News: 1681446553

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

To improve security, consider how the aviation industry stopped blaming pilots

(2023/04/14)


To improve security, the cybersecurity industry needs to follow the aviation industry's shift from a blame culture to a "just" culture, according to director of the Information Systems Audit and Control Association Serge Christiaans.

Speaking at Singapore's [1]Smart Cybersecurity Summit this week, Christiaans explained that until around 1990, the number of fatal commercial jet accidents was [2]growing alongside a steady increase of commercial flights. But around the turn of the decade, the number of flights continued to rise while the number of fatalities began to drop.

According to [3]one analysis, [PDF] the rate of fatal accidents fell from nine per 10 million flights in the 80s to six per 10 million in the 90s. Between 1995 and 2001, that figure was three per 10 million.</p

[4]

“There was a big game changer,” Christiaans told the Summit. “Millions of people a day now fly in commercial aviation, and nothing happens.”

[5]

[6]

While acknowledging that improved technology, more mature processes and improved leadership all helped to improve aviation safety, the former pilot and field CISO at tech consultancy Sopra Steria said the biggest improvements came from a change to a “just culture” that accepts people will make mistakes and by doing so makes it more likely errors will be reported.

In a just culture, errors are viewed as learning opportunities instead of moral failing, creating transparency and enabling constant improvement.

[7]

“We're not trying to blame, we're not trying to point fingers, we're trying to find the reasons behind the mistake,” said Christiaans. “There are of course, exceptions like negligence where of course you will be punished by law. But otherwise, if you speak up freely, you will not be punished.”

He then drew parallels to cybersecurity, claiming it can learn from aviation to look for the reasons behind the human error and determine if the mistake is perhaps systemic.

[8]US govt watchdog barks at FAA over 737 Max inspectors' lack of qualifications

[9]Vessels claiming to be Chinese warships are messing with passenger planes

[10]US warns aging air-traffic control code won't be fixed until 2030

[11]Boeing to pay SEC $200m to settle charges it misled investors over 737 MAX safety

Christiaans said he is yet to come across a company that had implemented open reporting without punishment in cybersecurity.

He attributed this to the industry working from the top down. The people at the top worked hard to get to leadership roles and become resistant to change. Shifting culture therefore needs to start with new recruits.

“It's going to take a generation,” said Christiaans. “We start with the youngest and educate them. And then in eight years, they become captains and when they go into management they already understand.”

[12]

What the pilot turned CISO did not address is how those at the bottom can become empowered while controlled by leadership beholden to different KPIs.

Furthermore, not all of the aviation industry has been a beacon of transparent culture. For example, whistleblowers have [13]alleged that culture at Boeing emphasized profit over safety, ultimately leading to engineering decisions that caused the [14]crash of two 737 MAX airplanes.

“Boeing is not in a business where safety can be treated as a secondary concern,” wrote engineer Curtis Ewbank in a formal complaint. “But the current culture of expediency of design-to-market and cost cutting does not permit any other treatment by the work force tasked with making executive management’s fever dreams a reality.”

The problem goes beyond Boeing. The US Office of the Special Counsel (OSC) [15]alleged that the US Federal Aviation Administration (FAA) misled investigators checking whether FAA personnel were fully qualified to sign off Boeing 737 Max training standards.

But Christiaan’s analysis may be true at least when it comes to pilots and airlines, especially when culture is changed with small steps.

“So you plant the seeds, some airlines adapt, some don't," said Christiaans. "The ones who adapt, succeed.” ®

Get our [16]Tech Resources



[1] https://www.singaporetechnologyweek.com/smart-cybersecurity-summit-singapore-2023/smart-cybersecurity-summit-conference-programme

[2] https://accidentstats.airbus.com/statistics/fatal-accidents

[3] https://www.faa.gov/about/initiatives/maintenance_hf/library/documents/media/aviation_maintenance/ntsb_takes_unusual_step_to_address_plane_crash.pdf

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZDkkRWbJ8eeA9N9dxyJvYQAAABQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZDkkRWbJ8eeA9N9dxyJvYQAAABQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZDkkRWbJ8eeA9N9dxyJvYQAAABQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZDkkRWbJ8eeA9N9dxyJvYQAAABQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[8] https://www.theregister.com/2019/09/25/faa_737_max_inspectors/

