Cyber Defense eMagazine August Edition for 2022

The ASSURE process
The aviation sector has quietly but steadily been strengthening its resilience over the past two years.
Here in the UK, the Civil Aviation Authority (CAA) launched its ASSURE cybersecurity scheme in January
2020 which applies to all those organisations deemed in scope of CAP 1753, such as airlines, airport
operating firms and air navigation service providers.
The Cyber Security Oversight Process for Aviation comprises a six-step process: Engagement, critical
systems scoping, cyber self-assessment for aviation, the ASSURE cyber audit, the provisional statement
of assurance and the final statement and certificate of compliance.
Mandated organisations are required to identify their critical systems (using guidance under CAP 1849)
and to then assess these systems against the Cyber Assessment Framework (CAF) for Aviation (using
guidance under CAP 1850).
The CAF for Aviation has been adapted from the CAF devised by the National Cyber Security Centre to
assess critical infrastructure so is well respected and provides an outcome-based assessment based on
14 principles and four key objectives: managing security risk, protecting against cyber-attack, detecting
cyber security events and minimising the impact of cyber security incidents. These form the basis of the
assessment that precedes the ASSURE audit which determines if the organisation has sufficiently met
the requirements of the CAF.
Where it adds value
It’s this third party assessment that has proven to be so effective. Carried out by cyber professionals that
specialise in at least one of three key areas – cyber audit and risk management, technical cyber security
or Industrial Control Systems (ICS)/Operational Technology – who are accredited by either the IASME
or CREST, these assessors are up to speed on the latest security threats and able to advise on how to
comply with the regulations effectively. An assessor can be brought on to help with the self-assessment
and to add value at this stage although this then means another assessor must be used for the audit
proper.
Cybersecurity is unfamiliar ground for many of those navigating the CAF and the self-assessment stage
can be lengthy, requiring various forms of evidence to be gathered and recorded, such as documents,
manuals, observations and interviews. As the The World Economic Forum’s Pathways towards a Cyber
Resilient Aviation Industry report attests, the aviation ecosystem can be complex, leading to fragmented
approaches to compliance, lack of transparency and visibility, and ambiguous accountability. If, for
example, there are separate parties for the operational training or maintenance of a system, things can
get very complicated because the airport has no direct contract or oversight and therefore no evidence
to draw upon.
Cyber Defense eMagazine – August 2022 Edition 44
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.