Penetration testing of Surveillance Data Distribution System

Abstract

The objective of this paper is to introduce a comprehensive status of cyber security challenges in Surveillance Data Distribution System (SDDS). The cyber security is one of the essential issues of current Air Traffic Systems. It has been mandated by European Union law as well as national law. Therefore, EUROCONTROL as the provider of several tools or services (SDDS, IMPACT, EAD, ARTAS etc.), is regularly conducting a penetration testing in order to identify security vulnerabilities of each system. For this purpose, a grey-box assessment was conducted by EUROCONTROL’s security experts on the SDDS system in a development environment of EUROCONTROL’s data centre. The numerous vulnerabilities were found, mainly due to older version of operation system used by the system. They are currently mitigated by the fact that SDDS systems allows the network connectivity only to trusted partner. The next version of SDDS application will be addressing the most critical issues.