Cities, Skies, and the Future Between

Cities, Skies, and the Future Between

Speakers: Abdullah Aljaber (Cybersecurity Advisor & Board Member, AJ); Badr Alogaili (VP of Cybersecurity, Flynas); Nora Aldeghaim (Senior Manager, Riyadh Airports)

Conference: Black Hat MEA

YouTube: https://www.youtube.com/watch?v=gADQphnYbds

Overview

In an era defined by rapid digital transformation, the integration of smart technologies into urban environments and aviation systems presents unprecedented opportunities alongside significant cybersecurity challenges. This panel discussion, "Cities, Skies, and the Future Between," convened at Black Hat MEA, brought together industry leaders to dissect the evolving threat landscape confronting smart cities, connected aviation hubs, and the critical infrastructure linking them. Moderated by Nora Aldeghaim, the session featured insights from Abdullah Aljaber, a cybersecurity advisor and board member, and Badr Alogaili, VP of Cybersecurity at Flynas. The discussion underscored a fundamental shift in cybersecurity perception, moving beyond a mere technical function to become an essential business and social enabler for national resilience and innovation.

The core premise of the talk revolves around the increasing convergence of physical and digital domains in our urban and aerial ecosystems. As cities become "smarter" with interconnected IoT (Internet of Things) devices and OT (Operational Technology) systems, and air travel relies more heavily on digital networks, the attack surface expands dramatically. This panel critically examined emerging risks, the friction between innovation and security, and the paramount importance of resilience, visibility, and collaboration in safeguarding these complex, interdependent environments. The insights offered are crucial for leaders tasked with protecting the foundational services that underpin modern society.

The significance of this discussion cannot be overstated. With nations globally investing heavily in smart infrastructure and future-forward urban planning – exemplified by initiatives like Saudi Vision 2030 – understanding and mitigating cyber risks in these interconnected domains is vital for economic stability, public safety, and national security. The panelists' diverse perspectives, spanning strategic advisory, aviation, and airport operations, provided a holistic view of the challenges and actionable strategies required to build a secure and resilient future for our cities and skies.

Background

▶ Watch: Introduction to smart cities & aviation cybersecurity panel (0:00)

The cybersecurity landscape has undergone a profound transformation over the past few years, evolving from a niche IT concern to a strategic imperative at the executive and board levels. This shift is particularly pronounced in the context of connected cities and aviation hubs, where digital services are expanding at an unprecedented pace. Historically, cybersecurity was often viewed as a support function, an afterthought to innovation. However, a series of high-profile incidents, such as the CrowdStrike supply chain attack (likely referring to the SolarWinds incident where CrowdStrike was impacted as a customer, or similar widespread supply chain compromises), have dramatically altered this perception. These events demonstrated the cascading impact of cyberattacks, affecting not just individual organizations but entire ecosystems and critical services, pushing cybersecurity to the forefront of business and national resilience discussions.

The problem arises from the rapid deployment of digital infrastructure and smart technologies – including IoT sensors, AI-driven systems, and OT networks – across urban services and air travel. This accelerated innovation often outpaces the development and implementation of robust security measures. The pressure to deliver new, efficient digital services quickly creates friction points, where security can be perceived as an impediment rather than an integral component. This dynamic leads to the emergence of entirely new risk categories that were not on the radar just a few years ago.

Specifically, the panelists highlighted the pervasive and growing threat of supply chain issues and third-party risks. Modern organizations, especially large entities like cities and aviation authorities, cannot operate in isolation. They rely on vast ecosystems of partners, suppliers, and service providers. A vulnerability or compromise within any link of this extended supply chain can directly impact the core organization, as demonstrated by incidents affecting critical services due to issues with trusted providers like Cloudflare (referring to past outages or security incidents impacting its customers). This interconnectedness, while enabling efficiency and innovation, simultaneously amplifies the attack surface and complicates risk management, making the traditional perimeter-based security model largely obsolete.

Key Findings

▶ Watch: Top emerging risk: supply chain vulnerabilities (4:18)

The panel identified several critical insights concerning the security of smart cities and connected aviation:

