Airside and Groundside Systems and Infrastructure

When examining airline systems, we typically categorise them into two distinct areas: airside and groundside. Airside systems, which support flight operations through maintenance tracking, electronic flight bags and flight planning, are subject to stricter regulation and tend to significantly impact business interruption losses. Landside systems, encompassing passenger loyalty programmes, booking systems and customer interactions, typically manage vast quantities of personal data, making them particularly vulnerable to legal and financial losses in the event of a breach.

The challenges

A unique challenge in the aviation sector is the operation of systems across various environments, including internal networks and hosted networks outside of the organisation's direct control, such as those in airports. This shared infrastructure creates additional complexity in implementing robust defence mechanisms.

One of our most significant findings has been the widespread use of common systems across multiple clients, including platforms like SABRE and AMOS. This standardisation creates substantial systemic cyber risk within the aviation sector, a concern that has caught the attention of both reinsurers and insurers. Organisations must carefully manage these risks by thoroughly understanding their exposure through vendor contracts and implementing appropriate risk transfer mechanisms.

The industry is currently experiencing a significant transition to cloud infrastructure, introducing new risk exposures during the migration period. Protection of legacy infrastructure that's likely to be superseded often receives reduced attention during these complex transitions, creating potential vulnerabilities.

Aviation organisations frequently grapple with legacy infrastructure and systems that present unique challenges for protection and patching. Our assessments have consistently identified struggles with access and account management, including the implementation of multifactor authentication, identification of privileged accounts, and enhanced protection for accounts with elevated privileges.

Security monitoring presents another significant challenge, particularly maintaining monitoring agents across diverse infrastructure. This becomes especially complex when dealing with legacy systems and organisations operating numerous interconnected systems.