Cyber security is a key enabler to safe Air Traffic Management (ATM). However, as the ATM systems become increasingly more interconnected and complex, the risks towards these systems are likewise becoming more complex. At the same time, the key elements required for achieving a more dynamic airspace management and ATM service provision, including a future data-sharing service delivery model, deployment of infrastructure through a service-oriented architecture, and increased flow of data among different actors , may expose the ATM systems to cyber security threats, which in worst-case can have catastrophic consequences if not properly addressed. To deliver safe and secure ATM, there is an urgent need to address cyber resilience. SEC-AIRSPACE addresses this need with a twofold proactive approach, aiming to
1. Improve the cyber security risk assessment of existing and future ATM scenarios.
2. Increase cyber security awareness and maturity amongst the ATM stakeholders.
These two objectives are inter-weaved since the results of a cyber security risk assessment can be used to target programs on employees’ cyber-awareness better.
The main impact of SEC-AIRSPACE - increased cyber resilience – will be achieved through a step-by-step approach. From its very beginning, SEC-AIRSPACE will contribute to state-of-the-art in cyber security risk assessment of ATM scenarios. Early results from the Exploratory Research activities will be published in acknowledged scientific conferences and disseminated to the ATM community. The short-term impact is, therefore, mainly an increased awareness and knowledge of cyber security threats and risks in the ATM community. However, we also expect that early project results can be utilized by the ongoing SESAR solutions, which can use the results to improve their security work; both when they perform security risk assessments and when they derive suitable security requirements for their solutions to mitigate the identified risks.
By the end of the project, the impact of SEC-AIRSPACE will be more substantial. The project results will be validated and demonstrated, which implies that the increased awareness and knowledge of cyber security threats and risks have reached a wider audience. The Strategic Research and Innovation Agenda states that in 2026, cyber-resilience guidelines and procedures tailored to ATM will be available for the Initial Operational Capacity (IOC) of the virtualised and cyber-secure data sharing scenarios. A significant mid-term impact of SEC-AIRSPACE will be evident in its influence on these guidelines and producers. Further, the two ATM datalink services, Satellite Communication (SATCOM) and L-band Digital Aeronautical Communications System (LDACS), are both expected to become operational and used to deliver Air Traffic Services (ATS) already in 2028. At this point, the SEC-AIRSPACE results will be sufficiently mature to be used to help ensure that multilink is implemented and deployed in a cyber-resilient manner and that the human operators can be trained to prevent, detect, and respond to relevant threats related to the use of datalink in service-oriented architectures. By then, the virtualisation of ATM services will also benefit from the project results, both in an early stage where dynamic airspace management is being applied in a single ATS unit and for assessing cyber security risks associated with future virtualised ATM scenarios before they are deployed.
Over time, SEC-AIRSPACE will establish a lasting foundation for cyber-secure virtualised ATM. Results from SEC-AIRSPACE will help ATM actors protect, detect, and react to potential cyber security threats, while at the same time reducing costs. The AI-driven training paths, tailored for each role in the organization, will, in the long run, reduce the time and overall costs of recurrent cyber-security training for employees in the ATM organisations. The main impact – increased cyber resilience - will be achieved when project results have been taken up and applied by stakeholders all along the ATM supply chain.
