Aerospace Village - Building Connections Across the Aviation Ecosystem
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Talley, Randy
Gejji, Sidd
Burke, Al
Ellis, Jen
Troy, Jeff
Craig, John
Noble, Katie
Across the Aviation Ecosystem, there is an increased effort to collaborate and coordinate to protect Information Technology (IT) and Operational Technology (OT) systems at airports, airlines, aviation management, and manufacturers and vendors via the supply chain. This diverse panel will share their insights and current activities between government, industry, and the security research community. Learn how you can participate in and ensure the safety and security of the Aviation Ecosystem
 Hello, and welcome to the Aerospace Village panel discussion on building communications across the aviation ecosystem. Hi, let me introduce myself. My name is Katie Trimble-Nobel, and I'm the director of Product Security Incident Response and Bug Bounty at Intel. So I run the Bug Bounty program as well as research or outreach and engagement. And I've been with really in the ecosystem for many, many years. Prior to coming over to Intel, I worked for the Department of Homeland Security, where I was the section chief for vulnerability management coordination. So I've been doing this for several years. Throughout my career, I've coordinated and disclosed over 20,000 cybersecurity vulnerabilities. So I really want to jump in right now. We don't have a lot of time today, and I want to go ahead and introduce our panel. So we're going to ask everybody to go through and introduce themselves. So Randy, can we start with you? Yeah, hi. I'm Randy Talley. I'm a senior advisor with the DHS's Cybersecurity and Infrastructure Security Agency. I've been working in aviation for quite a while as a pilot doing aviation security for the DHS and I've been on the, excuse me, the tri-chair, the DHS tri-chair for the aviation cyber initiative for the last two and a half years. Awesome. Sid? Hi, everyone. My name is Sid Gadji. I work at FAA. I'm a manager within the Office of Information Security and Privacy. I've been with the agency about 14 years and in a variety of different roles. And I serve as the tri-chair for the FAA on the aviation cyber initiative for the past two and a half years as well. I am glad to be here. It's my first year at DEFCON. Lots of people in the room, you know, virtually and I look forward to learning from you all. So glad to be here. Yeah, thanks. Welcome, Sid. Welcome to DEFCON. I hope this experience is awesome for you. You get a little bit of a different flavor this year. So John? Hi, my name is John Craig. I'm the chief engineer of Cabin Network and Security Systems at the Boeing Company. I've been there for around 34 years. I've worked in all sorts of systems groups on commercial airplanes and my current role has been working all the cabin systems, the networks on the airplane. I work with the development of the connectivity links and I'm responsible for products security for commercial airplanes. I'm also the chairman of the Aviation ISAC and I really like to encourage people to look up that organization. It provides a great sharing of opportunity in aviation. Thanks. Yeah, welcome. Jen? Hi, I'm Jen Ellis. I'm the VP of Community and Public Affairs at Reppert 7 and I am probably the least of the aviation experts on this panel. When I say probably, I mean definitely. But I represent the voice of I think the security research community and my job is to think about how do you leverage security research and insight and expertise to create social change that makes a more secure, safer world. Awesome. Awesome. Jeff? Hi, I'm Jeff Troy. I'm the president of the Aviation ISAC. I've been in that role for about three and a half years. I also work for General Electric. I'm on the staff of the CISO in General Electric Aviation. And I'm on the board of directors of the National Defense ISAC, so very engaged in the information sharing world. Prior to that, I was with the FBI for 25 years and left there in the cyber division, you know, working the cyber criminal and national security cases. Glad to be here. Thanks. Yeah, happy to have you. Allen? Hi, I'm Al Burke and I'm an associate deputy director in the Air Force's Cyber Space Operations and Warfighter Communications. And I'm also the Department of Defense chair for the Aviation Cyber Initiative. I come out of the Airspace and Missile Defense Operations community. And my primary focus in the ACI is on improving cybersecurity initiatives and resilience of derivative aviation capabilities where the DOD interagency and industry objectives intersect. Awesome. Awesome. I'm excited to hear more about that later. So now that we've all kind of introduced ourselves and we have good idea who we are and where we come from, you can see we have a just jam-packed panel full of awesome aviation cyber and researcher professionals here. So I'm really excited about it. Let's really just jump right in here. So today in this panel, we're going to talk a little bit about some current activities between government industry, security, the security community, the responsible disclosure community, some information sharing, and some improved collaboration and coordination across the aviation sector. So really jam-packed. I want to step back just a little bit and explain and go through just a little bit of the groundwork on what the Aviation Cyber Initiative is. And so, Randy, can you talk really briefly about what the Aviation Cyber Initiative is in the tri-chair? You're good. You'd love to. Aviation Cyber Initiative actually started probably around the five years ago, the 2016 timeframe. It was originally focused on aircraft only. There was some testing that our DHS, S&T folks were doing and was of interest to everyone. And we've taken that and a lot of things has happened since that initial surge or testing, if you will. The National Strategy for Aviation Security was published by the White House about a year and a half ago. We're getting close to two years ago. And it specifically was an update. The NSAS needed to be updated. It was dated back in 2016. It was old and it didn't include anything about cybersecurity, nor did it include anything about UAS. So that was a big upgrade, if you will, for the NSAS. It also defined the aviation ecosystem, which really helped us out and kind of defines the swim lanes, if you will, for aviation security. So those six swim lanes, as defined, include the aircraft, obviously, but also talks about airports, talks about airlines, airlift, airlift being the cargo derivative or equivalent of the airlines, talks about actors, which can mean anything from training to third-party vendors on the airport. It could be anything as to people. And it goes into aviation management, which is all the infrastructure necessary to run the aviation environment. So all of those things are our swim lanes. It's a little easier for us, the Aviation Cyber Initiative, to talk about this when you're talking about the various swim lanes as opposed to a big amorphous blob. So what is the ACI? Well, I talked a little bit about it initially. A year ago, we were chartered by the Secretary of Homeland Security, the Secretary of Defense, and the Secretary of Transportation to be a tri-chaired organization. So I have my DOD colleague, Al, and Sid, my FAA colleague. And we lead this effort across the whole of government to include industry and to include anybody that's really looking at aviation cybersecurity to pull them in and try to reduce air risks and increase their resiliency across aviation. So I'm very proud to participate in that. That gives you a little background. I don't want to get too much in depth in it, but I think that they should answer your question. Yeah, really good. Thank you. So I want to talk a little bit about a recent situation that I kind of really feel was a really good example of a watershed moment within the researcher aviation and public sector communities. So this happened about a year ago, and Gen, Rapid7, made a pretty, it's a pretty interesting disclosure on civil aviation last year. Can you walk us through that and kind of give us your perspective on the process? Yeah, sure. Absolutely. So we have a researcher, Patrick Keiley, who has done a transporation in the past. He has done a lot specifically with automotive. He's also a pilot, and he's building his plane as one, apparently. And so as part of his sort of, you know, passion and enthusiasm in this area, he was investigating various things. And he heard about a technology being used in small aircraft that is well known in the security community as being sort of quite trivial to exploit. So the technology is canvas. And he heard that it was being used as a way of sort of connecting avionics. And the avionics, you know, being the parts of the control of the plane, he was like, oh, that sounds quite dangerous. And he was well aware that a few years back there had been a lot of noise made around about canvas in automotive. And there had been very widespread discussion in the automotive industry. And as a result, many automotive organisations either moved away from using canvas or introduced additional mitigations and protections. He had not heard of such a discussion in the aviation space. And actually on talking to more people who work in aviation, he found that, you know, generally security people seem to believe it was an issue, but said that they were having trouble in having this be talked about at the right levels and get enough attention to really make a change. So he did some research on that. And our goal with the research from the beginning was never to sort of shame a particular vendor or embarrass a vendor. This wasn't a, we're going to take a specific vendor system and uncover new vulnerabilities. It's much more of an architectural issue and an unknown issue. So the goal was to look at a few different systems, verify that canvas was in fact being used and then talk about why that's an issue on a sort of strategic level and try and stimulate some discussion in the aviation community around it. As a result, and also because we were dealing with aviation and, you know, we recognise that aviation is a different space, you know, there is a sort of life and death element when you're talking about things to do with aviation. We were very cautious with how we approached it. Our typical disclosure process, which is documented and on the internet is normally a sort of 60 day process, sometimes a bit longer. This process took a year and a half. And the reason was two things. One, we very much did not want to cause hysteria, you know, as somebody who flies a lot. I know how easy it is to get spooked on this stuff. And I and the rest of the team were very keen not to have that be the case. So we wanted to be very thoughtful with the approach that we took and we wanted to be very balanced and as neutral as possible. And the second thing is that we really did want to try and stimulate this discussion. That was our goal. So we wanted to try and involve as many people to participate in that process as possible and really sort of like immerse the community as much as we could. It was a somewhat mixed process. You know, there's not there's not a lot of tried and true ways of doing this in aviation, even for an organization like Rapid Seven who have done a lot of vulnerability disclosure, a lot of vulnerability research over the years. Aviation, you know, is every sector is a little different and aviation is certainly also a little different. And what we found was that generally people, including many of the people on this call, were very, very generous with their time and their insight, their expertise. So we had a lot of people who are willing to talk to us, which was great because we were worried at the beginning that that wouldn't be the case. But we also found that there was a bit of a flavor in in the discussion that came across of, you know, people sort of pointing out that that we weren't aviation experts and that physical security would take care of this and that, you know, we weren't understanding how pilots work. Now here's the thing is certainly I'm not an aviation expert and I and I was very glad to have input and have expertise from people who really are immersed in this space. It was a great learning for me. But in general, I think anybody who works in cybersecurity is always going to be a little leery of any sector that really leans hard on physical security as a response to cybersecurity challenges. And while we were very aware, always very aware and acknowledged in the report that physical access was required to exploit this system, we're also very aware that these systems stay in place for a very long time and that motivated attackers will find ways, particularly when you're talking about smaller aircraft, which might not have quite the same degree of physical protection that, you know, sort of larger commercial aircraft might. So that there was a little bit of that, and then I think I think Patrick probably felt a little bit affronted every time he got told that he didn't know how pilots worked since he may not be a commercial pilot, but you know, he has flown planes. So it was good to get the feedback. We were super grateful to have to have the ears and to have the feedback. And we certainly wanted to challenge our own insolence. But what we did learn through the way is