Penetration testing for aviation: Strengthening cybersecurity in aviation & aerospace
In aviation, safety has always been non-negotiable, and the same mindset must also apply to cybersecurity within the sector. As a leader responsible for upholding operational continuity, reputation, and compliance, you’re likely already aware that cyber threats are evolving as rapidly as the technologies your teams adopt. What’s less often discussed is how traditional approaches to cybersecurity can fall short in exposing hidden risks across the complex systems aviation depends on daily.
This blog highlights why penetration testing is a critical component of any serious cybersecurity strategy within aviation. From protecting mission-critical infrastructure to meeting regulatory expectations, we’ll explore the tangible business benefits of taking a proactive, intelligence-led approach to risk and the strategic value it brings to protecting the safety, trust, and resilience your brand is built on.
Table of Contents
Why aviation needs penetration testing
Few industries in the world are as high-stakes as aviation. If you consider the value proposition of any aviation business, it’s pretty wild, isn’t it?
We’ll fly pretty much anything – including people, anywhere. And we’ll do it using an internationally developed, globally recognised, completely interoperable set of systems, procedures, people and infrastructure that will help us coordinate the safe delivery of your precious cargo. And we’ll get it right, pretty much every time.
It’s very easy to die when you’re flying through the sky at hundreds of miles an hour so aviation made it very hard for things to go wrong or accidents to happen.
The numbers speak for themselves. One can do a somewhat morbid calculation to determine the number of fatalities per mile travelled; the lower the number, the safer the transportation. Aviation tops the list in terms of safety. It’s twice as safe as rail and six times safer than road driving.
It’s a remarkable achievement of international cooperation and the strictest adherence to the highest standards. And that means that any companies that are a part of the industry have a serious amount riding on their ability to deliver products and services of the highest quality to the highest standards, consistently.
Take the inimitable Airbus A380 for example. Airbus uses over 1,500 suppliers to birth every single one of the double-decked behemoths. That’s an incredible supply chain, especially since that means that every supplier of every nut, bolt and screw needs to manufacture those things to a standard that’s fit for use at 35,000 feet.
But once you’ve got your shiny new A380, you need somewhere to park it, people to fly it, fuel it and maintain it; sell tickets to passengers, handle their luggage, check their passports, schedule their flights and staff and maintain the airports. Not forgetting the people who work tirelessly to make sure that traffic in the skies flows smoothly, and all of the millions of people working in aviation worldwide need to do so to the same high standards.
Aviation has a large attack surface
From a security perspective, aviation has an incredibly large attack surface. But it also has one of the most robust security postures that civilians will ever encounter. Try sneaking into duty-free without going through passport control if you want to experience just how robust that security is.
The world has moved on to become a digital-first place, with every industry you can think of having undergone some kind of digital transformation in the last fifty or so years. Aviation is no different in terms of technological uptake and adoption, but it does have a somewhat unique aspect to it that broadens the attack surface: the adoption of consumer technology.
It’s been five years since the Magecart supply chain attacks that resulted in the theft of payment card data from an estimated 380,000 British Airways (BA) customers. Attackers compromised a BA network account issued to an employee of cargo-handling firm Swissport before planting card-skimming malware on the airline’s payments page.
There are still many systems in use in modern aviation that are based on closed-source, proprietary and often highly regulated pieces of technology. You can’t just call up Honeywell Aerospace, dial ‘1’ for sales, ask for a couple of Primus II radios and insist on paying by credit card. They will want to know who you are and what airline you’re calling from.
You can hop on to your favourite electronics wholesaler’s website, buy a TP-Link TL-WN722N USB WiFi adapter, sit in one of the coffee shops at your nearest airport for convenience and start snooping around the wireless networks in range. Especially if they’re called something like “AIRPORT_STAFF” or anything else that might pique your interest.
But things like WiFi are only the start of the aviation attack surface conundrum. Embedded and specialised systems might also be based on variations of commercially available, off-the-shelf systems. Consider things like digital advertising boards.
