Avionics News March 2022 - 34

CCX SCORES WITH AVIONICS TESTING & CYBERSECURITY
Continued from page 32
the aviation industry was grappling with new satcom
providers and capabilities in the early 2000s
Some maintenance organizations are proactive in
offering cybersecurity solutions to customers and others
not so much. " In reality, unlike a typical maintenance
issue, it is not as obvious to offer cybersecurity, "
Bartlett said.
Hacking of aviation-related computer systems does
occur. In October 2021, Flying magazine reported that
a former employee hacked into the facility's computer,
according to police reports. The maintenance technician,
who was arrested, allegedly altered or deleted the
maintenance records on a dozen aircraft. All squawks
had been removed, which meant the aircraft may have
been operated in an unairworthy condition on seven
flights.
CCX advises customers to do an evaluation of their
aircraft networks based on the latest vulnerabilities and
intrusion methods used by hackers. These techniques are
always changing.
This year, CCX is encouraging business jet operators
to move away from checking the network at a point in
time to perpetual monitoring. CCX recommends this
continue whether the aircraft is on the ground or in the
air. SystemX installed on the aircraft is capable of doing
this and it can operate autonomously.
CCX then monitors the performance of its SystemX
based on the level of service selected by a customer.
Some may not need or want to pay for in-flight
monitoring. CCX can download data while the aircraft
is in the air or post-flight depending on how SystemX is
configured.
The Canadian company is engaged with aircraft
manufacturers and the military services. Its SystemX
system can be used on any MIL-STD-1553 bus, ARINC
429 bus, ADFX or standard Ethernet.
A key part of the service is to continuously update
things for new vulnerabilities in the cabin or on the
flight deck as hackers change their intrusion tactics.
It is easy for CCX to update SystemX equipment on
an aircraft. This doesn't require as much work as a
configuration change would.
In a CCX white paper on aviation cybersecurity, the
company asserts that the traditional ways of assuring
aviation network security defined by RTCA DO-326A
are not sufficient.
34 avionics news * march 2022
Testing aircraft systems as individual entities
no longer works when they are increasingly
interconnected. These linkages can be analyzed for
known vulnerabilities under current RTCA and EASA
standards, but vulnerabilities are constantly being
discovered by those who want to exploit them. Networks
must therefore be monitored to identify previously
unknown and undetected exploitation.
Malware can bridge networks, and the Stuxnet
computer worm showed that physical damage is possible
when it was first used to cripple hardware at Iran's
nuclear facilities. Stuxnet has mutated and spread.
CCX recommends persistent monitoring of all networks
on board an aircraft, including avionics data buses,
passenger entertainment systems and maintenance
networks. An attacker only needs to be right once.
CCX also has a white paper on how to fully secure the
avionics bay and cockpit against future cybersecurity
threats using a Zero Trust Model.
Unlike the perimeter model of security that trusts all
traffic, devices and users that pass through a specific
gate, Zero Trust assumes no traffic or device should be
trusted unless it meets precise parameters. This is an
architecture like that for a triple INS system that doesn't
trust a sensor if it starts to diverge from the other two.
The INS system doesn't trust all three throughout the
flight after they have passed a preflight check.
Perimeter security is vulnerable because anyone
who gets in can move about freely. This flaw has been
exploited in a lot of known cyberattacks, and Zero
Trust is now needed to protect more complex and
interconnected systems. CCX explains how a Zero
Trust architecture works and how it can be implemented
incrementally in existing avionics systems that were
designed before this type of cybersecurity became
necessary.
Ottawa, where CCX is headquartered, is a center of
high-tech businesses, including multinational giants and
homegrown companies. Software-intensive aerospace
businesses like CCX in Ottawa also include Searidge
Technologies, a leader in remote ATC tower technology
as well as the Fortune 500 companies General
Dynamics, Thales, Leonardo and Lockheed Martin.
The company is operating in its fifth year now, and it
has 30 employees. In the future, it wants to expand from
aviation to additional defense applications. q
To learn more about CCX Technologies, visit
ccxtechnologies.com.
http://www.ccxtechnologies.com
Avionics News March 2022

Table of Contents for the Digital Edition of Avionics News March 2022