that, yes, it's always, I think with any coordinated vulnerability disclosure, and we are big advocates for coordinated vulnerability disclosure, it is critical and key to build empathy, empathy to listen actively, to take on board feedback and to challenge your own assumptions and to try and build trust. Like I think above all, trust is where you want to get to. But you also have to know when to hold the line on your, like, yes, challenge your own assumptions, but hold your line once you've done that and you've verified that your findings are as you think they are. So it was a good learning process for us. And I think in the end, the disclosure went well, one thing just before I wrap that I'll say is I think part of the reason the disclosure went so well was because of the role that DHS CISA played. I think that having the vulnerability management center part of the CISA, which Katie was kind of running out of time, having you guys independently verify the research findings and then decide that it was a significant enough issue to put out your own alert to coincide with our report. That to me was a pretty big deal. It was actually kind of a game changer, I think. I can't say whether we were about to pressure if that had not been the case, but I'm certainly very grateful that we didn't have to make that choice. So thank you. And thank you to everyone else on the call who helped educate us along the way and gave us their time and their feedback. Yeah, it's definitely a complicated situation. I think a lot of times it's difficult when you think about every sector is different and your ICS systems, your embedded systems, your safety systems, they're very complex. And doing that coordination up and down the hardware stack is a little different than you would necessarily see in say a digital services sort of platform or in a general typical traditional software platform. So it's definitely learning, I think, for everyone and there are some ups and downs in that. And I think that when you look at it, you have to take it for, we're going to look at climate versus weather. If we look at one each individual disclosure, it's pretty tough, but in the end, we learned a lot. So, Randy, can you talk a little bit about the DHS got involved in this disclosure? Can you talk a little bit about how DHS got involved in the disclosure and what role DHS took? Sure. Yeah, we have the Vulnerability Disclosure Program that DHS runs. Every group of folks, as a matter of fact, I think J. Angus is going to have a panel at the Aerospace Village on Vulnerability Disclosure. So I invite you to go and listen to that. Great folks, they approach me, great folks, including you, Katie, approach me and said, hey, I've got an aviation thing. I need to get it to you and I need you to understand and we need to know kind of where we go from here. So I was able to get the briefing from Rapid7, actually got to read their final draft report, if you will. And you have to realize that aviation is a big thing. So I've got a big background in aviation, but the CAN bus, where it's installed, different aircraft vendors, it's a huge thing to try to go, oh yeah, I got this. So how important is it? It did require physical access, so I can stand down a little bit from that. I think everybody understood that. But how does it affect commercial aviation? How does it affect small aircraft or the general aviation folks? So I said, look, we need to get it to two places. We need to get to the FAA, they're the regulator, they should be aware of this, because they need to make a risk assessment if it's a big thing. We also need to get the aviation ISAC. Aviation ISAC has their members that can quickly get it out to aircraft manufacturers and actually the folks who are building systems and determine, hey, what can I do with this or what should I be doing with this in the future? I think this was the first time since the ACIs have been stood up that we've had a vulnerability disclosure come to me. It's not the last time, but it was the first time. It was handled very well, I think by Rapid 7. I think they understood going in. The physical access aspect was a big deal, the acknowledgement of that. It wasn't the skies falling. It was, hey, this is an issue and we need to address it. And I love that part of it. I know our VDP folks, the vulnerability disclosure folks, were very interested in, hey, look, we need to send out an advisory. It's going to mirror what we did on the cars years ago. And it's also going to say, hey, it does require physical access. So then once again, not the skies falling, we found a vulnerability. But this is something you should be aware of when you're architecting a system. So it was very good for me. I enjoyed getting involved in it to this level. And then the focus for that vulnerability disclosure is, can we get, how do we approach a mitigation? If we found a vulnerability, how do we approach a mitigation? How do we close that down and make the system more safe and secure? And I think we achieved that in this particular case. Great. Yeah, it's, we go back to that physical security. And I think overwhelmingly, one of the big things that was very different from, say, this disclosure to a disclosure that we might see somewhere else is that this is more of an architecture, it depicts a lot of different things versus, say, one particular product and one particular version. And so just the impact was very awe-inspiring. I mean, we didn't know where things were. So we really had to rely on the subject-better experts. And we really had to bring in a lot of different people to ask and find out. And so, Sid, can you really quickly tell us about your work and how you were brought in and talked to some of your colleagues at the FAA and the safety that was involved in that? Yeah, sure. So Randy kind of brought this up last year. And I think I agree with you, Katie. I think it was a watershed moment. It's a good way to describe it. We had a researcher that came forward with a vulnerability. Rapid7 came to us and they said, hey, look, this is important. This is an issue. And so it really helped kind of spur a set of conversations within the FAA, both from our ABS, which is this aviation safety organization within the agency. The CISO was on the call. And it helped us, I think, really connect different offices. And so granted, it's a physical security issue. And I believe the other thing that happened also was TSA was notified. That's the agency that's responsible for all of aviation security in the US. So it really helped us connect with different stakeholders and really laid the groundwork for a process. There's going to be a lot of back and forth in such situations between the safety engineers, the regulators, the researchers. And that's really, in my mind, very good. And it's healthy. We want to spur those types of conversations. Everybody's not going to agree on what exactly how big the risk is. And so it can get a little difficult to come to get to the same page. But I think having those conversations is really important. And I think this event helped us do that. So thanks to Rapid7, thanks to DHS and the ISAC for taking the lead on this. Yeah. Yeah. So that actually leads us right into, Jeff, can you talk about the ISAC and the ISAC information sharing? And so if you really want to affect change, you need to get the information out there. You need to make sure that people understand. So can you talk to us about your involvement in this? Thanks, Katie. And so first off, we were just really highly appreciative of Rapid7's approach to this and allowing us to be invited in. Similarly to Randy and the rest of the folks at the Aviation Cyber Initiative for being so inclusive and us kind of get this information and be able to pass it out to the members. So like has been mentioned earlier, the Aviation ISAC's role in these security disclosures is really a connector. And Jen highlighted how important it is for communication to be happening during these events. And typically when they start, it's really hard for a researcher to find the right person in the industry. We also mentioned here, though, that this was a little different. This is a technology that's broadly used across the industry, and it's actually something a lot of other folks plug into. Many times when a researcher has a particular disclosure they want to make, it's about one type of product. There's one vulnerability in some design of a specific component. When researchers want to get a hold of that company, frequently they're calling us because if you want to get a hold of somebody in the industry, it's a lot harder nowadays actually to find the right person. And we just happen to have them all connected in our community. But this one was different, and it was a great learning experience for us all because it was a little bit of a shorter window on the industrial side. But as we look back at the event, it really made a lot of sense because there wasn't somebody that was one particular company to take a look at this. This was more of everybody saying, hey, wait a minute, we're all plugging into this. We really need to take a look at this as a larger issue and as a systems issue. In the end, we did, and it's been mentioned as well, there was a physical security component. That is one component. But in the whole concept of layered security, physical security is just one layer. And when you find that there is an issue inside of any layer, the objective in a really good layered concept is to harden that layer. And this was a really good example of that. It doesn't matter if it's embedded in a lower layer. Let's get every layer as hard as it can possibly be and make it difficult for anyone to make that complete penetration. So I would agree with everyone. I think this was a really good example of how to do it right. And I think what was really impressive for us too, as the trust gets built across the engagement between the researchers and the industry, was really good to see what Jen talked about was the perspective right from the start, hey, we don't want to get people overly excited or hysterical about something. We really need to understand in the whole equation of risk, how big of a risk is this and how does that risk get managed? And their approach that they took, that cautious approach of really trying to get that understanding and validation was really critical to the successful outcome. Awesome. So I think this is a great opportunity and it was a great example of pieces that didn't ever typically work together and who were new to each other and maybe didn't even know that the other existed and were able to really pull together. And there were some ups and downs. And in the end, Rapid7 put out their vulnerability information. DHS put out a complimentary security advisory. And I think it sort of laid the groundwork. So now that we kind of talked about that, I really want to pivot to the current. So there are some really awesome progress being made in the aviation and researcher communities. And it's hard to even pull a couple of topics. When I sat down to kind of go through and say, what can we talk about here? It was, there were just so many topics out there. The community is moving so rapidly. And I think even the aviation village itself is something that 10 years ago, we wouldn't have even thought of. We could pull together and do that. And so there's so many wonderful things. John, Boeing is getting involved in some really awesome community outreach and community engagement. Can you talk a little bit about the tech council? Yeah. I'll start off with, you know, aviation is a unique space and we have a very strong safety culture. We have a unique development process. And, you know, to some extent, I think we view ourselves as being special. And you know, Jen kind of mentioned earlier that when people come from outside that community, the natural antibodies kick in and we find reasons to kind of discount the feedback. I've been working in this space for 10 to 15 years and, you know, reality kind of kicked in on me when the Stuxnet virus was disclosed. And it broke all my, you know, stereotypes of aviation and how we're unique. You know, and oftentimes I feel like an evangelist out trying to spread the good word. Well, last year was a significant milestone and I'd say turning point for Boeing. A researcher got a hold of some of our executable code, reversed engineered it and disclosed things that were actually quite surprising. I think we were surprised with the tools that allowed them to actually go in and, you know, kind of view the code in, you know, in a space where we didn't think was really possible. We actually spent a lot of time several months analyzing the code. We were in our lab. We have very extensive labs that replicate the airplane quite accurately. At the end of it, we actually went out onto an airplane. We brought all the systems engineers out to view it. We went through a bunch of scenarios. Some of the claims, we actually went well beyond the claims. We did a pretty thorough test on a 787. And at the end of that, our response, you know, not knowing, you know, it wasn't the real intent, but I think it was viewed as hostile. And I got that feedback from several folks, you know, in the aerospace village. And so after our analysis disclosure, we held a meeting with a lot of key stakeholders. A lot of the airlines had a lot of questions for us. You know, what