of services. Then there is the safety and security of people and facilities, which must always remain a top priority. “Unfortunately, this combination of interconnectivity and high impact makes aviation a natural target for cyber criminals. Keeping such a complex ecosystem protected is difficult. Meanwhile, attackers only need to find one vulnerability and they can increasingly do so using readily available and powerful tools. Therefore, effective cybersecurity in our sector requires a clear strategy, the right technologies, and well-trained staff,” explains Rainys.
An effective cybersecurity strategy
The ICAO’s Aviation Cybersecurity Strategy offers a good starting point for formulating your own approach to cybersecurity. It consists of 7 pillars, 5 of which focus on coordination in our sector at the macro level (International cooperation; Governance; Effective legislation and regulations; Cybersecurity policy; and Information sharing).
Its final 2 pillars relate to individual companies and organisations. “Firstly, there is Incident management and emergency planning: this refers to companies being prepared to effectively handle and swiftly resolve cyber attacks. And secondly, there is Capacity building, training and cybersecurity culture. This is about the proactive steps you take to ensure no attacks occur. Building on the ICAO’s guidance, regulations from both the EASA and the FAA require companies to proactively assess potential cyber vulnerabilities and take steps to mitigate them,” explains Rainys.
To meet these requirements, you need a robust strategy with the right technology and infrastructure in place. Companies are already investing, with the global market for aviation cybersecurity set to reach $6.5 billion by 2028, according to a recent IMARC Group report. In terms of where to focus, the Security Council of the US National Business Aviation Association (NBAA) recommends that companies assess risk levels for aircraft and mobile devices based on location and operation. It also advises formulating clear policy on how flight data is used, stored and shared, and best practices for device usage.
Cybersecurity-savvy personnel
“Even if you have the right strategy and technology in place, if your people are not conscious of cybersecurity and trained in how to prevent it, you won’t succeed,” argues Rainys. “Not everyone in aviation can be expected to have the same perspective as a cybersecurity professional, but for companies aspects like data security should never be just an afterthought,” explains Rainys.
“Air traffic controllers work with incredibly sensitive in-flight data, and must be cognizant of the potential risks in terms of cybersecurity. Meanwhile, pilots need to be prepared to deal with cyber attacks in flight. E-enabled aircraft bring improved efficiency and convenience via integrated IT networks. They also increase the potential risk. Manufacturers like Raytheon have developed cyber attack warning systems that inform pilots of a cyber intrusion. However, it is still up to the pilot to make the correct decision at that moment, which means an understanding of potential cyber threats is essential,” adds Rainys.
Aircraft maintenance specialists should also be trained in the potential risks of cyber attacks, especially in terms of proactive mitigation. Maintenance systems and MRO vendors are being actively targeted by cyber criminals as they represent a potential stepping stone for malware to be introduced into a carrier’s IT system. On the other hand, such well-established aviation players as Lufthansa Industry Solutions are developing and promoting solutions that increase cyber-resilience, like penetration testing.
An issue that is not going anywhere
Digitalisation is only going to increase in the aviation sector, as airports, airlines and other stakeholders continue to leverage technology to improve efficiency, sustainability and performance. This year, the IATA has launched Digital Aircraft Operations, an initiative aimed at supporting airlines in implementing more digital solutions for areas including flight operations, air traffic management, and ground operations.
“This ongoing digitalisation will further increase the complexity of our sector, amplifying the need for robust cybersecurity. We also have to remember bad actors are always looking for new angles of attack, which means standing still is not an option. However, I am confident we will rise to meet this ongoing threat. The aviation sector has navigated a century of rapid change and development, and is more than capable of meeting the ongoing challenge of cybersecurity. All we need is the right strategy and a strong focus on talent,” concludes Rainys.