Product Security: The invisible Shield.
In the era of modern and interconnected world, Product Security acts as an unseen defense whose tangible effects are clearly observed and felt in our daily lives.
While Product Security and Cybersecurity are intrinsically linked, however, they diverge in their priorities especially within the Operational Technology and Critical infrastructure. Cybersecurity, which is quite known, places its focus on the CIA triad (Confidentiality, Integrity and Availability) with more priority on Confidentiality. While Product security which is pivotal within the aerospace and industrial system prioritises Integrity and Availability. The core mandate of Product Security is to ensure that products remain resilient, and perform their intended function without obstruction when faced with cyber threats or attacks. This ensures the physical and digital integrity of the product and maintains the operational availability.
Whilst Cybersecurity is a concept familiar to most internet users, Product Security remains less understood. Distinct from general network defence, Product Security is the discipline of designing, building, and maintaining products that are resilient against threats by default. It is not an afterthought to be addressed at the end of the development phase, but a mindset embedded throughout the entire lifecycle – from the initial concept through to decommissioning.
Why does Product Security matter?
Product Security is all about trust. As a customer, you expect to trust that a product won’t expose your data or create any form of harm for your business; it is about reputation and revenue.
Let’s look at it through the aviation lens:
- Beyond regulatory or financial consequences, product safety guarantees the integrity of our operations. Any vulnerability could impact the trust we have built over decades, but more importantly, it could compromise the technical availability of our aircraft. In our industry, ensuring service continuity and preventing any interruption to operations, such as fleet grounding, is an absolute priority that guides every step of our design process.
- An aircraft has the potential to fly for 30+ years. The system design from inception is expected to be secured against threat through its active years and beyond, making it an incredibly complex process. While new threats continue to emerge, the system is designed for inherent security with the flexibility for future updates.
- With advanced technology, an aircraft is connected to different networks e.g. ground network, satellite communications, or cloud environments. All these networks are possible attack vectors whose security, and the trust attributed to them and their communication means, must be evaluated and taken into account in the design of the aircraft’s security.
- Modern aircraft comprise millions of components from hundreds of global suppliers, each representing a potential entry point for digital threats. To ensure total platform integrity, we must secure the entire supply chain’s environment and operational processes.
- Any plan change to aircraft software must go through rigorous testing and re-certification from relevant authorities like EASA for the EU and FAA for the USA. This can be very expensive and time consuming, unlike the traditional IT where you can easily apply a patch. This makes it significantly cheaper to design securely from the outset, as the alternative is finding a vulnerability, re-certifying, and deploying updates to airlines. A key advantage in aircraft systems, however, is that the product functions are well-known at the time of design, which allows security measures to be precisely tailored to the specific use cases the product implements.
Understanding the Product Security Lifecycle
Effective Product Security follows a continuous Secure Development Lifecycle (SDL), ensuring robust protection regardless of the product type.
The lifecycle embeds security in every stage/phases:
- Secure design: During this phase, security experts thoroughly map out every possible point of failure, as mentioned earlier, to anticipate what might go wrong. This is further elevated to Safety-Security Co-Analysis where experts analyse how threats could lead to safety concerns.
- Secure development: Here, experts use secure best practices developing a product to be more resilient to threats.
- Testing: This phase includes penetration testing and vulnerability scanning in a secured lab environment to ascertain the effectiveness of all security measures and controls on the product.
- Secure deployment: This phase takes into account all the processes including the supply chain, ensuring that processes are secured and all components are hardened and patched.
- Maintenance: This is collaborative efforts between different stakeholders (e.g. suppliers/manufactures, airlines etc.) to manage vulnerabilities guided by approved standards.
Conclusion
In conclusion, it is important to note that Product Security is a continuous and proactive journey for risk management. Security consciousness is highly prioritised and taken into account in every phase of the product; concept to retirement. This way, companies provide a trustworthy product to customers/clients.