do you think of this? Is it real? You know, we gave our synopsis. A lot of the government folks and Katie, you were in one of the meetings with us. We had a spirited discussion with lots of different government people, as you remember. And in that meeting, Katie kind of said, you know, John, you really need to reach out to these folks and I can help you if you'd like. So we took that, we went internal to Boeing and we had some spirited discussions because this is really uncomfortable, you know, changing how we've operated for a long time is not the easiest thing. But at the end of the day, we said, you know what, we need to do this because these people are looking at our designs. They're not, you know, I don't think there's any ill will, but we need to embrace them and we need to learn from them. So we set up this tech council and we had several meetings trying to level set a little bit. It's a little hard via the phone. And so after the RSA conference in San Francisco in February, we invited them all back to Boeing. And at Boeing, we kind of went over some of our design methodologies and, you know, met face to face. And that's a real, that's real powerful to get to know people at a much more personal level. We took them into our labs, showed them what we're capable of. We even arranged time on a 787 simulator. In fact, one of the gentlemen was a military pilot and we set up kind of a difficult landing form by winds and, you know, low light conditions, etc. He made it down good, which was positive. But I think it went a long way to mending the adversary relationship. So as part of that, we have part of this team. They have a, some folks have a claim they'd like to investigate with us and we're in the process of bringing them into Boeing into our lab to kind of evaluate that when, you know, the COVID hit and that kind of slowed us down a little bit. But, you know, I really want to embrace this and I want to expand it. And, you know, at DEF CON, we actually plan on bringing, you know, real hardware, setting up some kind of capture the flag event to kind of embrace this community much more. Another aspect of this, we actually matured our vulnerability disclosure process. It is now very easy to find on the Boeing website, at least I hope it is for folks I was able to find it. And you can send your vulnerabilities encrypted. We provide that means. And we're starting to receive a lot of stuff in. And a lot of things that come in are shared between all the stakeholders and as the product guy for the airplane, we see all of it. And we actually evaluated surprising vulnerabilities that are in the IT space. A lot of these systems are used in some form in aerospace. And so we have to evaluate all those and see if we have the same issue that maybe the original claim came in with. So I'll just close, you know, saying we're still crawling here. I'm really hoping to get more engaged. You know, I think it's critical that we interject this into our designs. It's a different view and, you know, it's always powerful to get diverse opinions and diverse perspectives and those outside of aviation probably are more powerful at looking at our designs than we may be. So thanks. Yeah, awesome. I know I remember sitting in some of those meetings and I remember thinking to myself, why don't we all just talk? You know, why can't we just, why don't we all just talk? And I can imagine that there were some people in that room who thought that I was just that crazy lady from Homeland Security with these wild dreams of working together. But I'm hopeful that we're going to see more of that and that that has actually worked out really well. So yeah, you know, we're still in steps here and I would like to, you know, commend Boeing because Boeing did all the hard work on that. You know, the hardest part is getting going and taking all of the steps that needed to happen in order to bring people in and really get down into the labs and get into the weeds and that that's that takes a lot, a lot of effort. And so, you know, I commend Boeing for that. So Sid, can you talk a little bit about the FAA structure and the work with the tri-chair and some of the things that you've been working with? Yeah, sure. Thanks, Katie. I agree with everything that has been said on this great panel. I think let me let me make a few points. You know, we kind of oversee and regulate civil aviation. So we have a unique role. We are the premier aviation agency in the US. We have authority over all the aircraft that fly in the US and all the airmen, all the pilots, we certify them, we certify all the aircraft. And we also conduct air traffic control. All the airplanes that take off and land are controlled by the FAA. So it's a pretty big role. It's a pretty big responsibility. I think safety is our focus and we are a safety agency. And so the way I see it is that cybersecurity is part of our safety responsibility. And I run into that all the time as a tri-chair for the ACI. You know, it's really a big task is culture change. We are trying to bring that culture of security and looking at how to improve the security of the whole ecosystem into an agency that's focused primarily on safety. So in terms of vulnerability disclosure, we don't have like a formal program. We don't have like a way that you all, the researchers can come forward and directly to us, we rely on DHS, which is our partner through the ACI. But that does not mean that we are not open to all of your ideas. I think the fact that I'm here on a panel, you know, I'd love to hear from you all. And we'd love to have that dialogue about what the risk is and what some of the vulnerabilities are. So I want to echo what has been said earlier. I think trust building is incredibly important. We all should come together and like Katie said, we need to be talking all the time and exchanging notes and exchanging ideas. Let me share a quick story. About two years ago, I was at the Pentagon and DOD has this team called Gen 5. That's basically a bunch of very smart people just like you all that were looking at some of the vulnerabilities within ADSP, which is our system for surveillance based air traffic control, it's satellite based, I'm sorry, air traffic control. We are moving away from radar into satellite based GPS radar control. And so they had worked on this project for about a year to look at some of the vulnerabilities within ADSP, which is a huge investment for the FAA and for the American public. And I was with the CISO at the time and some other executives from FAA and we just thought it was fantastic. I mean, to invite these researchers into the Pentagon and have them test an aviation system and hear some of their ideas. They actually came out with a report, which was super insightful. And we took it all the way to the National Security Council. And that has formed a basis for a lot of the follow on work that's going on within ACI for ADSP. So, you know, I told my boss, this is something we need at FAA too. We need a team like this to come in and test our systems and bring a completely different perspective than what the agency is used to. So that coming together of the researchers, of the research community, of the safety folks, you know, of the air traffic controllers and the IT people, all that has to happen because it's really about bringing all those disciplines together to tackle which is what is a very difficult sort of problem. I mean, we are looking at risks across the ecosystem. And so that conversation needs to happen between the different disciplines. I just did an online cyber course through Harvard a month or so ago. I finished it. It was like an eight week class. Let me just share a couple of things. Every organization, including aviation, has operational risks, reputational risks and legal risks when it comes to cybersecurity. So a cyber breach can cause huge damage. It can cause a loss of $1 in terms of your operations, in terms of your reputation. Something to think about. Second is that we need a culture within cybersecurity where we reward people for being skeptical. You know, you don't want to just kind of reward people who are sort of agreeing with what's going on. You want people to look skeptically at what's going on and tell you a different way to do things. You want people who want to break things because that can lead to a more cyber secure posture. And a lot of the challenge that we face today as organizations has to do with information sharing has to do with culture change and trust building. And so those are the tasks that we are all involved with. So information sharing should be happening all the time. And that's what the ACI is designed to do within the government between our three big departments and with industry. I want to, the last thing I want to say is also the fact that the aviation ecosystem faces a lot of state and non-state cyber threats. The threats are very real. There are known vulnerabilities within this ecosystem. We all recognize that. So that can impact the operations within the national airspace and civil flights. And the fact is we got to tackle those threats and risks together. And so the FAA issues cyber situation reports today which are, you know, which address specific equities across this ecosystem. And some of those are externally tailored to partners outside of FAA. So those include, you know, other federal agencies and industry partners. And that's what I have. So thanks, Katie. Yeah, awesome. It's really exciting to kind of hear some of the things that get passed around and just really are exciting initiatives. The Pentagon has, I know, been deeply involved in aviation for, you know, I was in the Air Force so, you know, since forever. And so it's really great to see these very, very established organizations get excited about working with research and breaking things. That just makes my day. So these are really awesome initiatives and I'm really excited about them. I want to move to the future for a little while. We kind of talked about the past and we talked about the current. And then I want to kind of talk about the future really quick. And so I think the DOD's got kind of a really fun new initiative that I'd love to hear more about and I think it's called the in-factor. So Al, can you talk to us about the in-factor? Hey, sure, Katie. Hey, just as a little background before we dive right into the in-factor. So we talked a lot about identifying and sharing cyber vulnerabilities, sharing information. But going forward, the future is that we need to work together to close those vulnerabilities using a threat-informed risk-based approach. And that points us to two trends the aviation ecosystem must address. You know, like Sid said, the first trend is the cyber threat to aviation is real and growing. So it's highly likely that advanced nefarious cyber actors to include adversary nation states will use cyberspace to steal our aviation intellectual property and to conduct cyber operations to damage the reputation of U.S. and allied aircraft and aviation industries to gain a competitive advantages for their own industries. And so from a national security perspective, improving the cybersecurity and resilience of our own nation's aviation ecosystem to counter this threat is key. And for the Department of Defense, we have to be able to project power, defend the homeland, and protecting critical aviation infrastructure is part of that. But there's one thing we acknowledge. This challenge is not something the Department of Defense or the government can do on its own. So recognizing these two trends, recognizing that trend, you know, requires an increase in a public and private sector collaboration or a whole-of-nation approach. I don't know if you're aware, but Congress recently chartered the cyberspace-celerium commission. And in this commission report, it identified the need to increase public and private sector collaboration. And the goal is to improve our speed and agility in addressing cybersecurity and resilience threats. And so the end factor that you referred to, which stands for the National Federation of Aviation Cyber Test Organizations and Researchers, the end factor, is a great example of how the Aviation Cyber Initiative is pushing to work on this. And so the thing that the Aviation Cyber Initiative does is, you know, we bring together that whole-of-nation approach, bring together the cyber experts from federal agencies, state agencies, industry, our federally funded research and development centers, our university-affiliated research centers, our national labs, all working together in the end factor to achieve three lines of effort. And those lines of effort are, one, is to catalog, collaborate, and connect. And so, you know, just at a top level, we talk about catalog, our big push is to create a national-level Aviation Cyber Resource Guide. And the goal of this resource guide is to be an online, accessible, and searchable database of Aviation Cyber Research, Development, Test, and Evaluation resources, expertise, facilities, and capabilities. And so if you're part of the end factor and you're working on initiative to counter, to look at cyberfuzzing or any of these other kind of cyber trends, you could go to the resource guide and it'll give you a list of who's working in that space, what kind of capabilities they have to test, and what, and more importantly, how you can get to hold, get a hold of them to further