The aviation industry is fast becoming one of the hottest areas of interest amongst the cyber community, particularly insurers, as the risk profile to both airplanes and carriers increases.
Over the past few months there have been a number of incidents involving cyber within the aviation industry, ranging from industry ‘standard’ breaches of bank accounts, all the way up to supposed incidents of hacking into on-board airline controls.
The Irish aircraft carrier Ryanair suffered a breach of its bank accounts in April, with hackers reportedly making off with £3m in funds, which was believed to originate from a Chinese source.
The US Government Accountability Office (GAO) recently issued a stark warning around the vulnerability of Wi-Fi networks on commercial airlines, stating that “modern aircraft are increasingly connected to the internet. This interconnectedness can potentially provide unauthorised remote access to aircraft avionics systems.”
And only recently an info-security researcher named Chris Roberts claimed to have hacked into the controls on an airline, sending a command to one of the engines to power up and temporarily fly the plane ‘sideways’.
These are just a few incidents that are causing a stir in the aviation and cyber insurance industries, as the increasing automation of controls within modern aircraft airlines creates potential exposures of their network.
There are a multitude of attack methods that pose a threat to airlines. On a ground level, phishing attacks are a popular method used by criminals; according to the Centre for Internet Security (CIS) 75 US airports were targeted with advanced persistent threats in 2014, due to a public document which exposed airport staff email addresses.
Remote hacking and Wi-Fi attacks are another form of attack, with flight control systems and Wi-Fi networks offering a new means for hackers to compromise an aircrafts command centre. Couple this with ‘ghost’ flights, when a hacker inserts or removes a plane’s projection onto radar screens, and there is plenty for insurers to consider when writing policies around this new threat.
One of the main aspects that is driving this threat is the connectivity on modern aircraft, with many planes now offering USB ports for passengers to connect mobile devices. This new risk also exposes the aviation industry from an insurance perspective, as cyber polices (at the moment) are not going to cover the property damage or business interruption that could occur if a plane is compromised, or worse, caused to crash due to a malicious breach.
What this highlights is a need for aviation insurers to work more closely with cyber insurers. As the cyber market matures and the capacity increases, more businesses will take up cyber policies and the type of coverage should become more detailed. However this process will take time, which may be problematic for the aviation industry as the threat posed to their business is already here.
One way to confront this threat is via aviation insurers; as this market has been around for much longer it has a much larger capacity to handle the cyber threat. The only issue for this market is the lack of experience. So there is an opportunity here for brokers and underwriters in both cyber and aviation to work together to protect airlines against the incoming threat of cyber-attack.
Jack Elliott-Frey is a cyber broker with Safeonline LLP.
