By Lisa Gordon | October 12, 2017 Estimated reading time 5 minutes, 37 seconds.
Think your data is safe on your business jet? You may need to think again.
It turns out that aircraft networks are just as vulnerable as a bricks and mortar office, even when the plane is flying thousands of feet above the ground.
Global connectivity services provider Satcom Direct (SD) believes it’s time to start talking about data security on aircraft and that operators need to get “cyber smart” about the security risks.
“When you have a remote office, you think about security because it’s on land,” said Josh Wheeler, director, Entry into Service at SD. “There’s always been a disconnect viewing the aircraft as an office environment. But now that we have much higher speeds in terms of capacity and bandwith, we can truly view it as an office in the sky. Would you put a firewall or anti-virus in your office in the sky? Of course you would.”
Wheeler pointed out that passengers–particularly in the world of business aviation–are often CEOs and executives who deal with sensitive information.
“It could be intellectual property, trade secrets, or even information that could potentially change the course of the stock market. You want to protect that information,” he said.
Established in 1997, SD–which is headquartered in Melbourne, Fla.–offers a full suite of products and services designed to keep people connected while they’re in the air. Last year, the company acquired TrueNorth Avionics, an Ottawa-based inflight connectivity solutions provider for both the cabin and the flight deck.
Wheeler’s team goes out into the field, working with flight departments to evaluate their network needs, demonstrate equipment use, and identify areas of weakness. That’s where the company’s new Threat Monitoring module comes in. It’s a new feature of SD’s Pro platform, a customizable software suite that includes things like flight tracking, router status monitoring, maintenance scheduling and flight logs.
At NBAA-BACE 2017 in Las Vegas, the company debuted the SD Pro system and promoted its new Threat Monitoring service.
“For the show, we have a live router through which we are passing malicious traffic,” explained Wheeler. A so-called “white hat hacker” worked in the background, attempting to compromise the network. Attacks and responses were detailed in the Threat Monitoring log visible at the show.
Wheeler said the company customizes its products and services based on an operator’s individual circumstances.
“You first have to evaluate the nature of the traffic–what are the passengers doing? Once you understand their needs, you can pick your security posture,” he said. “No two situations are the same.”
SD offers what Wheeler called a four-tier approach, depending on what an operator needs. First is a questionnaire, designed to figure out a client’s level of cyber security. Next is an onsite assessment followed by around the clock threat monitoring. For clients who want the ultimate in security, SD offers private network services through its own data centre.
Wheeler said SD’s Threat Monitoring service doesn’t require the installation of any special equipment. Existing customers can add the service without affecting network bandwidth and therefore user experience.
“The nice thing is you don’t have to necessarily engage your corporate IT team, but you can have layered protection,” he added. “If it’s a large corporation, they may have a good security policy, but the flight department may not know it.”
He added that it’s all about taking a proactive approach to cyber safety.
“By giving this visibility to customers, they can better mitigate their risk. It’s just like having insurance–you hope you never need it, but if you do, you know you’re covered.”
Any device connected to the Internet poses a potential security risk and is vulnerable to inbound and outbound threats.
“This isn’t about fear tactics,” concluded Wheeler. “This is what we’re seeing today. We offer a suite of services; but first, we want to understand what you’re doing. Things change so rapidly. It used to be that if you had Internet and a password, you were OK. But cyber security should be one of a company’s top three priorities.
“When a CFO goes to the flight department and says they caused the compromise, you can’t throw your hands up and plead ignorance.”
The standalone cost for SD’s Threat Monitoring is about US$795 per month, per aircraft tail number. That includes 24-hour response, live threat monitoring, threat prevention and the blocking of malicious content. The service is available internationally.