collaborate. And so the collaborations are second line of effort. You know, the goal of the collaboration is to create a persistent collaboration forum where these cyber experts, this whole nation approach, can get together and be able to spotlight or showcase capabilities, share information on projects. And more importantly, if a, like let's say for example, you're working a project on intrusion detection, cyber anomaly and intrusion detection, you can come to the end factor and present your project and give us asks. And the ask, the goal for the ask is that the end factor try to close those gaps. And when we talk about closing those gaps, we call that a connect. And that's the third line of effort, to connect projects, efforts, research papers with resources to do things like test, validate, and move forward projects. And just a couple of examples, you know, on the collaboration side, Johns Hopkins APL did a presentation on how they were doing cyber modeling on various aircraft. And the aircraft they were doing the modeling on, it so happened, since John Craig was on, they were Boeing aircraft. And so, you know, after the meeting, John and his team got together said, hey, we probably need to know more about this modeling effort. And oh, by the way, maybe we can work with Johns Hopkins to make it better. And so right now, that's what we call a connect. We're working to bring those Johns Hopkins APL and Boeing together to talk about how they can enhance that cyber modeling. And then on the resource sharing side, we had a project come forward that was working on a cyber anomaly and intrusion detection capability was AI machine learning based. And they needed a data tab to pull data from 1553 bus. They didn't have it. And they also needed large quantities of data to support, you know, training a machine learning and AI capable tool. And so we connected them with the Air Force Search Lab and provided a tool called Vampire, which is a aviation bus tap and ship that to them. And then Johns Hopkins APL again came through and they've been working on the data sharing effort that's been fantastic in terms of connecting. So those are the kind of things that the end factor is trying to do. We're trying to do it at scale. And so that leads us to the, I'm sure people are saying, so how do you participate? In the end factor? Well, we got a couple, a couple of asks, you know, first off, we're focused right now on US organizations. So if you want to be a part of the end factor, what we ask you to do is three things. First, we want you to one, agree to populate our aviation cyber resource guide with your company's capabilities and resources. So that's one. The second one is we want you to participate in our tight 90 minute monthly forum. It's the end factor collaboration forum. And our goal is to be able to showcase all our major participants as we go forward. And to participate and follow on meetings, you know, should those connects happen. And the third one is that is the connect part that if you have capacity and if you have resources, we would like for you to help connect others to serve as a mechanism to accelerate our cyber innovation and the aviation ecosystem. And so that's the kind of the three asks. I tell you, just yesterday, we had nearly 100 participants from across more than 60 organizations participate in the end factor forum. Our FAA tech center and DOD guys are working to deliver the aviation cyber resource guide by the end of August, at least the first instantiation of it. It's based on the FAA's technical capabilities library. And I would say, you know, in fact, it's growing. And I think it's exceeding many of our expectations. And what we want to do is get more people to work with us so we can do what I like to say collaborate with effect. And so that's that's an end factor going forward, working to address the threat and to increase our public and private sector cooperation across the aviation ecosystem. So let me ask you really quickly, is that is this initiative specific to military aviation or is it open to civil aviation as well? No, it's it's it's not limited to military aviation. In fact, it's not a DOD initiative. It's an aviation cyber initiative initiative. And so, you know, we have a charter to engage industry. And so we're we're working to do that in spades. And, you know, at least a couple of times a week, we're reaching out to bring our industry partners and really small businesses, you know, which we think the small business businesses are real powerhouses and innovation. And you know, when we can connect them with the larger big companies like the Raytheons and Boeing's of the world, then we can we believe that we'll be able to accelerate aviation cyber security capabilities. Awesome. Awesome. Awesome. So we have about eight minutes or so left. And so I really want to close up with some of our closing thoughts and some just kind of words of wisdom and things that we've learned from each one of the participants. So Randy, can we start with you some what are your what are your words of wisdom things to take away closing thoughts? Things to take away. Well, I tell you what, Katie, I'm super proud of what we're doing under ACI. I think it's I think I think it's time that we've we've reached out across the entire ecosystem and try to pull people together and have those conversations, address those those vulnerabilities. And I think, frankly, I think this is beginning to work. You know, working for DHS SZA, you know, I've got that outward look. I'm looking to industry. I can pick up the phone and call virtually anybody on this panel at any time. And if they're not in a meeting, which they always are, they'll answer the phone and we'll have a conversation. This is this is collaboration at its finest. And I got to say, you know, and I know we're limited on time, so I'll stop it here. I love my job, and these are the reasons why I love my job. The people on the panel, the things that we're trying to accomplish and what we're trying to do through ACI, I'm very proud of that. Yeah, it's wonderful. It's something that I think is really going to make a difference. And that's that's very exciting. I'm excited to be proud of it or to be part of it. Sid, what are your what are your thoughts? Well, I want to say that COVID-19 obviously has affected the aviation industry. It's transforming. It's going to transform how we travel. It's going to change so many things. And we're, you know, we're going through a change right now as an aviation industry. But that does not mean we ignore the cyber threats. The work we are doing here on this panel and the work I do through the ACI is incredibly important. The cyber threats are real from both state and non-state actors. It's a combination of physical security and cyber security and the information technology and operational technology, safety, security, all of that. And the ecosystem is a vast complex network. So there's a lot of vulnerabilities to it. A cyber breach can happen anytime. There are threats out there and an attack can cause millions of dollars of damage and a loss of reputation. So it can shake public confidence. It can change again the nature of flying. So we cannot ignore it. I think the work we are doing is super important and I'm privileged and I feel lucky to be part of this team of so many smart people who are doing such incredible work. So thank you for having me. You have my contact information, so I urge you all to reach out to me anytime. Awesome. John? So, you know, the last year has been interesting and we have got much more of a focus at Boeing on this. We do daily report outs to the board of directors. In fact, we have a champion on our board. We are leveraging our enterprise to not only help us with incident response, but helping to beef up our design guides. We have expanded our product CERT team and we are being much more proactive at looking at things. You know, and then we are looking at things across board. How do you create a process to evaluate threats and risks? And we are looking into that. We are actually working with, you know, industry and the government on, you know, how do we do that effectively? The key is we are really starting to engage outside of aerospace. I think that is going to be the thing that really helps us the most. The tech council is one, but participation at DEFCOM so we can build those relationships, RSA conferences, et cetera. So it is pretty exciting. It is really exciting right now and a little uncomfortable, but it is good. So thanks. Yeah. Embrace the uncomfort. Jen? Katie, I am honestly blown away. I think the whole purpose of the aerospace village is to increase understanding and appreciation of the importance of cybersecurity in aviation and to do so in a way that builds trust between the security community, the aviation industry and the government, which all play a very, very important role in advancing cybersecurity and aviation. And when I sit and I listen to my panelist talking about some of the amazing initiatives they have got going on and hear their attitudes and responses to the research and that kind of stuff, I feel like we are in such a dramatically different position to where we were a couple of years ago. And I hear people saying that they want to hear from the research community. They want to hear from the security community. They want to partner and collaborate. And that is an incredible opportunity. And I hope that anybody listening, particularly people who are participating in the search and research in some way, that they can love hope and optimism from this and feel that they can engage and that they can build trust. They can build empathy and they can get involved. Yeah. It's very exciting. I'm the trust and the relationships I think are some of the most important factors in all of this. It's getting involved. So yeah, getting involved. Jeff, information sharing, what have you got? What are your thoughts? Well, thanks a lot. I think this has been a great discussion. And we only went through one example. But at the Aviation ISAC, we've had several of these events happen over the last couple of years. And each one of them pretty much follows this pattern of building a great relationship with a security researcher, finding out what a vulnerability is that they've discovered and then going through that validation process of, you know, is it really an issue or isn't it an issue and then, you know, working through the remediations and disclosures when those have to happen. And, you know, likewise, we have found this to be incredibly eye-opening. And I mean, so much so with the researches we've even hired one, which helps us tremendously, particularly in the work that we're doing now. So I am glad that there's been kind of this breakthrough and that we're seeing, you know, the bridges being built and only think it's going to get better. Awesome. Al, what are your closing remarks, closing thoughts? Okay. Hey, Katie. So kind of echoing across the board, I think the most important thing is one is we have to recognize that the threat is real. And we should learn from the maritime sector's no-petch attack. We shouldn't have to wait until a serious cyber attack of our own on the aviation ecosystem occurs. And the key to preventing that is to embrace the idea that there's safety in the herd. You know, we need to strengthen the aviation herd, you know, by continuing to share information, vulnerabilities, and work together to address those vulnerabilities to improve our aviation cybersecurity and resilience. And so threats real and there's safety in the herd. Terribly true. Very true. So I guess my closing remarks then, I will say that the thing that I take away from all of these things is that I go back to the coordinated vulnerability disclosure and I say that coordinated vulnerability disclosure is an essential part of any security research. I think that everyone here and everyone that I've met from varying backgrounds all over the world, everyone has the same goal. We may not all speak the same language. We may all talk past each other. But I think ultimately we have the same goal and that goal is protecting the end user. It's reducing risk and making people safer. And so I think the last thing that anybody wants is to inadvertently put countless people's lives at risk, economic situation at risk, because we published a roadmap that if that fell into the wrong hands could just wreak havoc. So I go for coordinated vulnerability disclosure because it really is a balancing act. It's a process that allows us to mitigate while we're, or to balance while we're trying to mitigate. So that's my closing advice. I feel like all of the progress that we've made is so wonderful. We have a long way to go. I think that I love the fact that we're all talking to each other and we're working together. But I want to make sure we know that there is a road ahead of us. And that road to me, the future looks bright and I'm excited for it. So thank you guys for coming to the panel and listening to us. And if you have any questions, our contact information is up. I think there's going to be an opportunity for some live chat later at some point. So you'll be able to find out more information about that. If you have any questions or want to talk more to us, please feel free to reach out. I think everyone here would invite a conversation. So it was great talking to everybody today. Thank you.
