Advancing UK Aerospace, Defence, Security & Space Solutions Worldwide
  • Home
  • /
  • Aerospace
  • /
  • Bridewell Consulting reports on aviation's cyber security vulnerability

Aerospace Security

Bridewell Consulting reports on aviation's cyber security vulnerability

Eighty-eight percent of UK aviation organisations have detected cyber attacks on their Operational Technology (OT) or Industrial Control Systems (ICS) in the last 12 months, with 95% of these encountering at least one successful attack, according to new research from independent cyber security services company, Bridewell Consulting.

Image courtesy Bridewell Consulting

These findings come despite over three-quarters (78%) of organisations saying they are confident that their OT systems are protected from cyber threats, highlighting a degree of misplaced confidence in CNI cyber security in the sector.

The research, which surveyed 250 UK IT decision makers in the aviation, chemical, energy, transport, and water sectors, found aviation to be one of the most confident sectors when it comes to cyber security, despite detecting the highest volume of attacks.

Advertisement
Marshall RT

Aviation organisations are facing increasing risks posed by ageing legacy infrastructure that is becoming increasingly connected. The majority (88%) rely on OT systems that are between 6-20 years old, with over half (52%) between 11-20 years old. Systems are also increasingly accessible with 88% confirming that OT / ICS environments are accessible from corporate networks. Whilst over half (52%) say systems are currently not accessible from the Internet, of those, 54% plan to make them accessible in the future, potentially widening the attack surface and introducing new threats.

The research also reveals aviation organisations believe third party suppliers and partners pose the lowest risk. This is despite the National Cyber Security Centre (NCSC) and revisions to the NIS Directive (NIS 2) identifying the supply chain as a significant area of risk for CNI organisations, indicating a possible educational challenge over certain cyber threat vectors in the sector.

“The report highlights some nuances between how some organisations in the aviation sector perceive their cyber security posture versus reality” said Scott Nicholson, Co-CEO at Bridewell.

“Security vulnerabilities, whilst challenging to remediate within some CNI organisations, could have serious implications, not just in terms of substantial monetary fines but also risks to public safety and even loss of life, so organisations simply cannot afford to be complacent.”

Covid-19 has also intensified cyber threats with nearly half (45%) of UK aviation organisations experiencing increased attacks since the pandemic began. Yet over a quarter (28%) have reduced cyber security budgets in response. This is putting increasing pressure on IT and security teams with 82% agreeing they have felt an increasing pressure to improve cyber security controls for the OT / ICS environment in the last 12 months.

Advertisement
ODU RT 2

Encouragingly, 98% of organisations are carrying out some form of security assurance activities. However, less than half (44%) carry out penetration testing and only 37% conduct red, blue or purple team exercises, vital activities that can identify vulnerabilities and reduce the likelihood of attacks.

This could be due to mounting pressures, with understanding regulation cited as the top challenge facing teams today (cited by 34% of respondents), followed by a lack of knowledge/skills (32%). While 86% believe they currently have the right skills in place to maintain and secure their OT environment, worryingly 84% agree the UK’s CNI industry will be impacted by a critical cyber security skills shortage in the next three to five years.

“Aviation remains one of the most targeted sectors and while legislation like the NIS Directive and regulations has certainly helped to improve cyber security in the sector, there’s still room for improvement. Proactive cyber security activities such as vulnerability management, penetration testing, patching and threat assessments should be standard practice across the industry. This can be a challenge when balanced against the operational demands of the business, but the bad guys don’t care, so steps need to be taken to improve security before it’s too late,” concluded Nicholson.

 

Advertisement
L3Harris LB May IR L3Harris LB May IR
Rolls-Royce and TCS collaborate on hydrogen research

Aerospace

Rolls-Royce and TCS collaborate on hydrogen research

23 July 2024

Tata Consultancy Services (TCS) has expanded its partnership with Rolls-Royce to advance its sustainable initiatives, with researching hydrogen fuel system technology and continuing to prove hydrogen could be a zero-carbon aviation fuel of the future.

Cranfield University joins Avio Aero innovation cluster

Aerospace

Cranfield University joins Avio Aero innovation cluster

23 July 2024

Cranfield University has become part of an industry innovation cluster which aims to address the complex challenges of the future of flight through close collaborative work.

BA orders first GEnx engines for new Dreamliners

Aerospace

BA orders first GEnx engines for new Dreamliners

23 July 2024

International Airlines Group (IAG) has committed to purchasing GEnx engines from GE Aerospace to power six new 787 Dreamliners for British Airways – the first introduction of this engine into their fleet.

Virgin Atlantic orders seven A330neo at FIA2024

Aerospace Events

Virgin Atlantic orders seven A330neo at FIA2024

23 July 2024

Virgin Atlantic has placed a firm order for an additional seven A330neo aircraft at the Farnborough International Airshow (FIA) 2024, to complete its fleet transformation.

Advertisement
Marshall RT
Leonardo invests £604m in UK helicopter ops and supply chain

Aerospace Defence

Leonardo invests £604m in UK helicopter ops and supply chain

23 July 2024

Leonardo has invested £604 million in onshore helicopter operations and UK supply chain at its manufacturing facilities in Yeovil and is accelerating its UK uncrewed helicopter design and development, with the first flight of its Proteus Airborne Collaborative Platform (ACP) slated to take place in Q1 2025.

BA to fund training of 200 pilots

Aerospace

BA to fund training of 200 pilots

23 July 2024

British Airways has today announced it will fully fund up to 200 places on its Speedbird Pilot Academy recruitment programme.

Advertisement
Gulfstream RT July