"Cybersecurity is a key component of our avionics safety mindset"
© Thales/Hosam Badreldin
Across the Avionics activities of Thales, teams are collectively focused on the quality and reliability of the products and systems that are delivered to aviation customers. With the growth of connectivity, the technologies we conceive also have to be watertight in terms of cybersecurity, as explained by Hosam Badreldin, Product Security director for the In-Flight Entertainment business at Thales.
Why is cybersecurity taken so seriously in the field of avionics?
Technological evolution is profoundly transforming our environment. Aviation systems, once isolated, are now connected to passengers, airlines, Original Equipment Manufacturers (OEMs), and suppliers. This connectivity creates value, but it also generates new risks. An unmanaged cyber risk then becomes a safety risk, which is why cybersecurity is becoming essential on much the same level as the quality and reliability of the hardware and software we deliver.
Recent regulations clearly show that cybersecurity is no longer a peripheral issue. It is becoming an essential pillar for ensuring compliance and operational safety. From this perspective, cybersecurity is not an add-on: it is a natural extension of our internal approach built around a shared safety and quality mindset.
What are the concrete risks if cybersecurity is not properly addressed upstream?
The potential impacts extend far beyond the IT realm. The knock-on effect of a cyber incident can, for instance, lead to a loss of trust among pilots in their systems, the exploitation of a passenger system as a point of entry into critical networks, or even aircraft being grounded due to a lack of demonstrable cybersecurity robustness.
These scenarios demonstrate that cybersecurity is directly linked to operational safety. At Thales, whatever the product we are working on, we do not accept, do not generate, do not transmit non-conformities. When this is applied to cybersecurity, it translates into not accepting vulnerabilities from suppliers, not creating them in our designs, and not passing them on to our customers.
In terms of our in-house safety culture, this is, in essence, the same mindset, applied to a modern risk. We’ve integrated it for quality and have now integrated it for cybersecurity as well.
© Thales/Axel Dreyer
How is this being achieved?
One of our primary goals has been to incorporate cybersecurity into existing practices. Our teams were already aware that product and system security and safety are not just the responsibility of our Quality specialists; it’s everyone’s business. I believe the same logic applies to cybersecurity as well. It’s not just the Cybersecurity team. Our Engineering teams make secure design choices. Our Supply Chain specialists evaluate suppliers on security. Our Program Management focals integrate security into system design and development milestones. And, across the board, operational teams integrate the cybersecurity dimension into the pillars that make up our structured safety culture program, referred to in-house as weCare. I believe a shared culture is nurtured on four foundational elements and, as such, cybersecurity, like quality, must be Seen, Heard, Felt and Communicated.
Given how high the stakes are in this day and age, this approach seems vital…
Indeed. It is no longer possible to guarantee safety and security without addressing cybersecurity. They are now inseparable.