Cybersecurity remains high on the agenda and is a spending priority for both airport and airline CIOs, even though faster progress towards implementation of concrete cyber prevention and management initiatives remains a challenge, according to new research released by global IT provider SITA.
The 2018 Air Transport Cybersecurity Insights shows that 89% of airline CIOs plan a major programme around cybersecurity initiatives in the next three years, up from 71% last year.
This is even higher for airports, with 95% of them planning major programmes by 2021. Business continuity, through the protection of operational systems and processes, remains the priority for more than half (57%) of airline and airport executives.
As a result of the heightened focus, spend on cybersecurity is increasing year-on-year, reaching US$3.9 billion in 2018.
SITA’s research shows that airlines will spend an average of 9% of their overall IT budget on cybersecurity this year, up from 7% in 2017.
Similarly, airport investment in cybersecurity in 2018 is set to rise to 12% of their overall IT budgets in 2018, up from 10% last year.
The research also highlights that many executives are keenly aware that greater strides need to be made to implement proactive cybersecurity measures.
Barbara Dalibard, CEO, SITA, said: “The importance of cybersecurity is well recognised and airlines and airports are investing in building a solid security foundation. However, the number of cyberthreats continues to grow exponentially every year, as does the sophistication of those threats. Given the complexity and integrated nature of the air transport industry, we need to move far quicker in establishing proactive defences to ensure we stay ahead of the game.”
The most common cybersecurity spending priorities among airlines and airports today are; employee awareness and training (76%); achieving regulatory compliance (73%); and identity and access management (63%).
However, SITA’s insights identified several focus areas that need more attention over the next few years. These include proactive network monitoring and protection, securing the extended enterprise (Cloud, IoT) and protection from internal threats such as data leaks.
SITA’s research also indicates more can be done to raise the importance of cybersecurity. Today only 41% of respondents capture cybersecurity as part of a global risk register, while a further 42% of respondents plan to include cyber risk in their registers by 2021. Only 31% of the responding organisations have a dedicated chief information security officer, which is seen as crucial to ensure visibility of cybersecurity at executive level and effective implementation. Proactive monitoring through a security operations centre is also a core topic for many respondents with the majority having plans to quickly implement such services.
The biggest barrier to implementation is a lack of resources which affects 78% of air transport industry organisations. Another significant challenge executives face is the retention and recruitment of specialised skilled staff (47%) and the capacity for staff training (56%).
