Joining Forces with the White Hat Researchers: Aviation Industry Lessons
summary
Boeing launches an enterprise vulnerability disclosure program in 2019, publishes safe harbor and a Hall of Fame with three researchers, and coordinates fixes like the Onboard Performance Tool patch (OPT tool v4.7) after about a year of triage and certification work. ForeFlight input filtering is fixed in under 60 days. An operator moves from contest-style bug bounties to a responsible disclosure covering all internet-facing assets. Independent research finds seven EFB vulnerabilities — four remediated, one unresolved — discovered in newer boneyard aircraft during COVID.
AI-written summary · about
chapters (9)
- 0:00Introduction and context
- 2:52Why engage White Hat researchers
- 7:29Setting up vulnerability disclosure programs
- 13:15Aviation industry specifics
- 20:24Use cases and vulnerability fixes
- 31:52Media relations and public perception
- 39:21Certification and regulatory challenges
- 40:47Key takeaways and closing advice
- 48:37Q&A and wrap-up
related talks
49mBugs on a Plane: Implementing a Bug Bounty in an Airline IT/OT Environment
52mAnatomy of a Vulnerability Response - A View from the Inside
51mPoint-and-Shoot Exploits to Hack Avionics, Maritime, Satellite Devices
30mDoes Public Disclosure of Vulnerabilities Affect Hacker Participation in Bug Bounty Programs?
16mTaking Flight – 3 Experts Discuss Aerospace Cybersecurity
18mWhat You Need to Know and Do about Vulnerability Disclosure
51mArm IDA and Cross Check: Reversing the Boeing 787's Core Network
05mKeynote: OpenSearch, Open Security: Bringing Transparency to Our Security Processes