VDP in Aviation: How it Shouldn't be Done!
Shares firsthand experiences navigating vulnerability disclosure programs in the aviation industry, highlighting common pitfalls and best practices.
Summary
Vulnerability Disclosure Dynamics in Aviation
Vulnerability Disclosure Programs (VDPs) in the aviation sector operate under intense regulatory scrutiny and safety sensitivities, creating friction between independent researchers and aircraft manufacturers.
Firsthand Perspectives from Submissions and Triage
Matt Gaffney shares real-world case studies from both submitting and receiving vulnerability disclosures within the aerospace industry, illustrating how bureaucratic delays and legal threats undermine constructive security research.
Common Institutional Pitfalls
Key shortcomings include ambiguous scope definitions, defensive legal posturing, failure to provide receipt acknowledgments, and lack of safe harbor protections for good-faith researchers.
Frameworks for Constructive Aerospace VDPs
Improving aviation vulnerability handling requires adopting standardized ISO/IEC 29147 disclosure practices, establishing dedicated aerospace CERT channels, and fostering open dialogue with the research community.
Related talks
Creator Stage·55 min
M. Weigand · S. Wagner
Examines technical and policy challenges in civil aviation security as new European and United States regulatory frameworks take effect.
Aerospace Village·30 min
Steve Luczynski · Larry Grossman
FAA Chief Information Security Officer Larry Grossman shares federal perspectives on securing IT and operational systems across national civil aviation.
Aerospace Village·30 min
Matt Gaffney
Matt Gaffney recounts reporting critical vulnerabilities to aircraft manufacturers, analyzing why safety arguments are required to prompt aviation remediation.