The aviation safety sector is the study and practice of managing aviation risks. It is a solid concentration of regulations, legal documents, investigations of accidents and near-miss aviation incidents. On top of them lie lessons learned and shared knowledge; reports, facts and stats forming a cognitive super vitamin, that the aviation community uses to keep their business healthy and safe.

The above concept is successful. People trust the aviation sector and consider it the safest transportation. Sadly, when it comes to cybersecurity the community feels quite exposed and vulnerable. Stats that are not available, dark corners, and a lack of lessons learned from cyber incidents are some of the aspects that blur its reputation. Wouldn’t it be better if businesses and organizations adopt the successful “how-to” of the aviation safety sector to increase their cybersecurity level and the confidence of the community?

The idea behind

The recent cyber attacks renewed the interest of the industry, academia, and the US government in a form of a Board that could investigate cyber incidents. In the spring of 2021, a workshop was organized on creating a cyber incident investigative capacity modeled on the National Transportation Safety Board (NTSB). The NTSB is considered the most robust set of aviation safety programs. It acts as an independent Federal agency charged by Congress with investigating aviation accidents and major transportation incidents. NTSB investigates the causes and issues safety recommendations to prevent future disasters.

The workshop examined the feasibility of whether aviation safety procedures can be adopted by the cybersecurity sector to improve its posture. The output was a report where key findings were highlighted, research questions were recorded and a road map of recommendations was proposed. The report concluded that the cybersecurity industry does not have processes or authoritative and independent investigations whose focus is publishing lessons learned from cyber incidents and enabling improvements.

Policymakers in the cybersecurity industry have urged for an agency that will investigate cyber attacks and incidents, identify leaks and gaps in security controls and inform the community. From that perspective, the NTSB transportation safety paradigm is used frequently as an analogy, since it provides body, maturity, and substance to that concept.

The “cyber NTSB” conceptual approach

The workshop involved 70 expert minds who worked over four months on the concept of creating a “Cyber NTSB”, an idea born back in 1991. The problem handed over to the participants was the same as in the NSF 2014 Report: “A critical problem in cyber security is a lack of reliable, consistently reported data about security incidents. The lack of data makes it difficult for others to learn from these attacks, and is leading to misplaced priorities”.

The workshop was predicated on assumptions, all of which hold that the present cybersecurity safety system is insufficient and should be adjusted to match what the aviation safety industry performs. What the participants observed was that cybersecurity lacks information, knowledge and wisdom, not data; these are abundant.

Key findings of the workshop

At first, the workshop examined how a Board can be alerted about incidents to determine whether they merit investigation. Unlike in aviation, cyber incidents are not kinetic like air crashes and are wrapped with secrecy, as companies fear liability and damaged brand reputation, making their discovery difficult. The workshop’s findings were that:

• The Board can use existing reporting mechanisms effectively by filling the gaps between them.
• Cybersecurity and IT lack incentives for voluntary reporting, although it is clarified that information sharing does not violate antitrust laws.
• The awareness of the Board can be enhanced by individual reporting, although it may be considered as a company’s weakness and low investment in security.

Having an adequate reporting system present, the next question arose: which incidents require investigation? The workshop highlighted that there should be quantitative and qualitative criteria that will trigger the investigation procedure. Furthermore, it would be extremely useful if the Board could investigate not only incidents but trends as well. If it could track the cybersecurity ecosystem, identify common failures and trends in attack patterns, and associate best defense practices against these trends.

Next, the steps for a successful investigation were examined. How should investigations run, what exactly should be investigated, and what techniques should be used? The Board concluded that:

• Fact-finding should be a collaborative process; the analysis independent. As happens in aviation incidents, a lot of parties provide expertise related to the investigation, but they are excluded from the analysis and don’t contribute to the final report.
• Slow and careful investigations give value to the effort. Deep and detailed questions help knowledge gaining for the incident. Failures of the involved products, tools, and controls are significant and need to be looked at.
• The independence of the NTSB allows the Board to evaluate regulators and regulations.

Publishing reports of incidents and “near-miss incidents” is paramount. The workshop concluded that since there are no reliable data, records, and history of cyber incidents that can be used to build policies and response plans based on what has happened, the defender community often fights cases they don’t completely understand.

Finally, the reporting system should use narratives and numbers, as this will improve the “learning and sharing” concept, but should share knowledge wisely. There might be sensitive data, like “pilots’ last words to families”, that need to be disseminated with discretion.

The next steps

If safety was a fashion show, no doubt that aviation safety would be the top model; delicate but sturdy, where the maturity of time would add more charm to her. The challenge is whether cybersecurity can walk shiny on the same runways as aviation safety. The workshop proved that this is feasible if all parts cooperate to integrate knowledge to the highest possible security level.

To that end, the workshop sums up several research questions around adapting lesson learning systems from aviation, and key findings for further investigation. Finally, it suggests a series of recommendations for the Cyber Safety Review Board (CSRB) and Congress to evolve “Cyber NTSB” concept into reality; an entity that can learn from mistakes and successes, sharing knowledge generously.

Source: https://www.tripwire.com/state-of-security/featured/aviation-safety-cybersecurity-learning-from-incidents/cyber

Marine Energy Systems (MES) are focused on delivering silent, non-polluting and renewable sources of power into the marine sector. The company has a reputation for only working with credible, long-established companies.

With it’s UK nationwide network of trained skilled professionals, MES are able to service the whole of the UK – and one of the customer demands MES engineers face more and more frequently is an intelligent security system onboard.

Security concerns are inherent in two of three vessel owners; this considerable demand faces a lack of choice when it comes to security equipment purchase. Regardless of the vessel size, owners have to choose between spending over £5,000-6,000 for a specialised system or adapting a car/motorcycle alarm system. The last one is quite a hassle because navigation, key vessel indicators, controls and security are expected to be accessible on a digital dashboard and smartphone – anywhere, anytime.

MES works with big players and customers in this sector, including Sunseeker, a well-known luxury Superyacht manufacturer, and many others. MES came up with a request to supply boats with a security system which is compatible with the yachts’ onboard software. The system should: Support cellular connectivity; Have a mobile app to report alerts; Be straightforward to install; Look slick to fit luxury interiors.

Ajax security systems integrated via a proprietary API with wireless detectors that fit both luxury yachts interiors and tight budgets. MES’ engineers appreciated a hassle-free approach to system installation.

All detectors are equipped with SmartBracket panels meaning that there is no need to disassemble the enclosure. To connect a detector to the system, an engineer just scans a QR code with the Ajax app and the device is ready for configuring. The system parameters and detector configuration can be done from desktop or mobile apps. This system feature helps Marine Energy Systems in providing remote technical support throughout the entire vessel lifecycle.

Battery power became another practical aspect. Wireless devices do not require a power supply from a vessel at all. In turn, Ajax control panels, hubs, can be connected to the onboard electricity via the 6 V power supply unit. Backup batteries and low power consumption ensure long-lasting protection with no additional maintenance.

“I see a huge opportunity here,” said Lee Smith, Operations Manager, MES. “We work with various shipyards building leisure, commercial and service vessels – and all of them need some security solution. Having 25 years of experience in the boating industry, I think Ajax is a big leap forward, allowing us to build complex systems that will serve our customers all over the world.”

Source: https://securityjournaluk.com/ajax-disrupting-boat-security-market/