A Systems Engineering Approach To Appraise Cybersecurity Risks Of CNS/ATM and Avionics Systems

The aggregate use of complex cyber-physical systems, incorporation of artificial intelligence and autonomy in flight operations has reconceptualised the aerospace cybersecurity paradigm to a new era. Cybersecurity is about the prevention or mitigation of malicious acts undertaken to either compromise systems directly or access valuable information that could be subject to criminal misuse. The cybersecurity of Communication, Navigation, and surveillance / Air Traffic Management (CNS/ATM) systems is aimed at controlling the effects of such threats and enhancing the safety of flying passengers. Besides, the cybers resilience of state-of-the-art CNS/ATM and avionics systems have been impacted by convoluted risk management issues. The security of legacy aviation and airport infrastructure has been curtailed owing to their annexure to public networks, which constitute a significant risk to the aviation industry and the general public as a whole. The existing control mechanisms in place, with the aim of assuring Confidentiality, Integrity, and Availability (CIA) of information, have a multitude of deficiencies in deciding the extent of vulnerability of systems, the severity of impact and subsequently overall risk rating. Weaknesses in some of the security controls which are intended to mitigate the impact of cyber-attacks also contribute towards this issue. A risk-based system engineering solution is envisioned in managing today's cyber-physical systems which may comprise of interwound Systems of Systems (SoS). This paper aims to investigate threats to aviation assets, vulnerabilities of aviation systems and to adopt a holistic approach to mitigate possible risks. The article also recommends a novel methodology to manage risks by enhancing the consistency and accuracy of risk attributes of CNS/ATM systems, avionics and airport systems.