[9] https://www.theregister.com/2023/03/20/vessels_claiming_to_be_chinese/

[10] https://www.theregister.com/2023/02/07/faa_notam_air_traffic/

[11] https://www.theregister.com/2022/09/23/boeing_sec_200m/

[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZDkkRWbJ8eeA9N9dxyJvYQAAABQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[13] https://www.nytimes.com/2019/10/02/business/boeing-737-max-crashes.html

[14] https://www.theregister.com/2021/12/15/boeing_737_max_senate_report/

[15] https://www.theregister.com/2019/09/25/faa_737_max_inspectors/

[16] https://whitepapers.theregister.com/



Blame Culture

ChoHag

Who's fault is that then?

Also see https://xkcd.com/1831/ but thanks for playing. Now maybe get back to flying the plane? Developers have been at it so you're going to want to pay attention.

Many years ago...

chuckufarley

...I worked for a major commodities exchange that also happened to be a non-profit organization. It was hands down the best environment I have ever worked in. Not only were the network and software highly complex, and the people that built all of it willing to share their wisdom with young PFYs like I was, but everyone knew that when you made a mistake you owned it as soon as you realized it. Sure, it took guts to stand up and raise you hand and say "I really screwed this up!" On the other hand that kind of honesty was good for everyone because it saved the exchange time and money. Having all hands on deck to over come a problem works so much better if everyone knows what the problem is and why it happened. Even if it means restoring data from a back up tape is the only solution at least everyone can do what they need to without sitting in a conference call for three hours. Service level agreements, big money clients, insurance companies, and more can be satisfied so much easier when the root cause is known to be human error from the start because then it's easier to correct the problem without down time.

Not only that, I learned that smart people are smart. Most problems have more than one solution and I saw many ingenious fixes and workarounds to issues that could have delayed the opening of international markets if the person that had made the mistake kept quiet about it. Image not having to play the blame game every time there was a problem. Imagine working in a place where the easiest way to get fired is making a mistake and not telling anyone. Imagine not being written up or fired for being a human being.

That's why when I go to the rare job interview these days I always start with "If I make a mistake I'll tell you right away and here is why..."

Re: Many years ago...

ComputerSays_noAbsolutelyNo

What was the underlying reason for this culture?

My take from your description would be money, or the potential of losing money.

For an commodities exchange, downtime would be quite a loss-maker.

So, you had an overarching goal (avoiding downtime) and everything else (personal ego, etc.) was subordinated.

This makes your case special in my view, because many IT businesses lack that sort of motivation.

For many IT businesses downtime is bad, but losing your personal data?

They have backups, so it's not really lost; and it being out there isn't a problem as long as the leak isn't attributable to them.

And even then, they promise to do better and simply carry on.

A Non e-mouse

If you've never made a mistake in your worklife, you're either lying or have never done a days work and I'm not interested in employing you.

(Of course, if you've never done a days work and are applying for your first ever job...)

CGBS

"The ones who adapt succeed." I've never heard anything so amazingly naive in my life. If you think Boeing needs to adapt to succeed, you are a complete and total brain dead idiot or....you are just gunning to be the next Boeing: too consolidated, too well connected and too vital to fail.

lglethal

Boeing used to be the king of the commercial aviation market. People only bought Airbus when they didnt have enough money to get Boeings. But Airbus upped their game massively, and Boeing didnt adapt (or it adapted the wrong way by simply cutting costs). Now Airbus are king of the commerical aviation market, and people only buy Boeing if they dont have enough money to buy Airbus.

If the current trend continues (and Airbus dont screw it up), Boeing will become an irrelevance in commerical aviation, at which points funds will dry up fast. The support and connections from the US government will only go so far. It wont collapse into nothing over night, but a steady selling off of anything profitable (probably to politicians friends) and a break of anything else into multiple smaller firms, will occur unless something changes. I'd give it 10-15 years, but if things dont change that's the direction it's going.

anothercynic

I think you ignore the massive defence industrial complex that Boeing is part of. Boeing Commercial might see a drop perhaps, but that it will break into smaller companies? Not a chance. The GOP will not let that happen because too many snouts are in the troughs that Boeing provides (and vice versa). I say the GOP because they are the party of supposedly smaller government but prove themselves incapable of reducing defence spending.

