Aviation cybersecurity raises unique challenges in an ecosystem of competing stakeholders. Awareness, training and education of the current and future workforce are urgently needed. Embry-Riddle Aeronautical University is the sole National Science Foundation CyberCorps® Scholarship for Service institution in the nation tasked with addressing aviation cybersecurity.

With the support of the Aviation Information Sharing and Analysis Center (A-ISAC), a team from Embry-Riddle’s Prescott Campus recently organized an aviation cyber capture-the-flag (CTF) competition to share their knowledge with industry professionals at Southwest Airlines Headquarters at Dallas Love Field in Texas.

“Everyone learned something new related to aviation from this CTF. The scenarios were well designed, engaging and covered several areas of commercial aviation, said Ray Howard, Senior Systems Engineer with Southwest. “Previous aviation experience was not required. The CTF was a great educational and team-building experience for cybersecurity aviation beginners and professionals.”

The CTF involved over 30 participants who were cyber/IT security professionals representing a dozen different aviation organizations. These included several major airlines such as American, JetBlue, Lufthansa, Southwest, United and the International Air Transport Association (IATA). They were given an immersive, hands-on experience of what challenges emerge if cyberattacks happened at a major airport.

The CTF tasks the participants to defend major systems operating at the airport, such as check-in kiosk, security screening, flight information displays, aircraft and the air traffic control system.

This effort was presented by the Embry-Riddle team comprised of seven Cyber Intelligence and Security (CIS) department students in the College of Business, Security and Intelligence, one Air Traffic Management student and two Aeronautical Science students from the College of Aviation, and one Aerospace Engineering student from the College of Engineering. They were led by Professor Jesse Chiu and Dr. Krishna Sampigethaya, both faculty in the CIS department.

A group of college students tour airline operations center.

“In order to be a cyber defender, you need to think like a malicious actor and understand your system strengths. Our CTF aims to achieve this as part of the immersive learning experience,” said Professor Chiu.

“Technologies are increasingly inter-disciplinary. Developing and organizing this CTF gave students from across various disciplines [the ability] to collaborate with each other and learn how to solve cyber problems from these technologies,” said Dr. Sampigethaya.

“This competition was incredibly successful,” said Justin La Zare, CIS student and team lead. “The private-sector industry professionals described the challenges as hard and relevant to the work they are currently doing.”

“It’s also very satisfying to see our students interact with today’s workforce and educate these professionals about topics in this area. At the end of the event, one of the participants told me how we have made them think about new things in aviation cybersecurity! Students, in turn, also get exposed to the diverse real-world experience of these subject-matter experts,” said Dr. Sampigethaya.

“We also got the opportunity to tour the Southwest Airlines HQ and see first-hand what aviation is all about. We saw various facilities where boarding, cabin, emergency management, flight simulator and maintenance training is done, and last but not least, see a world-class Network Operations Center. These experiences will help us continuously improve our CTF in the future,” said Professor Chiu.

Women are underrepresented in cybersecurity in general, and aviation cybersecurity is no exception to this. “With the help of Dean Tim Holt, Gibson Rade and some faculty from the College of Aviation, we recruited women talented in aviation domains to join our CTF organization team, and now, they have become involved in our future aviation cyber CTF endeavors,” said Dr. Sampigethaya.

“Security is such a big part of any industry, especially aviation,” said Megan Amoako, who is majoring in Aeronautical Fixed Wing and minoring in Cybersecurity and Intelligence as well as Aviation Business Administration.

“It’s important to know what could go wrong since that can drastically affect an airline or airport,” she added. Amoako is part of the Women in Aviation Prescott Club as well as the Women Ambassadors Association.

“The Avtech event provided an excellent opportunity for me to apply what I have learned as a pilot and aerospace engineering student in a new context,” said Team Member Adam Shapiro. It was exciting to come up with cockpit cyber-attack simulations and then watch those scenarios play out in real-time during the capture-the-flag challenge.”

Shapiro added, “I would like to thank Southwest for their hospitality and the ERAU cybersecurity department for making this opportunity available to Embry-Riddle students from all colleges.”

Participating students included: Justin LaZare (team lead), Michael Boehm, Elizabeth Chwialkowski, Samuel DeKemper, Abigail Geiger, Nathan Johnson, Stephen Levy and Maxwell Werner from the College of Business, Security and Intelligence/Cyber; Megan Amoako (AS), Rachel Supergan (ATM) and Taylor Witka (AS) from the College of Aviation; and Adam Shapiro (AE) from the College of Engineering.