 Hello, and welcome to the Aerospace Village panel discussion on building communications  across the aviation ecosystem.  Hi, let me introduce myself.  My name is Katie Trimble-Nobel, and I'm the director of Product Security Incident Response  and Bug Bounty at Intel.  So I run the Bug Bounty program as well as research or outreach and engagement.  And I've been with really in the ecosystem for many, many years.  Prior to coming over to Intel, I worked for the Department of Homeland Security, where  I was the section chief for vulnerability management coordination.  So I've been doing this for several years.  Throughout my career, I've coordinated and disclosed over 20,000 cybersecurity vulnerabilities.  So I really want to jump in right now.  We don't have a lot of time today, and I want to go ahead and introduce our panel.  So we're going to ask everybody to go through and introduce themselves.  So Randy, can we start with you?  Yeah, hi.  I'm Randy Talley.  I'm a senior advisor with the DHS's Cybersecurity and Infrastructure Security Agency.  I've been working in aviation for quite a while as a pilot doing aviation security for  the DHS and I've been on the, excuse me, the tri-chair, the DHS tri-chair for the aviation  cyber initiative for the last two and a half years.  Awesome.  Sid?  Hi, everyone.  My name is Sid Gadji.  I work at FAA.  I'm a manager within the Office of Information Security and Privacy.  I've been with the agency about 14 years and in a variety of different roles.  And I serve as the tri-chair for the FAA on the aviation cyber initiative for the past  two and a half years as well.  I am glad to be here.  It's my first year at DEFCON.  Lots of people in the room, you know, virtually and I look forward to learning from you all.  So glad to be here.  Yeah, thanks.  Welcome, Sid.  Welcome to DEFCON.  I hope this experience is awesome for you.  You get a little bit of a different flavor this year.  So John?  Hi, my name is John Craig.  I'm the chief engineer of Cabin Network and Security Systems at the Boeing Company.  I've been there for around 34 years.  I've worked in all sorts of systems groups on commercial airplanes and my current role  has been working all the cabin systems, the networks on the airplane.  I work with the development of the connectivity links and I'm responsible for products security  for commercial airplanes.  I'm also the chairman of the Aviation ISAC and I really like to encourage people to look  up that organization.  It provides a great sharing of opportunity in aviation.  Thanks.  Yeah, welcome.  Jen?  Hi, I'm Jen Ellis.  I'm the VP of Community and Public Affairs at Reppert 7 and I am probably the least of  the aviation experts on this panel.  When I say probably, I mean definitely.  But I represent the voice of I think the security research community and my job is to think  about how do you leverage security research and insight and expertise to create social  change that makes a more secure, safer world.  Awesome.  Awesome.  Jeff?  Hi, I'm Jeff Troy.  I'm the president of the Aviation ISAC.  I've been in that role for about three and a half years.  I also work for General Electric.  I'm on the staff of the CISO in General Electric Aviation.  And I'm on the board of directors of the National Defense ISAC, so very engaged in the information  sharing world.  Prior to that, I was with the FBI for 25 years and left there in the cyber division, you  know, working the cyber criminal and national security cases.  Glad to be here.  Thanks.  Yeah, happy to have you.  Allen?  Hi, I'm Al Burke and I'm an associate deputy director in the Air Force's Cyber Space  Operations and Warfighter Communications.  And I'm also the Department of Defense chair for the Aviation Cyber Initiative.  I come out of the Airspace and Missile Defense Operations community.  And my primary focus in the ACI is on improving cybersecurity initiatives and resilience of  derivative aviation capabilities where the DOD interagency and industry objectives intersect.  Awesome.  Awesome.  I'm excited to hear more about that later.  So now that we've all kind of introduced ourselves and we have good idea who we are  and where we come from, you can see we have a just jam-packed panel full of awesome aviation  cyber and researcher professionals here.  So I'm really excited about it.  Let's really just jump right in here.  So today in this panel, we're going to talk a little bit about some current activities  between government industry, security, the security community, the responsible disclosure  community, some information sharing, and some improved collaboration and coordination across  the aviation sector.  So really jam-packed.  I want to step back just a little bit and explain and go through just a little bit of  the groundwork on what the Aviation Cyber Initiative is.  And so, Randy, can you talk really briefly about what the Aviation Cyber Initiative is  in the tri-chair?  You're good.  You'd love to.  Aviation Cyber Initiative actually started probably around the five years ago, the 2016  timeframe.  It was originally focused on aircraft only.  There was some testing that our DHS, S&T folks were doing and was of interest to everyone.  And we've taken that and a lot of things has happened since that initial surge or testing,  if you will.  The National Strategy for Aviation Security was published by the White House about a year  and a half ago.  We're getting close to two years ago.  And it specifically was an update.  The NSAS needed to be updated.  It was dated back in 2016.  It was old and it didn't include anything about cybersecurity, nor did it include anything  about UAS.  So that was a big upgrade, if you will, for the NSAS.  It also defined the aviation ecosystem, which really helped us out and kind of defines the  swim lanes, if you will, for aviation security.  So those six swim lanes, as defined, include the aircraft, obviously, but also talks about  airports, talks about airlines, airlift, airlift being the cargo derivative or equivalent  of the airlines, talks about actors, which can mean anything from training to third-party  vendors on the airport.  It could be anything as to people.  And it goes into aviation management, which is all the infrastructure necessary to run  the aviation environment.  So all of those things are our swim lanes.  It's a little easier for us, the Aviation Cyber Initiative, to talk about this when you're  talking about the various swim lanes as opposed to a big amorphous blob.  So what is the ACI?  Well, I talked a little bit about it initially.  A year ago, we were chartered by the Secretary of Homeland Security, the Secretary of Defense,  and the Secretary of Transportation to be a tri-chaired organization.  So I have my DOD colleague, Al, and Sid, my FAA colleague.  And we lead this effort across the whole of government to include industry and to include  anybody that's really looking at aviation cybersecurity to pull them in and try to reduce  air risks and increase their resiliency across aviation.  So I'm very proud to participate in that.  That gives you a little background.  I don't want to get too much in depth in it, but I think that they should answer your  question.  Yeah, really good.  Thank you.  So I want to talk a little bit about a recent situation that I kind of really feel was a  really good example of a watershed moment within the researcher aviation and public  sector communities.  So this happened about a year ago, and Gen, Rapid7, made a pretty, it's a pretty interesting  disclosure on civil aviation last year.  Can you walk us through that and kind of give us your perspective on the process?  Yeah, sure.  Absolutely.  So we have a researcher, Patrick Keiley, who has done a transporation in the past.  He has done a lot specifically with automotive.  He's also a pilot, and he's building his plane as one, apparently.  And so as part of his sort of, you know, passion and enthusiasm in this area, he was investigating  various things.  And he heard about a technology being used in small aircraft that is well known in the  security community as being sort of quite trivial to exploit.  So the technology is canvas.  And he heard that it was being used as a way of sort of connecting avionics.  And the avionics, you know, being the parts of the control of the plane, he was like,  oh, that sounds quite dangerous.  And he was well aware that a few years back there had been a lot of noise made around  about canvas in automotive.  And there had been very widespread discussion in the automotive industry.  And as a result, many automotive organisations either moved away from using canvas or introduced  additional mitigations and protections.  He had not heard of such a discussion in the aviation space.  And actually on talking to more people who work in aviation, he found that, you know,  generally security people seem to believe it was an issue, but said that they were having  trouble in having this be talked about at the right levels and get enough attention  to really make a change.  So he did some research on that.  And our goal with the research from the beginning was never to sort of shame a particular vendor  or embarrass a vendor.  This wasn't a, we're going to take a specific vendor system and uncover new vulnerabilities.  It's much more of an architectural issue and an unknown issue.  So the goal was to look at a few different systems, verify that canvas was in fact being  used and then talk about why that's an issue on a sort of strategic level and try and stimulate  some discussion in the aviation community around it.  As a result, and also because we were dealing with aviation and, you know, we recognise  that aviation is a different space, you know, there is a sort of life and death element when  you're talking about things to do with aviation.  We were very cautious with how we approached it.  Our typical disclosure process, which is documented and on the internet is normally  a sort of 60 day process, sometimes a bit longer.  This process took a year and a half.  And the reason was two things.  One, we very much did not want to cause hysteria, you know, as somebody who flies a lot.  I know how easy it is to get spooked on this stuff.  And I and the rest of the team were very keen not to have that be the case.  So we wanted to be very thoughtful with the approach that we took and we wanted to be  very balanced and as neutral as possible.  And the second thing is that we really did want to try and stimulate this discussion.  That was our goal.  So we wanted to try and involve as many people to participate in that process as possible  and really sort of like immerse the community as much as we could.  It was a somewhat mixed process.  You know, there's not there's not a lot of tried and true ways of doing this in aviation,  even for an organization like Rapid Seven who have done a lot of vulnerability disclosure,  a lot of vulnerability research over the years.  Aviation, you know, is every sector is a little different and aviation is certainly also a  little different.  And what we found was that generally people, including many of the people on this call,  were very, very generous with their time and their insight, their expertise.  So we had a lot of people who are willing to talk to us, which was great because we  were worried at the beginning that that wouldn't be the case.  But we also found that there was a bit of a flavor in in the discussion that came across  of, you know, people sort of pointing out that that we weren't aviation experts and  that physical security would take care of this and that, you know, we weren't understanding  how pilots work.  Now here's the thing is certainly I'm not an aviation expert and I and I was very glad  to have input and have expertise from people who really are immersed in this space.  It was a great learning for me.  But in general, I think anybody who works in cybersecurity is always going to be a little  leery of any sector that really leans hard on physical security as a response to cybersecurity  challenges.  And while we were very aware, always very aware and acknowledged in the report that  physical access was required to exploit this system, we're also very aware that these systems  stay in place for a very long time and that motivated attackers will find ways, particularly  when you're talking about smaller aircraft, which might not have quite the same degree  of physical protection that, you know, sort of larger commercial aircraft might.  So that there was a little bit of that, and then I think I think Patrick probably felt  a little bit affronted every time he got told that he didn't know how pilots worked since  he may not be a commercial pilot, but you know, he has flown planes.  So it was good to get the feedback.  We were super grateful to have to have the ears and to have the feedback.  And we certainly wanted to challenge our own insolence.  But what we did learn through the way is that, yes, it's always, I think with any coordinated  vulnerability disclosure, and we are big advocates for coordinated vulnerability disclosure,  it is critical and key to build empathy, empathy to listen actively, to take on board  feedback and to challenge your own assumptions and to try and build trust.  Like I think above all, trust is where you want to get to.  But you also have to know when to hold the line on your, like, yes, challenge your own  assumptions, but hold your line once you've done that and you've verified that your findings  are as you think they are.  So it was a good learning process for us.  And I think in the end, the disclosure went well, one thing just before I wrap that I'll  say is I think part of the reason the disclosure went so well was because of the role that  DHS CISA played.  I think that having the vulnerability management center part of the CISA, which Katie was kind  of running out of time, having you guys independently verify the research findings and then decide  that it was a significant enough issue to put out your own alert to coincide with our  report.  That to me was a pretty big deal.  It was actually kind of a game changer, I think.  I can't say whether we were about to pressure if that had not been the case, but I'm certainly  very grateful that we didn't have to make that choice.  So thank you.  And thank you to everyone else on the call who helped educate us along the way and gave  us their time and their feedback.  Yeah, it's definitely a complicated situation.  