Hi everyone,
Drones are increasingly being used by government agencies, public safety, and critical infrastructure organisations. However, there is more to consider when assessing the cybersecurity of drones.
Modern UAVs have many components that could contain vulnerabilities, including firmware, ground control software, radio communications, onboard storage and third-party components, which can result in sensitive operational data being compromised.
Key Cybersecurity Considerations
1. Firmware and Software Security
Out-of-date firmware, insecure updates, and vulnerable software dependencies may be present. Secure boot, signed firmware updates, vulnerability management, and software bill of materials (SBOM) should be considered.
2. Communication and Data Protection
The drones will contain information that needs to be protected through encryption, authentication, secure storage and access control. This includes telemetry, images, and mission information being sent between the aircraft and ground stations.
3. Supply Chain Security
As the components may come from a variety of manufacturers, it is important to ensure you have verified suppliers and are managing your software dependencies.
The Blue UAS Cleared List provides useful background on how drone cybersecurity assessments and government procurement requirements intersect. However, Blue UAS status and NDAA compliance are distinct considerations and do not replace independent security assessments.
4. Continuous Security Monitoring
Security assessments must resume in the field. Updates to firmware, newly discovered vulnerabilities, and modifications to the connected infrastructure.
Questions for the Community
- What cybersecurity controls should organisations consider when assessing government drones?
- How do security teams ensure the integrity of firmware and check for third-party dependencies?
- How might endpoint protection solutions such as Bitdefender be able to secure drone ground control stations?
I am keen to have some feedback from cybersecurity experts who have a working knowledge of connected industrial systems, endpoint security, or UAV security analysis.
Disclosure: I am affiliated with Zena Drone, which owns the linked website. The reference is for background and not the cybersecurity validation of the referenced site.
