One line of code, $1 million
If I asked you how much it would cost to change just one line of computer code in a device that's already in service, what number would come to mind? A few hundred dollars? Maybe thousands?
According to Aviation Today, it costs $1 million for a commercial airline to update a line of code in its planes. For a cost so substantial, they would likely need a compelling reason to take the steps required to make any update to their airplane's systems, which really got me thinking about a number of factors.
Breaking down the cost
While the article doesn't outline what comprises the $1 million cost, I think it's a viable figure. I'm not an expert specifically in airline software updates, but I can assume a few of the steps the airline is forced to take in this situation.
First, the airline needs to discover a flaw or vulnerability that necessitates the update. The cited example consists of research performed by the U.S. Department of Homeland Security (DHS) on a Boeing 757. The results - a remote hack after only two days of work - are more than compelling enough for any airline to take note.
From there, software developers need to analyze the findings, write new code, and test it in a safe environment to ensure the issue is fixed. Now comes the tricky part. The airline needs to ground each vulnerable or flawed aircraft, apply the new code, test it to ensure it works with that specific plane, and then recertify that plan for commercial flight.
According to airfleets.net, Southwest Airlines currently has 499 Boeing 737-700 planes in its fleet. Consider the time and money investment involved if a security flaw emerged in this particular plane model.
Not just an airline challenge
Clearly, airlines should have a vested interest in employing sound secure coding principles from the start. After giving it a few moments'thought, I could see numerous industries and situations where a similar cost might apply. Instead of worrying about airplanes falling out of the sky due to a hacked vulnerability, what about medical devices like pacemakers? How much does it cost to recall and update a half-million lifesaving pieces of electronics?
In the automotive industry, we continue to hear talk and security concerns about self-driving cars. Yet, even our "typical'vehicles rely more heavily than ever on connectivity to the internet, which leads directly to some troubling - if entertaining - safety concerns.
It's a simple fact that it costs much more money and takes more effort and time to update devices or systems after they've been released into a production environment, or before they've been mass produced, than it does to build security into your initial development process. Yet, we still continue to see new preventable software flaws and cybersecurity vulnerabilities every day, underscoring the need for companies to look for ways to build secure software development into their development culture.
The cost to change one line of code on a piece of avionics equipment is $1 million, and it takes a year to implement. For Southwest Airlines, whose fleet is based on Boeing's 737, it would "bankrupt" them if a cyber vulnerability was specific to systems on board 737s
Matias Madou, Ph.D.
Matias is a researcher and developer with more than 15 years of hands-on software security experience. He has developed solutions for companies such as Fortify Software and his own company Sensei Security. Over his career, Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon.
Matias holds a Ph.D. in Computer Engineering from Ghent University, where he studied application security through program obfuscation to hide the inner workings of an application.
Related Articles We Recommend
Related Articles We Recommend
Dive into onto our latest secure coding insights on the blog.
Our extensive resource library aims to empower the human approach to secure coding upskilling.
Get the latest research on developer-driven security
Our extensive resource library is full of helpful resources from whitepapers to webinars to get you started with developer-driven secure coding. Explore it now.
One line of code, $1 million
If I asked you how much it would cost to change just one line of computer code in a device that's already in service, what number would come to mind? A few hundred dollars? Maybe thousands?
According to Aviation Today, it costs $1 million for a commercial airline to update a line of code in its planes. For a cost so substantial, they would likely need a compelling reason to take the steps required to make any update to their airplane's systems, which really got me thinking about a number of factors.
Breaking down the cost
While the article doesn't outline what comprises the $1 million cost, I think it's a viable figure. I'm not an expert specifically in airline software updates, but I can assume a few of the steps the airline is forced to take in this situation.
First, the airline needs to discover a flaw or vulnerability that necessitates the update. The cited example consists of research performed by the U.S. Department of Homeland Security (DHS) on a Boeing 757. The results - a remote hack after only two days of work - are more than compelling enough for any airline to take note.
From there, software developers need to analyze the findings, write new code, and test it in a safe environment to ensure the issue is fixed. Now comes the tricky part. The airline needs to ground each vulnerable or flawed aircraft, apply the new code, test it to ensure it works with that specific plane, and then recertify that plan for commercial flight.
According to airfleets.net, Southwest Airlines currently has 499 Boeing 737-700 planes in its fleet. Consider the time and money investment involved if a security flaw emerged in this particular plane model.
Not just an airline challenge
Clearly, airlines should have a vested interest in employing sound secure coding principles from the start. After giving it a few moments'thought, I could see numerous industries and situations where a similar cost might apply. Instead of worrying about airplanes falling out of the sky due to a hacked vulnerability, what about medical devices like pacemakers? How much does it cost to recall and update a half-million lifesaving pieces of electronics?
In the automotive industry, we continue to hear talk and security concerns about self-driving cars. Yet, even our "typical'vehicles rely more heavily than ever on connectivity to the internet, which leads directly to some troubling - if entertaining - safety concerns.
It's a simple fact that it costs much more money and takes more effort and time to update devices or systems after they've been released into a production environment, or before they've been mass produced, than it does to build security into your initial development process. Yet, we still continue to see new preventable software flaws and cybersecurity vulnerabilities every day, underscoring the need for companies to look for ways to build secure software development into their development culture.
The cost to change one line of code on a piece of avionics equipment is $1 million, and it takes a year to implement. For Southwest Airlines, whose fleet is based on Boeing's 737, it would "bankrupt" them if a cyber vulnerability was specific to systems on board 737s
