VDP in Aviation: Experiences and Lessons Learnt
Matt Gaffney recounts reporting critical vulnerabilities to aircraft manufacturers, analyzing why safety arguments are required to prompt aviation remediation.
Summary
Navigating Vulnerability Disclosure in the Aviation Industry
Disclosing software vulnerabilities in commercial aviation involves unique cultural and regulatory dynamics where standard CVSS severity scores often fail to prompt action.
The 'Features vs. Vulnerabilities' Mindset
Matt Gaffney reflects on disclosing vulnerabilities to an aircraft manufacturer in 2019, discovering that vendors frequently dismiss flaws unless direct airworthiness impact is proven.
Framing Cybersecurity in Terms of Passenger Safety
Gaffney explains how security researchers must translate technical findings (e.g. memory corruption) into measurable flight safety impacts to engage aviation engineers.
Recommendations for Modernizing Aviation VDPs
The author provides guidelines for both researchers and aerospace manufacturers to establish constructive, transparent coordinated disclosure pipelines.
Related talks
Aerospace Village·20 min
Jay Angus
Presents a practical checklist for researchers and aerospace vendors to coordinate vulnerability disclosures smoothly and build trust.
Creator Stage·21 min
Matt Gaffney
Shares firsthand experiences navigating vulnerability disclosure programs in the aviation industry, highlighting common pitfalls and best practices.
Voting Village·27 min
Tod Beardsley
Tod Beardsley examines the cultural shift in election vendor vulnerability disclosure, tracing progress from adversarial hostility to coordinated CVD programs.