1. Cybersecurity as a Business Enabler: The most significant mindset shift is recognizing cybersecurity not as a mere technical or IT support function, but as a fundamental enabler of innovation, business continuity, and national resilience. Embedding security early in strategic discussions and innovation initiatives prevents costly retrofitting and bolsters the overall integrity of new deployments.
2. Supply Chain and Third-Party Risk Dominance: Supply chain attacks and third-party risks have emerged as top-tier threats. Organizations are heavily reliant on diverse digital infrastructures and external partners, making them vulnerable to compromises originating outside their direct control. These risks are exceptionally challenging to detect and remediate, necessitating robust Business Continuity Management (BCM) and resilience programs.
3. Friction Between Innovation and Security: The rapid pace of technological innovation (e.g., AI, IoT, OT) often leaves cybersecurity lagging. Security teams struggle to keep pace with new technologies and tools, creating friction points. The goal should be for security to support and enable innovation, rather than act as a barrier.
4. Strategic Flexibility in Diverse Infrastructures: Cybersecurity strategies must be highly flexible and adaptable to accommodate diverse digital infrastructures and varying business needs across different sectors. Proactive planning and embedding security into procurement processes are crucial to avoid higher costs and reactive measures.
5. Paramount Importance of Resilience: In environments that cannot tolerate downtime, such as airports and critical city services, resilience is non-negotiable. This involves avoiding single points of failure and developing comprehensive, service- and process-oriented BCM plans, rather than solely technology-focused ones.
6. 360-Degree Visibility is Essential: Effective security requires complete, real-time visibility into the entire ecosystem – "knowing exactly what is happening, where it's happening, and when it's happening." This means centralizing critical information, filtering out noise, and focusing on actionable alerts from diverse sources, including IoT, OT, and cloud services.
7. Collaboration Across Ecosystems: Security is no longer confined to a single organization. It spans entire ecosystems, demanding strong collaboration between aviation, city services, telecom, and other critical sectors. Initiatives like Saudi Vision 2030 and national regulators are driving tangible examples of such integration, fostering shared security responsibility.

Technical Deep Dive

▶ Watch: Toughest part of managing ecosystem security: third-party risks (8:30)

The technical challenges inherent in securing interconnected cities and aviation systems are multifaceted, extending beyond traditional IT security to encompass operational technology (OT) and the vast landscape of the Internet of Things (IoT). The panelists articulated that the "technical deep dive" in this context involves understanding the architectural complexities and interdependencies that define these modern ecosystems.

A primary technical concern highlighted was the diverse digital infrastructure that characterizes smart cities and aviation. This includes a myriad of systems, from legacy SCADA (Supervisory Control and Data Acquisition) systems in critical infrastructure to cutting-edge AI platforms managing traffic or flight operations, and countless IoT sensors collecting environmental data or monitoring assets. Each layer of this infrastructure presents unique vulnerabilities and requires specialized security considerations. The challenge is not merely securing individual components but ensuring the integrity and resilience of the entire interconnected fabric.

The pervasive issue of supply chain security was emphasized as a top five risk. Technically, supply chain attacks exploit vulnerabilities in third-party software, hardware, or services integrated into an organization's operations. This could involve malicious code injection during software development (e.g., the SolarWinds incident, which had far-reaching impacts), compromised hardware components, or insecure configurations in cloud services provided by vendors. Detecting such compromises is "extremely difficult" because they often originate from trusted sources, bypassing conventional perimeter defenses. Effective mitigation requires a deep understanding of the entire digital supply chain, rigorous vendor risk management, and continuous monitoring of third-party dependencies.

To counteract these intricate threats, the concept of resilience is paramount. Technical resilience involves designing systems to withstand and recover from failures or attacks without significant downtime. This translates into architectural principles such as redundancy, failover mechanisms, and distributed systems to eliminate single points of failure. The panelists stressed the importance of Business Continuity Management (BCM) plans that are "service and process-oriented," rather than solely technology-oriented. This means understanding how critical business processes flow across various technical components, including those managed by third parties, and designing recovery strategies based on these flows. For instance, an airport's BCM plan must account for the failure of an air traffic control system, passenger check-in, or baggage handling, and how these interdependencies impact the ability to maintain operations or rapidly restore them.

Visibility was presented as a cornerstone of effective security. Technically, achieving "360-degree visibility" requires aggregating and analyzing data from an immense array of sources. This includes traditional IT logs from servers and network devices, OT logs from industrial control systems, IoT device telemetry, cloud service logs, and security tool alerts. The challenge lies in consolidating this disparate information into a unified view, often through a Security Information and Event Management (SIEM) system or a Security Orchestration, Automation, and Response (SOAR) platform. The goal is to filter out "noise" and identify "important information when it's time and the alerts that you need to detect" to enable rapid threat detection and response. This demands sophisticated correlation rules, behavioral analytics, and potentially AI/ML-driven anomaly detection to make sense of the vast data streams. The complexity is further compounded by the presence of multiple cloud service providers, each with its own logging mechanisms and security tools, necessitating a strategy for unified log ingestion and analysis.

Finally, the discussion implicitly touched on DevSecOps principles, advocating for embedding cybersecurity "in even initial discussions of initiatives or designs or innovation." This technical approach integrates security practices throughout the entire software development and operational lifecycle, from design to deployment and maintenance. It means performing security architecture reviews early, conducting threat modeling, integrating security testing into CI/CD pipelines, and ensuring secure coding practices are followed, thereby proactively addressing vulnerabilities rather than reactively patching them after deployment. This is particularly crucial for the rapid development cycles often seen in smart city initiatives.

