Around the world, in any market or business, cybersecurity is becoming increasingly important. Security threats on the aviation infrastructure are on the rise. From aircraft and avionics, to airports and ground infrastructure, it is imperative that strong cybersecurity methods are in place.
Aireon is addressing threats via an ongoing collaboration with Air Navigation Service Providers (ANSPs), regulators, and other industry stakeholders to create and maintain a service with security and safety as the top priority. Aireon believes that addressing security is a never-ending process over the development, operational, and maintenance life cycles of our service.
Aireon’s cybersecurity initiative began by identifying the relevant security framework that would result in the culmination of a security program that would meet customer, regulator and industry needs and requirements. Over the last several years, we have been diligent in ensuring we meet the objectives and requirements of the cyber security framework. This includes, but it is not limited to: Establishing security polices, implementing security controls, completing security assessments, conducting security operations monitoring and alerting, testing for and remediating security weaknesses and providing education and training.
Aireon also integrates customer and industry regulatory agency requirements and best practices into our security program. For example, Aireon is nearing the completion of a series of audits by the European Aviation Safety Agency (EASA) for a safety certification. These audits address software assurance, integrity of management processes (safety, security, configuration management, quality assurance, testing) and validation of operational continuity of services (data, technical support and billing). The EASA organizational Air Traffic Management / Air Navigation Service (ATM / ANS) certification represents a commitment by Aireon to provide a level of service commensurate with the critical needs of an ANSP providing air traffic separation services.
Aireon’s unique system design also addresses security risks through encryption, diversity and redundancy of physical assets. Although the Automatic Dependent Service Broadcast (ADS-B) signal is transmitted unencrypted, Aireon encrypts the signal as it is detected at the payload on the satellite. The information is routed through the virtual private network of the Iridium® network until it is unencrypted at the Aireon Processing and Distribution (APD) subsystem. The APD will integrate the ADS-B position report, encrypt the combined data again, and deliver the geographically filtered information to the specific ANSP Service Delivery Point (SDP). The location of the payloads in space and the multiple teleport network sites provides diversity and redundancy which prevents issues with physical security breaches that may occur on ground-based infrastructure. Additionally, the ADS-B payload has no reliance on Global Navigation Satellite System (GNSS) signals for timing.
Customer requirements are collected by Aireon as part of the contract development stage with the customer. ANSP’s have unique security requirements that are integrated into the Aireon development and operational requirements. As the customer updates their security plans, the requirements are flowed down to Aireon to maintain alignment. The introduction of these requirements continues to enforce a comprehensive up-to-date security approach consistent with the needs of the customer.
While having these security measures within the system in place, security goes beyond the flow of ADS-B data from the satellite to the customer. Woven internally across the Aireon organization, we employ risk management techniques to engage employees, customers and any single person interacting with the system to identify all risks. By doing so, it allows the company to proactively manage security risks with funded mitigations to ensure currency in our security posture.
Every day there is a new cybersecurity threat introduced that has the potential to impact organizations worldwide. Aireon’s security team is focused on identifying these threats and ensuring that they have no impact to the service we provide to our customers.