Cybercrime is an ever-present threat, which business jet connectivity players are countering through various means, writes Rob Coppinger
In business aviation, connectivity is not an option but a prerequisite. Users demand free-flowing information, and this is enabled by a vast infrastructure. To ensure the cybersecurity of the connectivity solution, there must be no weak links between the user, the satellite and the terrestrial data centre.
“The hardware and software, if professionally managed by aviation IT experts, are not the weakest links,” says Josh Wheeler, senior director of entry into service at Satcom Direct (SD), which provides satellite services and systems for business aviation. “We have built robust routers and antennas to meet the demanding needs of business aviation to effectively and consistently transmit data,” he adds.
Joined-up solution
Wheeler explains that the sector is becoming “more digitised”, with data generated from an aircraft providing valuable insights into aircraft performance, for example, and it all needs to be protected. SD develops its own software, infrastructure and hardware. Wheeler says customers benefit from SD’s “heightened visibility into the connectivity system and can be better prepared to anticipate and mitigate any events”.
Too often, Wheeler explains, cyber events are instigated by bad actors taking advantage of those who are unaware of what they need to do. Security breaches can begin with a lack of awareness of phishing emails. Passengers’ devices might lack antivirus software, or they might log into a non-password-protected network and inadvertently upload malware. “This is why we focus on education too,” says Wheeler.
SmartSky Networks, an air-to-ground network provider, offers connectivity in the continental USA. The onboard systems work with cabin wireless access points such as the Honeywell GoDirect Router and the Satcom Direct Router. Sean Reilly, VP of air transport management and digital solutions at SmartSky Networks, emphasises the company utilises a blend of its patented innovations and the best technologies available: “Our network is designed from the ground up and each aircraft gets its own dedicated connection,” he says. “The separate connection means no bandwidth is ever shared with other aircraft, providing enhanced performance and information security.”
That beam is also constantly changing every few minutes and to hack into it, if it can be detected in time, the hacker would need the “secret handshake” of that beam, Reilly says. “We’ve got more than 30,000 beams available in the USA, and each has its own unique identifier but it’s obviously changing as well,” he says.
Despite this there are still threats and the hackers are becoming more creative. “The vast majority [of vulnerabilities] are web application issues and nearly three quarters of attacks are now malware-free,” Reilly says, referencing cybersecurity firm CrowdStrike’s 2023 Global Threat Report.
Web application issues
Security misconfiguration and broken authentication are two problems associated with web application issues. The lack of an identifiable malware program makes these threats even more difficult to detect. “The key to avoiding these threats is avoiding unsecure networks – that’s what makes SmartSky’s inflight connectivity so different,” says Reilly.
Meanwhile, spacecraft orbiting the Earth underpin Viasat’s connectivity solutions. “Following our recent acquisition of Inmarsat, we now have a total of 18 satellites in orbit that already provide ample near-global coverage over both Ka-band and L-band,” says Claudio D’Amico, VP of strategic market engagement for business aviation at Viasat. “Our partners will play an important role here too. For example, at NBAA-BACE this year, Honeywell, Orbit and SD announced future terminal innovations that will allow business aviation customers to access our full Ka-band network.”
The cybersecurity for this orbit-to-Earth infrastructure has “deep layers, engineered into our end-to-end systems from the outset”, explains D’Amico.
Constant look-out
The network is monitored constantly to evaluate threats and anomalies without the need for additional hardware on the aircraft, D’Amico explains. In business aviation, Viasat’s Ka-band capacity provides high-speed solutions for a broad range of aircraft, from super-midsize to large-cabin jets. “Our L-band capacity provides resilient services that can either be used as primary connectivity for smaller or older aircraft,” D’Amico says.
At Gogo, security measures span both hardware and software solutions. The company offers 3G in-cabin wi-fi as part of its solution that connects with its 4G network. “We have physical hardware in the network that is solely for cybersecurity, and there’s also a lot of software solutions, so it’s a combination of both,” says Michael Schnepf, VP of network engineering at Gogo.
Layer 7 firewalls
Schnepf adds that Gogo’s vendors use industry-standard software firewalls. “It’s a Layer 7 next-gen firewall that will come with software,” says Schnepf. “Cisco, Palo Alto Networks, all those vendors have their own software.”
Gogo also has cybersecurity software solutions that can run on any common-off-the-shelf (COTS) servers.
Like other companies, Gogo also has a security centre. Operating from Broomfield, Colorado, the Gogo Network Operations Center provides monitoring and troubleshooting for all the elements of the Gogo Business Aviation mobile broadband network. Beyond the centre, the firm’s own satellite ground stations and its cables linking them to other infrastructure provide what Gogo calls “secured networking” to its firewalled and segmented data centres.
Schnepf sees cybersecurity growing in importance, and says Gogo has exciting solutions coming: “We’re growing our cybersecurity programme; the business is expanding globally.”
Gone phishing
Like other companies, Gogo is seeing an increase in phishing attacks. “Threat actors attempt to impersonate legitimate communication and target users with malicious emails and text messages,” says Schnepf. “They are an attempt to get users to click a hyperlink to install malware. Educating personnel to avoid this is a key change.”
Methods of attack and defence evolve endlessly. For the business jet passenger, an hour in the classroom might be the ultimate defence.
This feature was written by Rob Coppinger and first published in the December 2023/January 2024 edition of Business Jet Interiors International.