Demo / Proof of Concept

▶ Watch: Importance of process-oriented business continuity plans (10:30)

As a panel discussion focusing on strategic insights and high-level challenges, this session did not feature any live demonstrations, technical proofs of concept, or code examples. The format was dedicated to a conversational exploration of critical cybersecurity topics facing smart cities and aviation.

Defensive Implications

▶ Watch: Actionable takeaway: Embed cybersecurity in initial discussions (15:45)

The insights from this panel provide actionable directives for cybersecurity defenders operating within or collaborating with smart cities and aviation sectors. The core message is a shift from reactive security to a proactive, integrated, and ecosystem-wide approach.

1. Embed Security Early in the Lifecycle: Defenders must advocate for and ensure cybersecurity is an integral part of all strategic discussions, initiative designs, and innovation processes from their inception. This "security by design" approach prevents costly rework and bolsters the resilience of new technologies and services. This includes engaging with business leaders and engineers at the planning stages of any new IoT, OT, or AI deployment.
2. Prioritize Supply Chain and Third-Party Risk Management: Given the prevalence of supply chain attacks, defenders must implement robust third-party risk management (TPRM) programs. This involves comprehensive vendor assessments, contractual security requirements, continuous monitoring of third-party compliance, and establishing clear incident response protocols for supplier-related compromises. Organizations should also consider segmenting networks and services to limit the blast radius of a third-party breach.
3. Strengthen Basic Security Hygiene: Despite advanced threats, fundamental security controls remain critical. Defenders should relentlessly focus on perfecting patch management, accurate asset management (knowing all assets, their configurations, and vulnerabilities), and robust backup and recovery strategies. These foundational elements are often overlooked but are responsible for many successful attacks.
4. Develop Service-Oriented Business Continuity Plans: Cybersecurity leaders should collaborate with business units to design Business Continuity Management (BCM) plans that are centered on critical business processes and services, rather than just technology components. This involves mapping interdependencies, identifying minimum operational requirements, and developing alternative operational modes to ensure service delivery even during a significant cyber incident. Regular testing and refinement of these plans are non-negotiable.
5. Achieve 360-Degree Visibility: Implement advanced monitoring and logging solutions that provide comprehensive visibility across IT, OT, IoT, and cloud environments. This requires centralizing logs, potentially using a SIEM or SOAR platform, and leveraging analytics to identify anomalous behavior and potential threats. The focus should be on actionable intelligence rather than simply collecting vast amounts of data, ensuring that security teams can quickly detect and react to incidents.
6. Foster Cross-Sector Collaboration: Defenders must actively participate in and promote information sharing and collaborative defense initiatives with other sectors, including aviation, city services, and telecommunications. This could involve participating in Information Sharing and Analysis Centers (ISACs), joint threat intelligence platforms, and multi-organizational incident response exercises, building a collective defense posture against shared threats.
7. Cultivate an Adaptive Security Strategy: Recognize that the threat landscape is dynamic. Cybersecurity strategies must be flexible enough to accommodate new technologies, evolving business needs, and emerging threats. This means continuous assessment, regular strategy reviews, and a commitment to ongoing training and skill development for security teams to keep pace with innovation.

Key Takeaways

• Cybersecurity is a Strategic Enabler: Shift the mindset from viewing cybersecurity as a cost center or technical roadblock to recognizing it as an essential driver of innovation, business resilience, and national security.
• Prioritize Supply Chain and Third-Party Risk: Actively manage the profound risks posed by interconnected supply chains and third-party partners through rigorous assessments, contractual obligations, and continuous monitoring.
• Build Robust Resilience: Implement comprehensive, service-oriented Business Continuity Management (BCM) plans and design systems to avoid single points of failure, ensuring critical services can withstand and recover from cyber incidents.
• Demand 360-Degree Visibility: Invest in tools and processes to achieve complete, actionable visibility across all IT, OT, IoT, and cloud environments, enabling rapid detection and response to threats.
• Embed Security from Inception: Integrate cybersecurity considerations into the earliest stages of initiative planning, design, and procurement to proactively address vulnerabilities and prevent costly retrofits.
• Foster Ecosystem-Wide Collaboration: Actively engage in cross-sector information sharing and collaborative defense strategies to strengthen the collective security posture against pervasive and evolving threats.

About the Speaker(s)

Nora Aldeghaim served as the moderator for this panel discussion. She holds the position of Senior Manager for Riyadh Airports in the Kingdom of Saudi Arabia (KSA), bringing a critical perspective from the operational cybersecurity challenges faced by major aviation hubs.

Abdullah Aljaber contributed to the discussion from a strategic advisory and board-level viewpoint. He is a Cybersecurity Advisor and Board Member for AJ, offering insights into high-level governance and strategic planning for cybersecurity initiatives across various sectors.

Badr Alogaili provided an aviation and enterprise cybersecurity leadership lens to the conversation. As the VP of Cybersecurity at Flynas, he shared practical experiences and challenges in securing digital services within the airline industry.