One line of code, $1 million

If I asked you how much it would cost to change just one line of computer code in a device that's already in service, what number would come to mind? A few hundred dollars? Maybe thousands?

According to Aviation Today, it costs $1 million for a commercial airline to update a line of code in its planes. For a cost so substantial, they would likely need a compelling reason to take the steps required to make any update to their airplane's systems, which really got me thinking about a number of factors.

Breaking down the cost

While the article doesn't outline what comprises the $1 million cost, I think it's a viable figure. I'm not an expert specifically in airline software updates, but I can assume a few of the steps the airline is forced to take in this situation.

First, the airline needs to discover a flaw or vulnerability that necessitates the update. The cited example consists of research performed by the U.S. Department of Homeland Security (DHS)  on a Boeing 757. The results - a remote hack after only two days of work - are more than compelling enough for any airline to take note.

From there, software developers need to analyze the findings, write new code, and test it in a safe environment to ensure the issue is fixed. Now comes the tricky part. The airline needs to ground each vulnerable or flawed aircraft, apply the new code, test it to ensure it works with that specific plane, and then recertify that plan for commercial flight.

According to airfleets.net, Southwest Airlines currently has 499 Boeing 737-700 planes in its fleet. Consider the time and money investment involved if a security flaw emerged in this particular plane model.

Not just an airline challenge

Clearly, airlines should have a vested interest in employing sound secure coding principles from the start. After giving it a few moments'thought, I could see numerous industries and situations where a similar cost might apply. Instead of worrying about airplanes falling out of the sky due to a hacked vulnerability, what about medical devices like pacemakers? How much does it cost to recall and update a half-million lifesaving pieces of electronics?

In the automotive industry, we continue to hear talk and security concerns about self-driving cars. Yet, even our "typical'vehicles rely more heavily than ever on connectivity to the internet, which leads directly to some troubling - if entertaining - safety concerns.

It's a simple fact that it costs much more money and takes more effort and time to update devices or systems after they've been released into a production environment, or before they've been mass produced, than it does to build security into your initial development process. Yet, we still continue to see new preventable software flaws and cybersecurity vulnerabilities every day, underscoring the need for companies to look for ways to build secure software development into their development culture.

The cost to change one line of code on a piece of avionics equipment is $1 million, and it takes a year to implement. For Southwest Airlines, whose fleet is based on Boeing's 737, it would "bankrupt" them if a cyber vulnerability was specific to systems on board 737s

‍