I think a lot of times it's difficult when you think about every sector is different  and your ICS systems, your embedded systems, your safety systems, they're very complex.  And doing that coordination up and down the hardware stack is a little different than  you would necessarily see in say a digital services sort of platform or in a general  typical traditional software platform.  So it's definitely learning, I think, for everyone and there are some ups and downs  in that.  And I think that when you look at it, you have to take it for, we're going to look at  climate versus weather.  If we look at one each individual disclosure, it's pretty tough, but in the end, we learned  a lot.  So, Randy, can you talk a little bit about the DHS got involved in this disclosure?  Can you talk a little bit about how DHS got involved in the disclosure and what role DHS  took?  Sure.  Yeah, we have the Vulnerability Disclosure Program that DHS runs.  Every group of folks, as a matter of fact, I think J. Angus is going to have a panel  at the Aerospace Village on Vulnerability Disclosure.  So I invite you to go and listen to that.  Great folks, they approach me, great folks, including you, Katie, approach me and said,  hey, I've got an aviation thing.  I need to get it to you and I need you to understand and we need to know kind of where  we go from here.  So I was able to get the briefing from Rapid7, actually got to read their final draft report,  if you will.  And you have to realize that aviation is a big thing.  So I've got a big background in aviation, but the CAN bus, where it's installed, different  aircraft vendors, it's a huge thing to try to go, oh yeah, I got this.  So how important is it?  It did require physical access, so I can stand down a little bit from that.  I think everybody understood that.  But how does it affect commercial aviation?  How does it affect small aircraft or the general aviation folks?  So I said, look, we need to get it to two places.  We need to get to the FAA, they're the regulator, they should be aware of this, because they  need to make a risk assessment if it's a big thing.  We also need to get the aviation ISAC.  Aviation ISAC has their members that can quickly get it out to aircraft manufacturers and actually  the folks who are building systems and determine, hey, what can I do with this or what should  I be doing with this in the future?  I think this was the first time since the ACIs have been stood up that we've had a vulnerability  disclosure come to me.  It's not the last time, but it was the first time.  It was handled very well, I think by Rapid 7.  I think they understood going in.  The physical access aspect was a big deal, the acknowledgement of that.  It wasn't the skies falling.  It was, hey, this is an issue and we need to address it.  And I love that part of it.  I know our VDP folks, the vulnerability disclosure folks, were very interested in, hey, look,  we need to send out an advisory.  It's going to mirror what we did on the cars years ago.  And it's also going to say, hey, it does require physical access.  So then once again, not the skies falling, we found a vulnerability.  But this is something you should be aware of when you're architecting a system.  So it was very good for me.  I enjoyed getting involved in it to this level.  And then the focus for that vulnerability disclosure is, can we get, how do we approach  a mitigation?  If we found a vulnerability, how do we approach a mitigation?  How do we close that down and make the system more safe and secure?  And I think we achieved that in this particular case.  Great.  Yeah, it's, we go back to that physical security.  And I think overwhelmingly, one of the big things that was very different from, say,  this disclosure to a disclosure that we might see somewhere else is that this is more of  an architecture, it depicts a lot of different things versus, say, one particular product  and one particular version.  And so just the impact was very awe-inspiring.  I mean, we didn't know where things were.  So we really had to rely on the subject-better experts.  And we really had to bring in a lot of different people to ask and find out.  And so, Sid, can you really quickly tell us about your work and how you were brought  in and talked to some of your colleagues at the FAA and the safety that was involved  in that?  Yeah, sure.  So Randy kind of brought this up last year.  And I think I agree with you, Katie.  I think it was a watershed moment.  It's a good way to describe it.  We had a researcher that came forward with a vulnerability.  Rapid7 came to us and they said, hey, look, this is important.  This is an issue.  And so it really helped kind of spur a set of conversations within the FAA, both from  our ABS, which is this aviation safety organization within the agency.  The CISO was on the call.  And it helped us, I think, really connect different offices.  And so granted, it's a physical security issue.  And I believe the other thing that happened also was TSA was notified.  That's the agency that's responsible for all of aviation security in the US.  So it really helped us connect with different stakeholders and really laid the groundwork  for a process.  There's going to be a lot of back and forth in such situations between the safety engineers,  the regulators, the researchers.  And that's really, in my mind, very good.  And it's healthy.  We want to spur those types of conversations.  Everybody's not going to agree on what exactly how big the risk is.  And so it can get a little difficult to come to get to the same page.  But I think having those conversations is really important.  And I think this event helped us do that.  So thanks to Rapid7, thanks to DHS and the ISAC for taking the lead on this.  Yeah.  Yeah.  So that actually leads us right into, Jeff, can you talk about the ISAC and the ISAC information  sharing?  And so if you really want to affect change, you need to get the information out there.  You need to make sure that people understand.  So can you talk to us about your involvement in this?  Thanks, Katie.  And so first off, we were just really highly appreciative of Rapid7's approach to this  and allowing us to be invited in.  Similarly to Randy and the rest of the folks at the Aviation Cyber Initiative for being  so inclusive and us kind of get this information and be able to pass it out to the members.  So like has been mentioned earlier, the Aviation ISAC's role in these security disclosures  is really a connector.  And Jen highlighted how important it is for communication to be happening during these  events.  And typically when they start, it's really hard for a researcher to find the right person  in the industry.  We also mentioned here, though, that this was a little different.  This is a technology that's broadly used across the industry, and it's actually something  a lot of other folks plug into.  Many times when a researcher has a particular disclosure they want to make, it's about one  type of product.  There's one vulnerability in some design of a specific component.  When researchers want to get a hold of that company, frequently they're calling us because  if you want to get a hold of somebody in the industry, it's a lot harder nowadays actually  to find the right person.  And we just happen to have them all connected in our community.  But this one was different, and it was a great learning experience for us all because it  was a little bit of a shorter window on the industrial side.  But as we look back at the event, it really made a lot of sense because there wasn't somebody  that was one particular company to take a look at this.  This was more of everybody saying, hey, wait a minute, we're all plugging into this.  We really need to take a look at this as a larger issue and as a systems issue.  In the end, we did, and it's been mentioned as well, there was a physical security component.  That is one component.  But in the whole concept of layered security, physical security is just one layer.  And when you find that there is an issue inside of any layer, the objective in a really good  layered concept is to harden that layer.  And this was a really good example of that.  It doesn't matter if it's embedded in a lower layer.  Let's get every layer as hard as it can possibly be and make it difficult for anyone to make  that complete penetration.  So I would agree with everyone.  I think this was a really good example of how to do it right.  And I think what was really impressive for us too, as the trust gets built across the  engagement between the researchers and the industry, was really good to see what Jen  talked about was the perspective right from the start, hey, we don't want to get people  overly excited or hysterical about something.  We really need to understand in the whole equation of risk, how big of a risk is this  and how does that risk get managed?  And their approach that they took, that cautious approach of really trying to get that understanding  and validation was really critical to the successful outcome.  Awesome.  So I think this is a great opportunity and it was a great example of pieces that didn't  ever typically work together and who were new to each other and maybe didn't even know  that the other existed and were able to really pull together.  And there were some ups and downs.  And in the end, Rapid7 put out their vulnerability information.  DHS put out a complimentary security advisory.  And I think it sort of laid the groundwork.  So now that we kind of talked about that, I really want to pivot to the current.  So there are some really awesome progress being made in the aviation and researcher communities.  And it's hard to even pull a couple of topics.  When I sat down to kind of go through and say, what can we talk about here?  It was, there were just so many topics out there.  The community is moving so rapidly.  And I think even the aviation village itself is something that 10 years ago, we wouldn't  have even thought of.  We could pull together and do that.  And so there's so many wonderful things.  John, Boeing is getting involved in some really awesome community outreach and community engagement.  Can you talk a little bit about the tech council?  Yeah.  I'll start off with, you know, aviation is a unique space and we have a very strong safety  culture.  We have a unique development process.  And, you know, to some extent, I think we view ourselves as being special.  And you know, Jen kind of mentioned earlier that when people come from outside that community,  the natural antibodies kick in and we find reasons to kind of discount the feedback.  I've been working in this space for 10 to 15 years and, you know, reality kind of kicked  in on me when the Stuxnet virus was disclosed.  And it broke all my, you know, stereotypes of aviation and how we're unique.  You know, and oftentimes I feel like an evangelist out trying to spread the good word.  Well, last year was a significant milestone and I'd say turning point for Boeing.  A researcher got a hold of some of our executable code, reversed engineered it and disclosed  things that were actually quite surprising.  I think we were surprised with the tools that allowed them to actually go in and, you know,  kind of view the code in, you know, in a space where we didn't think was really possible.  We actually spent a lot of time several months analyzing the code.  We were in our lab.  We have very extensive labs that replicate the airplane quite accurately.  At the end of it, we actually went out onto an airplane.  We brought all the systems engineers out to view it.  We went through a bunch of scenarios.  Some of the claims, we actually went well beyond the claims.  We did a pretty thorough test on a 787.  And at the end of that, our response, you know, not knowing, you know, it wasn't the  real intent, but I think it was viewed as hostile.  And I got that feedback from several folks, you know, in the aerospace village.  And so after our analysis disclosure, we held a meeting with a lot of key stakeholders.  A lot of the airlines had a lot of questions for us.  You know, what do you think of this?  Is it real?  You know, we gave our synopsis.  A lot of the government folks and Katie, you were in one of the meetings with us.  We had a spirited discussion with lots of different government people, as you remember.  And in that meeting, Katie kind of said, you know, John, you really need to reach out to  these folks and I can help you if you'd like.  So we took that, we went internal to Boeing and we had some spirited discussions because  this is really uncomfortable, you know, changing how we've operated for a long time is not  the easiest thing.  But at the end of the day, we said, you know what, we need to do this because these people  are looking at our designs.  They're not, you know, I don't think there's any ill will, but we need to embrace them  and we need to learn from them.  So we set up this tech council and we had several meetings trying to level set a little  bit.  It's a little hard via the phone.  And so after the RSA conference in San Francisco in February, we invited them all back to Boeing.  And at Boeing, we kind of went over some of our design methodologies and, you know, met  face to face.  And that's a real, that's real powerful to get to know people at a much more personal  level.  We took them into our labs, showed them what we're capable of.  We even arranged time on a 787 simulator.  In fact, one of the gentlemen was a military pilot and we set up kind of a difficult landing  form by winds and, you know, low light conditions, etc.  He made it down good, which was positive.  But I think it went a long way to mending the adversary relationship.  So as part of that, we have part of this team.  They have a, some folks have a claim they'd like to investigate with us and we're in the  process of bringing them into Boeing into our lab to kind of evaluate that when, you  know, the COVID hit and that kind of slowed us down a little bit.  But, you know, I really want to embrace this and I want to expand it.  And, you know, at DEF CON, we actually plan on bringing, you know, real hardware, setting  up some kind of capture the flag event to kind of embrace this community much more.  Another aspect of this, we actually matured our vulnerability disclosure process.  It is now very easy to find on the Boeing website, at least I hope it is for folks I  was able to find it.  And you can send your vulnerabilities encrypted.  We provide that means.  And we're starting to receive a lot of stuff in.  