You don’t need to be a cybersecurity expert to figure out that many of these systems run versions of Microsoft Windows, especially if they’ve just received a flawed update and are now lamenting a critical error they’ve just encountered as the dreaded white text on a blue screen.
Whilst these might be very cut-down, very specialised versions of Windows, they are still Windows, which means that, from an attacker’s perspective, there is a lot that you already know about the system and how it likely networks with other similar devices.
This creates a unique situation from a security testing perspective because we now have effectively two domains of security to consider: one in which the attacker knows very little about the target systems, supply chains and technologies, and one where the attacker knows a good deal more about those systems.
There are many examples where there’s overlap between those domains, such as a supplier that specialises in modifying existing operating systems for use in aviation, or a hardware manufacturer that uses a mixture of proprietary and commercially available hardware for their products.
Either way, the business case for running penetration tests against these systems is clear: you can gain actionable insights into how and where your risks lie, as well as how they might be compounded across systems to create new vulnerabilities.
The Benefits of Penetration Testing in Aviation
There are several clear benefits to engaging in pen testing in the aviation industry:
Test your security against real-world attack scenarios
Tabletop cyber incident response exercises can only take you so far when it comes to understanding how your security stands up against the tactics, techniques and procedures of cybercriminals.
The attack surfaces and potential kill chains in aviation scenarios are vast and complex, with near limitless possibilities for pivoting through interconnected systems to gain deeper access to mission-critical systems.
Imagine an attacker who is able to use an exploit against a self-check-in kiosk whilst masquerading as a maintenance member. They’re able to leave a Remote Access Tool (RAT) within the housing of the kiosk, which is also connected to the mobile phone network via 5G.
They connect to the RAT at their leisure and, after some snooping around, they find a way to gain access to the Passenger Management System via a series of exploits. After exfiltrating all of the passenger information they can, they gain access to the Airline Operations System due to a single overlooked network segregation misconfiguration.
This kind of multi-stage attack scenario is easy to imagine and might be considered in a tabletop exercise, but that doesn’t guarantee that misconfigurations and risks don’t exist.
Maintain compliance with aviation regulations
As we explored above, the sheer number of separate organisations that need to come together to continue to make aviation an industry is huge. Not only that, but the effects when it goes wrong are often lethal, hence the need for strict regulations around the world.
Compliance with national and international regulations is often the difference between continuing to operate as a business and losing your entire client book to competitors.
In 2018, the U.S. legislated the Federal Aviation Authority Reauthorization Act and introduced the requirements for the FAA to create a capability to test the cybersecurity of aviation technologies before they enter the American airspace.
In the UK, the Civil Aviation Authority (CAA) created the ASSURE framework in order to give suppliers access to third-party organisations that can conduct cybersecurity audits. This scheme was created in collaboration with CREST and thus can be delivered by CREST-accredited professionals as well as IASME-accredited suppliers.
Manage your risks proactively
The attack landscape is constantly changing, and new vulnerabilities are being discovered and weaponised on a daily basis. The introduction and adoption of more technology only exacerbate these risks as the complexity in aviation systems increases.
Consider the proliferation of critical internet-connected devices and systems and systems that now use the ubiquitous 2.4 and 5GHz WiFi standards for secure communication, including critical aircraft ground connectivity systems.
An attacker creating an ‘evil twin’ wireless access point, a malicious access point that masquerades as a legitimate one, might be able to encourage some of these systems to authenticate with their malicious network instead of the legitimate one.
Likewise, packet injection attacks on improperly secured wireless networks can give determined attackers the ability to bypass wireless authentication altogether.
Pen testing these kinds of systems will allow you to identify and manage your risks and exposures in these areas proactively, enabling you to update and upgrade systems in a controlled, business-as-usual manner rather than an emergency, out-of-bounds fashion.
What is penetration testing?
A penetration test, or pen test, is a type of security test that involves a cybersecurity consultant assessing the strength of your security posture by emulating how real-world criminals would attack it.
