Protecting jetBlue Airways From Cyber Threats in the "Clouds"

Randy Naraine and Greg Speranza, security staff at JetBlue, open by explaining how airline IT differs from other enterprise environments. Downtime compounds quickly across bookings and check-in, the industry faces heavy regulation, and third-party links for fuel, satellite connectivity and hosting widen the exposure. Lost or stolen crew iPads holding flight routes and documents add another concern.

The middle of the talk covers the Log4j disclosure in late 2021, when the team ran the response for days. They reproduced the exploit against a local test application, used the CDN edge to block the payload pattern, and scripted changes across about 65 services. Patching stalled wherever vendors had bundled the library into their own software. The speakers then described bot tagging and rate limiting on the web application firewall, including a high-traffic fare sale where most requests were blocked, a large DDoS attack, and abusive traffic aimed at a flight search endpoint used by an external search service.

The closing sections describe how aircraft maintenance logs are still moved by hand on USB sticks into file servers and then into a SIEM, and how the team works with Airbus on controls for onboard systems. They also introduced the Aviation ISAC for intelligence sharing, university partnerships, phishing tests for mobile staff, a bug bounty program, and the cost surprises of running large workloads in the cloud. Takeaways include automating defenses, knowing every API endpoint, and using deception where blocking alone falls short.