And a lot of things that come in are shared between all the stakeholders and as the product  guy for the airplane, we see all of it.  And we actually evaluated surprising vulnerabilities that are in the IT space.  A lot of these systems are used in some form in aerospace.  And so we have to evaluate all those and see if we have the same issue that maybe the original  claim came in with.  So I'll just close, you know, saying we're still crawling here.  I'm really hoping to get more engaged.  You know, I think it's critical that we interject this into our designs.  It's a different view and, you know, it's always powerful to get diverse opinions and  diverse perspectives and those outside of aviation probably are more powerful at looking  at our designs than we may be.  So thanks.  Yeah, awesome.  I know I remember sitting in some of those meetings and I remember thinking to myself,  why don't we all just talk?  You know, why can't we just, why don't we all just talk?  And I can imagine that there were some people in that room who thought that I was just that  crazy lady from Homeland Security with these wild dreams of working together.  But I'm hopeful that we're going to see more of that and that that has actually worked  out really well.  So yeah, you know, we're still in steps here and I would like to, you know, commend Boeing  because Boeing did all the hard work on that.  You know, the hardest part is getting going and taking all of the steps that needed to  happen in order to bring people in and really get down into the labs and get into the weeds  and that that's that takes a lot, a lot of effort.  And so, you know, I commend Boeing for that.  So Sid, can you talk a little bit about the FAA structure and the work with the tri-chair  and some of the things that you've been working with?  Yeah, sure.  Thanks, Katie.  I agree with everything that has been said on this great panel.  I think let me let me make a few points.  You know, we kind of oversee and regulate civil aviation.  So we have a unique role.  We are the premier aviation agency in the US.  We have authority over all the aircraft that fly in the US and all the airmen, all the  pilots, we certify them, we certify all the aircraft.  And we also conduct air traffic control.  All the airplanes that take off and land are controlled by the FAA.  So it's a pretty big role.  It's a pretty big responsibility.  I think safety is our focus and we are a safety agency.  And so the way I see it is that cybersecurity is part of our safety responsibility.  And I run into that all the time as a tri-chair for the ACI.  You know, it's really a big task is culture change.  We are trying to bring that culture of security and looking at how to improve the security  of the whole ecosystem into an agency that's focused primarily on safety.  So in terms of vulnerability disclosure, we don't have like a formal program.  We don't have like a way that you all, the researchers can come forward and directly  to us, we rely on DHS, which is our partner through the ACI.  But that does not mean that we are not open to all of your ideas.  I think the fact that I'm here on a panel, you know, I'd love to hear from you all.  And we'd love to have that dialogue about what the risk is and what some of the vulnerabilities  are.  So I want to echo what has been said earlier.  I think trust building is incredibly important.  We all should come together and like Katie said, we need to be talking all the time and  exchanging notes and exchanging ideas.  Let me share a quick story.  About two years ago, I was at the Pentagon and DOD has this team called Gen 5.  That's basically a bunch of very smart people just like you all that were looking at some  of the vulnerabilities within ADSP, which is our system for surveillance based air traffic  control, it's satellite based, I'm sorry, air traffic control.  We are moving away from radar into satellite based GPS radar control.  And so they had worked on this project for about a year to look at some of the vulnerabilities  within ADSP, which is a huge investment for the FAA and for the American public.  And I was with the CISO at the time and some other executives from FAA and we just thought  it was fantastic.  I mean, to invite these researchers into the Pentagon and have them test an aviation system  and hear some of their ideas.  They actually came out with a report, which was super insightful.  And we took it all the way to the National Security Council.  And that has formed a basis for a lot of the follow on work that's going on within ACI  for ADSP.  So, you know, I told my boss, this is something we need at FAA too.  We need a team like this to come in and test our systems and bring a completely different  perspective than what the agency is used to.  So that coming together of the researchers, of the research community, of the safety folks,  you know, of the air traffic controllers and the IT people, all that has to happen because  it's really about bringing all those disciplines together to tackle which is what is a very  difficult sort of problem.  I mean, we are looking at risks across the ecosystem.  And so that conversation needs to happen between the different disciplines.  I just did an online cyber course through Harvard a month or so ago.  I finished it.  It was like an eight week class.  Let me just share a couple of things.  Every organization, including aviation, has operational risks, reputational risks and  legal risks when it comes to cybersecurity.  So a cyber breach can cause huge damage.  It can cause a loss of $1 in terms of your operations, in terms of your reputation.  Something to think about.  Second is that we need a culture within cybersecurity where we reward people for being skeptical.  You know, you don't want to just kind of reward people who are sort of agreeing with what's  going on.  You want people to look skeptically at what's going on and tell you a different way to do  things.  You want people who want to break things because that can lead to a more cyber secure posture.  And a lot of the challenge that we face today as organizations has to do with information  sharing has to do with culture change and trust building.  And so those are the tasks that we are all involved with.  So information sharing should be happening all the time.  And that's what the ACI is designed to do within the government between our three big  departments and with industry.  I want to, the last thing I want to say is also the fact that the aviation ecosystem  faces a lot of state and non-state cyber threats.  The threats are very real.  There are known vulnerabilities within this ecosystem.  We all recognize that.  So that can impact the operations within the national airspace and civil flights.  And the fact is we got to tackle those threats and risks together.  And so the FAA issues cyber situation reports today which are, you know, which address specific  equities across this ecosystem.  And some of those are externally tailored to partners outside of FAA.  So those include, you know, other federal agencies and industry partners.  And that's what I have.  So thanks, Katie.  Yeah, awesome.  It's really exciting to kind of hear some of the things that get passed around and just  really are exciting initiatives.  The Pentagon has, I know, been deeply involved in aviation for, you know, I was in the Air  Force so, you know, since forever.  And so it's really great to see these very, very established organizations get excited  about working with research and breaking things.  That just makes my day.  So these are really awesome initiatives and I'm really excited about them.  I want to move to the future for a little while.  We kind of talked about the past and we talked about the current.  And then I want to kind of talk about the future really quick.  And so I think the DOD's got kind of a really fun new initiative that I'd love to hear more  about and I think it's called the in-factor.  So Al, can you talk to us about the in-factor?  Hey, sure, Katie.  Hey, just as a little background before we dive right into the in-factor.  So we talked a lot about identifying and sharing cyber vulnerabilities, sharing information.  But going forward, the future is that we need to work together to close those vulnerabilities  using a threat-informed risk-based approach.  And that points us to two trends the aviation ecosystem must address.  You know, like Sid said, the first trend is the cyber threat to aviation is real and  growing.  So it's highly likely that advanced nefarious cyber actors to include adversary nation states  will use cyberspace to steal our aviation intellectual property and to conduct cyber  operations to damage the reputation of U.S. and allied aircraft and aviation industries  to gain a competitive advantages for their own industries.  And so from a national security perspective, improving the cybersecurity and resilience  of our own nation's aviation ecosystem to counter this threat is key.  And for the Department of Defense, we have to be able to project power, defend the homeland,  and protecting critical aviation infrastructure is part of that.  But there's one thing we acknowledge.  This challenge is not something the Department of Defense or the government can do on its  own.  So recognizing these two trends, recognizing that trend, you know, requires an increase  in a public and private sector collaboration or a whole-of-nation approach.  I don't know if you're aware, but Congress recently chartered the cyberspace-celerium  commission.  And in this commission report, it identified the need to increase public and private sector  collaboration.  And the goal is to improve our speed and agility in addressing cybersecurity and resilience  threats.  And so the end factor that you referred to, which stands for the National Federation of  Aviation Cyber Test Organizations and Researchers, the end factor, is a great example of how  the Aviation Cyber Initiative is pushing to work on this.  And so the thing that the Aviation Cyber Initiative does is, you know, we bring together that  whole-of-nation approach, bring together the cyber experts from federal agencies, state  agencies, industry, our federally funded research and development centers, our university-affiliated  research centers, our national labs, all working together in the end factor to achieve three  lines of effort.  And those lines of effort are, one, is to catalog, collaborate, and connect.  And so, you know, just at a top level, we talk about catalog, our big push is to create  a national-level Aviation Cyber Resource Guide.  And the goal of this resource guide is to be an online, accessible, and searchable database  of Aviation Cyber Research, Development, Test, and Evaluation resources, expertise, facilities,  and capabilities.  And so if you're part of the end factor and you're working on initiative to counter, to  look at cyberfuzzing or any of these other kind of cyber trends, you could go to the  resource guide and it'll give you a list of who's working in that space, what kind of  capabilities they have to test, and what, and more importantly, how you can get to hold,  get a hold of them to further collaborate.  And so the collaborations are second line of effort.  You know, the goal of the collaboration is to create a persistent collaboration forum  where these cyber experts, this whole nation approach, can get together and be able to  spotlight or showcase capabilities, share information on projects.  And more importantly, if a, like let's say for example, you're working a project on intrusion  detection, cyber anomaly and intrusion detection, you can come to the end factor and present  your project and give us asks.  And the ask, the goal for the ask is that the end factor try to close those gaps.  And when we talk about closing those gaps, we call that a connect.  And that's the third line of effort, to connect projects, efforts, research papers with resources  to do things like test, validate, and move forward projects.  And just a couple of examples, you know, on the collaboration side, Johns Hopkins APL  did a presentation on how they were doing cyber modeling on various aircraft.  And the aircraft they were doing the modeling on, it so happened, since John Craig was on,  they were Boeing aircraft.  And so, you know, after the meeting, John and his team got together said, hey, we probably  need to know more about this modeling effort.  And oh, by the way, maybe we can work with Johns Hopkins to make it better.  And so right now, that's what we call a connect.  We're working to bring those Johns Hopkins APL and Boeing together to talk about how  they can enhance that cyber modeling.  And then on the resource sharing side, we had a project come forward that was working  on a cyber anomaly and intrusion detection capability was AI machine learning based.  And they needed a data tab to pull data from 1553 bus.  They didn't have it.  And they also needed large quantities of data to support, you know, training a machine learning  and AI capable tool.  And so we connected them with the Air Force Search Lab and provided a tool called Vampire,  which is a aviation bus tap and ship that to them.  And then Johns Hopkins APL again came through and they've been working on the data sharing  effort that's been fantastic in terms of connecting.  So those are the kind of things that the end factor is trying to do.  We're trying to do it at scale.  And so that leads us to the, I'm sure people are saying, so how do you participate?  In the end factor?  Well, we got a couple, a couple of asks, you know, first off, we're focused right now on  US organizations.  So if you want to be a part of the end factor, what we ask you to do is three things.  First, we want you to one, agree to populate our aviation cyber resource guide with your  company's capabilities and resources.  So that's one.  The second one is we want you to participate in our tight 90 minute monthly forum.  It's the end factor collaboration forum.  And our goal is to be able to showcase all our major participants as we go forward.  And to participate and follow on meetings, you know, should those connects happen.  And the third one is that is the connect part that if you have capacity and if you have  resources, we would like for you to help connect others to serve as a mechanism to accelerate  our cyber innovation and the aviation ecosystem.  And so that's the kind of the three asks.  I tell you, just yesterday, we had nearly 100 participants from across more than 60  organizations participate in the end factor forum.  