This typically means finding and exploiting weaknesses in computer systems, whether they’re networks, websites, mobile apps or APIs. In aviation, it commonly extends to any other computer system that you own or operate.
Pen tests are easily one of the most direct ways to gauge the effectiveness of your security systems. They give you fast, detailed feedback on potential vulnerabilities and how those vulnerabilities can be exploited for greater gain. They also highlight how individual weaknesses can be chained together to form more potent threats collectively.
Pen testing is a form of what is known as ‘offensive security’, where organisations put their security directly to the test against well-trained experts or ‘ethical hackers’. By doing this, you get an insightful snapshot of how your security measures actually perform in real-world scenarios.
Penetration tests follow industry standard methodologies, and findings are collated by the consultants into written reports which detail and rank the vulnerabilities by severity, as well as offering advice on remediating the issues found.
In aviation, a pen test will likely be scoped to either internal network infrastructure, external network infrastructure, web applications, APIs, mobile applications or hardware. There are other types of pen tests that exist, but these are by far the most prevalent.
Often times multiple tests will be conducted in a multi-phase test, where consultants can work together to cross-reference their findings.
The Penetration Testing Process for Aviation Systems
In the highly regulated and safety-critical aviation and aerospace sectors, penetration testing follows the same general methodology as in other industries, but with a much sharper focus on risk mitigation, regulatory compliance, and operational continuity. Broadly speaking, there are seven stages to a pen test, but depending on who you ask, they might say as few as five. They are:
Pre-engagement and scoping a pen test
This is where the specifics of both the requirements and the extent to which the systems to be tested are decided. It is where things such as network IP ranges, specific devices and web addresses are communicated, as well as whether the test will be from an authenticated or unauthenticated perspective.
In aviation, pre-engagement and scoping are critical due to the diverse and complex nature of the systems involved, from flight planning platforms and avionics interfaces to airport operational systems, onboard Wi-Fi, and even third-party ground service integrations.
The results of scoping produce a statement of work which forms a binding document that authorises the pen testers to conduct their work within those parameters. Scoping must take into account safety-critical zones, air-gapped networks, and compliance requirements from regulatory bodies.
Reconnaissance
This is where the tester will gather information about the target systems in a passive way, finding information that is widely/publicly available.
In aviation, reconnaissance often focuses on open-source intelligence (OSINT) relating to air traffic control systems, public maintenance logs, exposed APIs, or even third-party supply chain exposures (such as MRO platforms or in-flight service portals).
This might include things like searching extensively on a search engine, crawling websites, searching for employee information on social media and doing virtual assessments of the physical infrastructure using publicly available map tools.
Scanning and enumeration
This is the stage where the tester starts to put together the map of the systems in scope, they’ll use things like network scanners or website crawlers to gather as much direct information from the target. In many cases, vulnerability scanners will be used to get an overview of the potential vulnerabilities in the system.
Enumerating aviation environments involves careful interaction with systems such as airport Wi-Fi portals, ground-based radar data feeds, or crew scheduling applications.
Exploitation and maintaining access
The tester will then use their knowledge of malicious practices to attempt to exploit the target systems. In aviation, attacks might target misconfigured remote access platforms used by engineers, weak authentication controls on cloud-hosted ticketing portals, or known CVEs within Iot-based baggage systems.
Access might be used to simulate a lateral move from, say, a supplier’s system into flight operations or maintenance records, a scenario that mimics real-world breaches seen in recent aviation incidents.
Testing might involve things like bypassing authentication, database injection attacks, software exploits or various attacks against domain controllers in networks. Once access is gained, they will maintain access, allowing them to easily return to the exploited state.
Post exploitation
Post-exploitation focus turns to escalating privileges and pivoting into other networks and systems, thus gaining further access to the whole system if possible. In aviation, this could mean escalating from a compromised vendor portal to flight manifest databases or internal comms platforms, illustrating the potential safety and reputational impact of an attacker gaining deeper access.
This stage of the engagement attempts to demonstrate just how far an exploit can be pushed and how deep into a system an attacker can gain access to.
