The Federal Office for Information Security (BSI) as a Major Player for Cybersecurity in Civil Aviation

Image : © AdobeStock/Nirut The Federal Office for Information Security (BSI) as a Major Player for Cybersecurity in Civil Aviation Cybersecurity in Civil Aviation Hendrik Dibbern Head of Division W 32 – Cybersecurity at Airports Hamburg Aerospace Lecture Series, October, 09th 2025 Bundesamt für Sicherheit in der Informationstechnik (BSI) https://doi.org/10.5281/zenodo.17722957 RAeS Hamburg in cooperation with the DGLR, VDI, ZAL & HAW invites you to a lecture DGLR / HAW Prof. Dr.-Ing. Dieter Scholz Tel.: 040 42875 8825 [email protected] RAeS Richard Sanderson Tel.: 04167 92012 [email protected] DGLR Bezirksgruppe Hamburg https://hamburg.dglr.de RAeS Hamburg Branch https://www.raes-hamburg.de VDI, Arbeitskreis L&R Hamburg https://www.vdi.de ZAL TechCenter https://www.zal.aero Hamburg Aerospace Lecture Series (AeroLectures): Jointly organized by DGLR, RAeS, ZAL, VDI and HAW Hamburg (aviation seminar). Information about current events is provided by means of an e-mail distribution list. Current lecture program, archived lecture documents from past events, entry in e-mail distribution list. All services via http://AeroLectures.de. The Federal Office for Information Security (BSI) as a Major Player for Cybersecurity in Civil Aviation Hendrik Dibbern, MSSc Head of Division Cybersecurity at Airports, BSI Date: Thursday 9 October 2025, 18:00 Location: HAW Hamburg, Berliner Tor 5, Hörsaal 01.10 (in-person only!) 2018 –2020 Master of Social Science (MSSc) in International Security and Law at University of Southern Denmark. 2020 Start of work at BSI in the area of Critical Infrastructure in the Transport Sector. Since 2023 Head of Division Cybersecurity at Airports (Referatsleiter W32 –Cybersicherheit an Flughäfen). The German "Federal Office for Information Security", in German: "Bundesamt für Sicherheit in der Informationstechnik" (BSI)is the German federal cybersecurity authority. During the last several years, it has been playing an increasingly larger role in the national air safety network. It acts as a cooperative partner together with different aviation organizations. Hendrik Dibbern will describe the role of the BSI in the field of Cybersecurity in Aviation. The BSI works in a field of tension between supervision and cooperation. It deals also with future regulations. Author: Heidas, CC BY-SA, Wikimedia 2 •Introduction of the German Federal Office for Information Security (BSI) and Division W 32 •Main tasks of Division W 32 •The current (Aviation) Cyber Threat Landscape •Beyond regulating stakeholders: IT-Grundschutz Profil for Smalland Medium-Sized Airports Topics Image : © AdobeStock/Azazul Introduction of the German Federal Office for Information Security (BSI) and Division W 32 4 Our Stakeholders State Business Civil society Science 4 Prevention Detection Response Adoption of technical protection measures National IT Situation Centre Technical support and services CERT-Bund and MIRTs Advice and service centre Co-operation Alliance for Cyber Security CI Implementation Plan (UP KRITIS) Support in training and further education Technical guidelines Certification IT security mark 1,785 Jobs 2024 Version information: 30.06.2022 Foundation 1 January 1991 Federal Ministry of the Interior Federal Office for Information Security Bonn Freital Hamburg Stuttgart Wiesbaden Saarbrücken Berlin Headquarter Brussels No training: 2% Mathematics: 6% Computer science 30% Natural sciences/ engineering: 21% Technology/Crafts: 8% Administration: 16% Economy 8% Law 3% Communication/ Media 3% Politics: 3% 237 Financial planning 2024 million Euro 5 Main Tasks of the BSI Institutional co-operation Research funding Operators and business Security Operations Technologies Manufacturers and products Classified information Digital consumer protection Cybersecurity basics and state of the art IT security of the federal government 8 Organisation of the BSI 6 Management Office President Vice President DG Z Central Tasks DG K Stakeholder Engagement, Digital Consumer Protection DG T Technology