Our FAA tech center and DOD guys are working to deliver the aviation cyber resource guide  by the end of August, at least the first instantiation of it.  It's based on the FAA's technical capabilities library.  And I would say, you know, in fact, it's growing.  And I think it's exceeding many of our expectations.  And what we want to do is get more people to work with us so we can do what I like to  say collaborate with effect.  And so that's that's an end factor going forward, working to address the threat and to increase  our public and private sector cooperation across the aviation ecosystem.  So let me ask you really quickly, is that is this initiative specific to military aviation  or is it open to civil aviation as well?  No, it's it's it's not limited to military aviation.  In fact, it's not a DOD initiative.  It's an aviation cyber initiative initiative.  And so, you know, we have a charter to engage industry.  And so we're we're working to do that in spades.  And, you know, at least a couple of times a week, we're reaching out to bring our industry  partners and really small businesses, you know, which we think the small business businesses  are real powerhouses and innovation.  And you know, when we can connect them with the larger big companies like the Raytheons  and Boeing's of the world, then we can we believe that we'll be able to accelerate aviation  cyber security capabilities.  Awesome.  Awesome.  Awesome.  So we have about eight minutes or so left.  And so I really want to close up with some of our closing thoughts and some just kind  of words of wisdom and things that we've learned from each one of the participants.  So Randy, can we start with you some what are your what are your words of wisdom things  to take away closing thoughts?  Things to take away.  Well, I tell you what, Katie, I'm super proud of what we're doing under ACI.  I think it's I think I think it's time that we've we've reached out across the entire  ecosystem and try to pull people together and have those conversations, address those  those vulnerabilities.  And I think, frankly, I think this is beginning to work.  You know, working for DHS SZA, you know, I've got that outward look.  I'm looking to industry.  I can pick up the phone and call virtually anybody on this panel at any time.  And if they're not in a meeting, which they always are, they'll answer the phone and we'll  have a conversation.  This is this is collaboration at its finest.  And I got to say, you know, and I know we're limited on time, so I'll stop it here.  I love my job, and these are the reasons why I love my job.  The people on the panel, the things that we're trying to accomplish and what we're trying  to do through ACI, I'm very proud of that.  Yeah, it's wonderful.  It's something that I think is really going to make a difference.  And that's that's very exciting.  I'm excited to be proud of it or to be part of it.  Sid, what are your what are your thoughts?  Well, I want to say that COVID-19 obviously has affected the aviation industry.  It's transforming.  It's going to transform how we travel.  It's going to change so many things.  And we're, you know, we're going through a change right now as an aviation industry.  But that does not mean we ignore the cyber threats.  The work we are doing here on this panel and the work I do through the ACI is incredibly  important.  The cyber threats are real from both state and non-state actors.  It's a combination of physical security and cyber security and the information technology  and operational technology, safety, security, all of that.  And the ecosystem is a vast complex network.  So there's a lot of vulnerabilities to it.  A cyber breach can happen anytime.  There are threats out there and an attack can cause millions of dollars of damage and  a loss of reputation.  So it can shake public confidence.  It can change again the nature of flying.  So we cannot ignore it.  I think the work we are doing is super important and I'm privileged and I feel lucky to be  part of this team of so many smart people who are doing such incredible work.  So thank you for having me.  You have my contact information, so I urge you all to reach out to me anytime.  Awesome.  John?  So, you know, the last year has been interesting and we have got much more of a focus at Boeing  on this.  We do daily report outs to the board of directors.  In fact, we have a champion on our board.  We are leveraging our enterprise to not only help us with incident response, but helping  to beef up our design guides.  We have expanded our product CERT team and we are being much more proactive at looking  at things.  You know, and then we are looking at things across board.  How do you create a process to evaluate threats and risks?  And we are looking into that.  We are actually working with, you know, industry and the government on, you know, how do we  do that effectively?  The key is we are really starting to engage outside of aerospace.  I think that is going to be the thing that really helps us the most.  The tech council is one, but participation at DEFCOM so we can build those relationships,  RSA conferences, et cetera.  So it is pretty exciting.  It is really exciting right now and a little uncomfortable, but it is good.  So thanks.  Yeah.  Embrace the uncomfort.  Jen?  Katie, I am honestly blown away.  I think the whole purpose of the aerospace village is to increase understanding and appreciation  of the importance of cybersecurity in aviation and to do so in a way that builds trust between  the security community, the aviation industry and the government, which all play a very,  very important role in advancing cybersecurity and aviation.  And when I sit and I listen to my panelist talking about some of the amazing initiatives  they have got going on and hear their attitudes and responses to the research and that kind  of stuff, I feel like we are in such a dramatically different position to where we were a couple  of years ago.  And I hear people saying that they want to hear from the research community.  They want to hear from the security community.  They want to partner and collaborate.  And that is an incredible opportunity.  And I hope that anybody listening, particularly people who are participating in the search  and research in some way, that they can love hope and optimism from this and feel that  they can engage and that they can build trust.  They can build empathy and they can get involved.  Yeah.  It's very exciting.  I'm the trust and the relationships I think are some of the most important factors in  all of this.  It's getting involved.  So yeah, getting involved.  Jeff, information sharing, what have you got?  What are your thoughts?  Well, thanks a lot.  I think this has been a great discussion.  And we only went through one example.  But at the Aviation ISAC, we've had several of these events happen over the last couple  of years.  And each one of them pretty much follows this pattern of building a great relationship with  a security researcher, finding out what a vulnerability is that they've discovered and  then going through that validation process of, you know, is it really an issue or isn't  it an issue and then, you know, working through the remediations and disclosures when those  have to happen.  And, you know, likewise, we have found this to be incredibly eye-opening.  And I mean, so much so with the researches we've even hired one, which helps us tremendously,  particularly in the work that we're doing now.  So I am glad that there's been kind of this breakthrough and that we're seeing, you know,  the bridges being built and only think it's going to get better.  Awesome.  Al, what are your closing remarks, closing thoughts?  Okay.  Hey, Katie.  So kind of echoing across the board, I think the most important thing is one is we have  to recognize that the threat is real.  And we should learn from the maritime sector's no-petch attack.  We shouldn't have to wait until a serious cyber attack of our own on the aviation ecosystem  occurs.  And the key to preventing that is to embrace the idea that there's safety in the herd.  You know, we need to strengthen the aviation herd, you know, by continuing to share information,  vulnerabilities, and work together to address those vulnerabilities to improve our aviation  cybersecurity and resilience.  And so threats real and there's safety in the herd.  Terribly true.  Very true.  So I guess my closing remarks then, I will say that the thing that I take away from all  of these things is that I go back to the coordinated vulnerability disclosure and I say that coordinated  vulnerability disclosure is an essential part of any security research.  I think that everyone here and everyone that I've met from varying backgrounds all over  the world, everyone has the same goal.  We may not all speak the same language.  We may all talk past each other.  But I think ultimately we have the same goal and that goal is protecting the end user.  It's reducing risk and making people safer.  And so I think the last thing that anybody wants is to inadvertently put countless people's  lives at risk, economic situation at risk, because we published a roadmap that if that  fell into the wrong hands could just wreak havoc.  So I go for coordinated vulnerability disclosure because it really is a balancing act.  It's a process that allows us to mitigate while we're, or to balance while we're trying  to mitigate.  So that's my closing advice.  I feel like all of the progress that we've made is so wonderful.  We have a long way to go.  I think that I love the fact that we're all talking to each other and we're working together.  But I want to make sure we know that there is a road ahead of us.  And that road to me, the future looks bright and I'm excited for it.  So thank you guys for coming to the panel and listening to us.  And if you have any questions, our contact information is up.  I think there's going to be an opportunity for some live chat later at some point.  So you'll be able to find out more information about that.  If you have any questions or want to talk more to us, please feel free to reach out.  I think everyone here would invite a conversation.  So it was great talking to everybody today.  Thank you.
DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_0_119.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_120_215.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_216_299.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_300_383.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_384_1583.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_1584_3647.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_3648_3815.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_3816_8927.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_8928_9263.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_9264_9347.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_9348_10331.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_10332_12527.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_12528_14351.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_14352_14807.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_14808_16187.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_16188_16259.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_16260_18443.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_18444_18491.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_18492_19883.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_19884_19943.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_19944_24227.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_24228_25367.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_25368_25775.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_25776_25823.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_25824_28487.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_28488_28655.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_28656_28715.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_28716_28775.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_28776_30383.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_30384_30551.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_30552_33515.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_33516_33563.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_33564_34187.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_34188_34235.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_34236_34391.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_34392_38411.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_38412_38483.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_38484_40079.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_40080_40139.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_40140_40307.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_40308_42023.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_42024_42071.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_42072_42179.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_42180_44399.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_44400_44591.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_44592_44675.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_44676_44879.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_44880_46235.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_46236_48659.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_48660_50915.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_50916_52595.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_52596_52643.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_52644_54071.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_54072_60827.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_60828_63851.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_63852_67391.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_67392_67475.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_67476_67931.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_67932_69371.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_69372_73271.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_73272_75263.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_75264_89915.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_89916_89987.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_89988_90035.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_90036_90083.png DEF_CON_Safe_Mode_Aerospace_Village_-_Panel_-_Buil_XZ0dS-ayQA0_90084_90173.png