UAS cybersecurity

Why this matters

A medical delivery drone flying beyond visual line of sight (BVLOS) relies on computers and networks at every step, from receiving its flight plan to sending commands and returning video. If an attacker can forge commands or make the drone lose track of its position, the damage is not just to data: it is an aircraft falling on people, or medicine that never reaches a patient. The reviews by AlTawy and Youssef (2017) and Wang et al. (2023) therefore treat drone cybersecurity as a flight safety issue too.

UAT 105 covered the CIA triad and HMAC; this course moves on to analysing a real system as a whole. The whole course uses one hypothetical case: a BVLOS medical delivery network flying from a provincial hospital to three sub-district health centres, using dual C2 paths (radio and LTE) and connected to a traffic management provider in a trial area. All numbers are made up for practice. The Python code for every module can be downloaded from /downloads/uat-367/.

Attack surface and trust boundaries

The attack surface is every point where an attacker can send data into, or pull data out of, the system. Think of a house where every door and window counts, not just the front door. The medical delivery system has at least:

• The aircraft: flight controller, companion computer, USB and debug ports.
• The links: C2 radio, LTE, and GNSS signals received from space.
• The ground station: control software (GCS) on a laptop, user accounts and stored keys.
• Providers and cloud: the mission server, the UTM service supplier (USS), and patient data tied to parcels.
• The supply chain: firmware, libraries and hardware from manufacturers.

A trust boundary is a line where data crosses from a part we control to a part we cannot trust as much. For every flow across a boundary, ask: “Who sent this? Could it be altered on the way? Who can read it?”

Threat analysis with STRIDE

Shostack (2014) suggests walking through threats by category using STRIDE on a data-flow diagram. Each letter is a violation of one security property.

Once the threats are listed, score likelihood (L) and impact (I) from 1 to 5 and multiply to get a risk score. This is simple and explainable, but it is an ordinal estimate, not a real probability. Several knowledgeable people should score together and review regularly.

threats = [
    ("S", "forged C2 commands on an unsigned link", 3, 5),
    ("T", "mission route altered on the server", 2, 5),
    ("R", "no signed log of who aborted a flight", 3, 2),
    ("I", "LTE video and parcel data intercepted", 3, 4),
    ("D", "GNSS or radio jamming on the route", 4, 4),
    ("E", "admin rights gained on the GCS laptop", 2, 5),
]

def level(risk):
    return "HIGH" if risk >= 15 else "MEDIUM" if risk >= 8 else "LOW"

for cat, name, like, imp in sorted(threats, key=lambda x: -x[2] * x[3]):
    risk = like * imp
    print(f"{cat}  {name:<40} L{like} x I{imp} = {risk:>2}  {level(risk)}")

D  GNSS or radio jamming on the route       L4 x I4 = 16  HIGH
S  forged C2 commands on an unsigned link   L3 x I5 = 15  HIGH
I  LTE video and parcel data intercepted    L3 x I4 = 12  MEDIUM
T  mission route altered on the server      L2 x I5 = 10  MEDIUM
E  admin rights gained on the GCS laptop    L2 x I5 = 10  MEDIUM
R  no signed log of who aborted a flight    L3 x I2 =  6  LOW

Defense in depth

No single control stops everything. Defense in depth stacks controls so an attacker must get through every layer. Anderson (2020) warns that layers only help if they fail independently. If every layer depends on one password or on keys stored on the same machine, an attacker who obtains that gets through all layers at once.

layers = [
    ("network segmentation of the GCS", 0.30),
    ("MAVLink 2 signing", 0.05),
    ("command allowlist and geofence on the aircraft", 0.20),
]
p = 1.0
for name, bypass in layers:
    p *= bypass
    print(f"+ {name:<48} attack still succeeds with p = {p:.4f}")
print(f"about 1 in {1 / p:,.0f} attempts, if the layers fail independently")

+ network segmentation of the GCS                  attack still succeeds with p = 0.3000
+ MAVLink 2 signing                                attack still succeeds with p = 0.0150
+ command allowlist and geofence on the aircraft   attack still succeeds with p = 0.0030
about 1 in 333 attempts, if the layers fail independently

Class activity and lab

Common mistakes

Summary

• The UAS attack surface covers the aircraft, links, ground station, cloud and supply chain.
• STRIDE helps cover all six threat categories on flows that cross trust boundaries.
• L × I scores are for ranking, not probabilities.
• Defense in depth works when the layers fail independently.

Check your understanding

1. Which STRIDE category is intercepting LTE video?
2. A threat with likelihood 4 and impact 3 gets what score and level under the example’s thresholds?
3. Three layers can be bypassed with chances 0.5, 0.1 and 0.1. What is the chance of passing all of them (if independent)?
4. What is a trust boundary?
5. Why does storing the signing key on a compromised GCS weaken defense in depth?