Strategy DG V Cryptography and Protection of Classified Information DG I Secure Infrastructures of Public Administration DG C Operational Cyber Security -Situation and CERT DG W Cyber Security in the Private Sector DG D Digitisation and Identities DG S Standardisation, Certification and Evaluation Department Z 1 Central Tasks 1 Department K 1 Digital Consumer Protection Department T 1 IT Systems Department V 1 Approvals of Classified Information Solutions Department I 1 Implementation Advisory of Information Security for Federal and State Governments Department C 1 IT Security Situation Department W 1 Cyber Security for Critical Infrastructures Department D 1 Electronic Identities Department S 1 Standardisation and Supervision Department Z 2 Central Tasks 2 Department K 2 Liaison Office and Legal Affairs Department T 2 IT Infrastructures Department V 2 Evaluation and Development of Classified Information Solutions Department I 2 Security of Critical Infrastructure Administration Department C 2 CERT-Bund Department W 2 Cyber Security for Enterprises Department D 2 Digitisation Department S 2 Certification and Labels Department T 3 Internal Digitalisation and Information Technology Department V 3 Centre of Excellence on Cryptography and Management of Classified Information Systems Department I 3 Detection Department W 3 Cyber Security in Civil Aviation Department D 3 Public Sector Identity Management Department S 3 Operational Evaluation and Centre of Competence 5G/6G 7 What is Section W 3 and Division W 32? Division W 31 Cybersecurity in Civil Aviation - Principles Cybersecurity for the Private Sector Directorate General W Division W 32 Cybersecurity at Airports Division W 33 Cybersecurity for Air Carriers Division W 34 Cybersecurity in the Aviation Supply Chain Cybersecurity in Civil Aviation Department W 3 Division S 33 Audits for the Private Sector 8 Categories of BSI Tasks Security Operations KRITIS support Support for providers of digital services Support for Big Businesses NIS II support Sector support Situation centre and situation IT Crisis Response Centre Incident support (CERT and MIRT) National Cyber Defence Centre (NCAZ) Cyber defence Vulnerability management Operators and Business Support for SMEs Security networks Investment restrictions Maturity assessment and certification Overview of the Individual Tasks Image : © AdobeStock/Azazul Beyond regulating stakeholders: IT-Grundschutzprofil for Small-and Medium-Sized Airports What is an IT-Grundschutz Profil? 16 •“baseline protection profile” based on the BSI IT-Grundschutz (State of the Art in Information Security) •Information Security Template for users (from users) •the usage of an IT-Grundschutz Profil is not a BSI requirement but a recommendation Core content: •a list of relevant targets (business processes, applications, IT systems and rooms); •a determination of the required protection level for the relevant processes and applications; •an assignment of the appropriate and existing IT-Grundschutz modules to the target objects (modeling) 17 Participants in the working group Besides BSI employees, staff of the following airports was involved: Münster/ Osnabrück Airport (FMO) Dortmund Airport (DTM) Hahn Airport (HHN) Nuremberg Airport (NUE) Memmingen Airport (FMM) Karlsruhe/ Baden-Baden Airport (FKB) Standard Protection procedure 18 Steps included in ITGrundschutz Profil for small and medium airports Structural Analysis 19 Extract from table 8 in the IT-Grundschutz Profil for small and medium airports Structural Analysis 20 Extract from table 9 in the IT-Grundschutzprofil for small and medium airports Structural Analysis 21 Extract from table 10 in the IT-Grundschutzprofil for small and medium airports Structural Analysis 22 Extract from table 11 in the IT-Grundschutzprofil for small and medium airports Extract from table 12 in the IT-Grundschutzprofil for small and medium airports Determination of protection requirements 23 Extract from table 13 in the IT-Grundschutzprofil for small and medium airports Modelling 24 Extract from table 16 in the IT-Grundschutzprofil for small and medium airports