As air traffic management (ATM) systems become more interconnected, they face increasing cyber security risks. These risks are growing more complex due to the evolving nature of cyber threats and recent geopolitical events. Current security measures often miss the human element, which is crucial for building resilient systems. To keep our skies safe, we need to improve how we identify and address these threats, involving both technology and human awareness.

This solution applies to cyber security risk assessment methods already in use by enhancing existing best practices and providing an updated vocabulary for including critical assets in current and future ATM systems. This will help manufacturers, service providers and regulators in accurately assessing cyber risks and understanding potential cascading effects of cyber-attacks. The solution also provides guidelines to identify vulnerabilities in ATM systems, considering IT, operational technology, and human factors, and make it easier to apply mitigation strategies. The solution will be validated and demonstrated in two ATM-specific use cases, related to new services for 4D flight trajectory management over digital communication links and provision of dynamic and virtualized air traffic services, such as remote tower operations. ATM stakeholders will be involved to help assessing cyber security risks, recommend the most suitable security controls and mitigations, define their implementation strategy, review the integration, and monitor the entire process. 

No regulatory changes will be required, but it is assumed that risk assessment will continue to be required and inherent part of the ATM strategy to introduce control measures to eliminate or reduce any potential risk-related impact. 
The results from this solution will be suggested as an addition to the SESAR2020 ATM Security Reference Material.

BENEFITS 

• More effective and accurate cyber risk assessments of existing and future ATM scenarios.
• Increased and continuously updated cyber risk awareness and maturity among ATM stakeholders in an everchanging threat environment.