Reporting
The tester then compiles a detailed report of the various vulnerabilities, including details about what was done and any screenshots and tool output where applicable. The report includes a ranking of the vulnerabilities and remediation advice so that high and critical severity vulnerabilities are remediated as soon as possible.
Given the sensitivity of aviation systems, reporting also takes care to highlight system availability and safety implications, even if exploitation was only partial.
Remediation and re-testing
The client will receive notification of critical and high vulnerabilities during the testing window, and may choose to remediate those there and then. In a regulated environment like aviation, remediation cycles are often closely monitored.
Retesting often coincides with scheduled downtime or maintenance windows to ensure fixes are robust and do not introduce new risks, particularly in systems that support scheduling, ticketing, or aircraft maintenance.
Oftentimes, remediation requires longer to implement, so critical and high severity vulnerabilities are generally re-tested for free within a given window, say 30 days.
How long does a pen test take?
Penetration tests can range massively in duration depending on the size and nature of the system being tested. A very small test might only require one day, but this is rare. The duration varies significantly depending on whether you’re testing a passenger-facing web app, airport perimeter networks, or a flight control simulation environment. Aviation environments often demand additional lead time for coordination, simulation environments, and safety reviews
Mobile application tests tend to span three days at a minimum for relatively simple applications, whilst internal network tests generally require four days at a minimum. These numbers increase in line with the size of the targets, but this is discussed in the pre-sales conversations
How often should penetration testing be conducted in aviation?
It is recommended and sometimes required for compliance that your computer systems be pen tested at least annually.
Most aviation organisations perform annual pen testing at the very least to comply with internal governance and external regulations. However, this might increase depending on how much your systems change over the course of the year. The cadence should increase under several conditions:
- After significant upgrades to onboard systems or passenger-facing apps
- When new third-party integrations are onboarded (e.g. baggage handling vendors)
- Post-incident response, to ensure that vulnerabilities were properly remediated
- Before major public events or peak travel seasons, to verify the resilience of critical systems
Conclusion: Ensuring robust cybersecurity in aviation through penetration testing
The aviation and aerospace sector remains one of the most complex and critical sectors in the world, with a wide range of interconnected systems and, of course, the responsibility to maintain the highest standards of safety and security for employees and passengers alike.
But with any technology, as it continues to evolve, so too does the threat landscape, and with it, the importance of proactive cybersecurity measures. With millions of people flying regularly, it’s imperative that systems remain robust, secure and operate smoothly.
Penetration testing plays a crucial role in ensuring that aviation systems remain resilient against cyber threats, identifying vulnerabilities before they can be exploited by malicious actors.
By engaging in regular pen tests, aviation organisations can safeguard their networks, systems, and the safety of their passengers, ensuring compliance with regulatory standards while mitigating potential risks that could lead to catastrophic consequences.
Whether testing air traffic control systems, in-flight networks, or ground operations, penetration testing allows organisations to stay ahead of threats, identify weaknesses, and maintain operational integrity.
In the world of aviation, where security is paramount and even the smallest vulnerability could have far-reaching consequences, penetration testing isn’t just a best practice; it’s a necessity.
Need an expert CREST-accredited penetration testing partner for your aviation organisation?
We can help. At Evalian, we put emphasis on ensuring your scoping documents are clear and understood fully, prior to carrying out your penetration test. If you would like to understand more about our pen testing services or discuss security issues that relate to your aviation or aerospace organisation, please contact our friendly team.
Client success:
Farnborough Airport has been working with Evalian since November 2023, in which time the service provided has proven to be extremely supportive and professional in the following ways:
- Always clear about the services that they offer, their remit and signpost options where requests are out of their services or remit,
- Clients’ priorities and requirements consistently met through scheduled catchups with account manager,
- Confidence in the expertise of the Evalian team, in particular of the lead Principal Data Protection Consultant (Data Protection Officer ‘DPO’).
We’d like to thank Evalian for their support, expertise, integrity and for making it a pleasant overall working relationship.
