The European Aviation Safety Agency signed on 10 February 2017 a Memorandum of Cooperation with the Computer Emergency Response Team (CERT-EU) of the EU Institutions. CERT-EU's mission is to support the European Institutions to protect themselves against intentional and malicious attacks that would hamper the integrity of their IT assets and harm the interests of the EU.
EASA and CERT-EU will cooperate in the establishment of a European Centre for Cyber Security in Aviation (ECCSA). ECCSA's mission is to provide information and assistance to European aviation manufacturers, airlines, maintenance organizations, air navigation service providers, etc. in order to protect the critical elements of the system such as aircraft, navigation and surveillance systems, datalinks, airports, etc. ECCSE will cover the full spectrum of aviation.
The actors of the European aviation system can become members of ECCSA on a voluntary basis in order to benefit from the services of ECCSA: intelligence from aviation related sources which will provide awareness of cyber-attacks and, on demand, operational means to face cyber security threats.
CERT-EU will make available cybersecurity tools and information for the development of ECCSA's specialized aviation cybersecurity components and services. EASA and CERT-EU will establish a close collaboration between their analysts' teams and will maintain an exchange information through ECCSA on threats affecting the sector, to contribute to the overall EU threat landscape and analyses of tactics, techniques and procedures.
"With this cooperation, EASA will develop its capability to handle cyber security threats in its mission and within its remit to improve the overall safety of air transport" said Patrick Ky, EASA Executive Director.
ECCSA's capabilities will be rolled out with a stepped approach in order to progressively implement the technologies, consolidate the operational procedures and allow a smooth handover of competences from the implementation team to the operational team coping with the daily activities. The first implementation phase foresees the development of the following tools and services in the period 2017 – 2018:
- A public website reporting cyber security news and ECCSA initiatives,
- Open Source Intelligence services for members,
- A collaboration platform for members to exchange sectorial cyber security information.
About ECCSA:
ECCSA will contribute to the safety of air travelers and the public by assisting in the establishment of acceptable levels of protection of its infrastructures: from design to decommissioning of aircraft; Communication, Navigation and Surveillance systems; and other critical services necessary to the safety of flight. This implies that the following actors will be part of the ECCSA constituency:
- Aviation manufacturers: aircraft, avionics systems or ground systems, etc.
- Aviation organisations: Airlines, maintenance repair organisations, aviation communication services providers, etc.
- Air Navigation Service Providers (ANSP): national and cross-border ANSPs.
In principle all the organizations relevant for the safety and security of European Civil Aviation may apply for ECCSA membership, provided that they meet applicable security criteria.
About CERT-EU:
The scope of CERT-EU's activities covers prevention, detection, response and recovery. The team is made up of IT security experts from the main EU Institutions (European Commission, General Secretariat of the Council, European Parliament, Committee of the Regions, Economic and Social Committee). It cooperates closely with other CERTs in the Member States and beyond as well as with specialized IT security companies.