Boeing will survive on defence contracts. That's why they moved their HQ from Chicago to Arlington in Virginia, to be closer to the big trough that is government spending (and the Pentagon, and the various three-letter agencies). Seattle is... well... 'just' manufacturing (ditto South Carolina).

fnusnu

We'll know we are making progress in this direction when we stop blaming "human error". It's a meaningless labe akin to blaming car accidents on 'bad driving'

Pilot Error

fpx

In the end, a large proportion of aviation accidents come down to pilot error, unfortunately. Pilots have ultimate control over their aircraft and are in position to avoid accidents. Most aviation accidents would have been preventable, if the pilots hat acted properly. Unfortunately, that "proper action" is sometimes obvious only in retrospect.

Therefore, when an accident happens, there is a culture of questioning why it came to that, and why the pilots did not use their opportunity to avoid the accident. Were pilots given false, conflicting or misleading information? Were they distracted by an overload of concurrent events? Were they following a checklist, and if not, why not?

I encourage everyone to read NTSB aviation accident reports. They go into deep detail about what could have been done to prevent an accident. The reports do not blame the pilot, but investigate why pilots acted the way they did, and what should be done to assist future pilots in recognizing a similar situation, and to arrive at the proper action earlier.

This holistic approach to investigating incidents without attributing blame is something that we can all learn from.

Re: Pilot Error

imanidiot

The surface level reason for a lot of accidents is indeed "pilot error". But what aviation as a whole has worked on is looking beyond that and finding out WHY that pilot error happened. Well trained pilots rarely make unforced errors, there's often more going on. Could be bad, conflicting, unusual, incorrect training, instruments, ATC instructions, crew communications, weather, etc, etc. By preventing or mitigating the circumstances that led to the mistake, allowing the pilot to focus on the flying and get things right, the pilot error doesn't happen again. Arguably the 2 737 MAX crashes were "pilot error" because they should have correctly applied the runaway trim procedure and landed the aircraft. But they didn't, and unclear instrumentation, bad training and bad design conspired to steer them away from the correct solution and ultimately led to them losing control of the aircraft.

Re: Pilot Error

Christoph

" looking beyond that and finding out WHY that pilot error happened. "

The pilot misheard a message about waiting for takeoff and thought it was clearance for takeoff.

Fix: Aircraft now wait for 'departure'. The word 'takeoff' is used ONLY when giving or cancelling clearance for immediate takeoff.

Result: No more Teneriffe.

Re: Pilot Error

abend0c4

It's not just aviation. There's been a culture shift in Civil Engineering, too, where more time and energy could be spent in negotiating penalty costs between myriad subcontractors when things went wrong than on putting things right. See, for example:

https://www.constructionbusinessowner.com/management/beating-blame-game

imanidiot

"The people at the top worked hard to get to leadership roles and become resistant to change. Shifting culture therefore needs to start with new recruits."

I categorically disagree. Because the new recruits are never going to "get it" when the leadership doesn't accept just culture. This is a change that needs to come from the top (or at the very least from the middle management layer) and if the current leadership doesn't want to adapt they need to be removed and replaced.

Apart from stopping to blame pilots: regulation, and that's unlikely to happen

ComputerSays_noAbsolutelyNo

Being grounded by the FAA, or any other large aviation regulator, is a pretty strong incentive to stop ones planes from crashing.

However, I can not imagine any regulation nearly as strong in the IT sector, so the problem will persist.

It also doesn't help that bits and bytes are quite invisible. While it's hard to hide the crashing of plane, even those that simply vanish from the face of the earth create quite some media attention.

Your personal data gets stolen or simply leaks away from an IT biz?

Nobody will be any wiser until the data is up for sale on some forum or it is being actively used by malicious actors.

And even then, you have no indication who lost your data, or worse, the malicious use does not get noticed.

Cyber-security is inherently different to physical aviation safety. Massively so.

While there surely are valid lessons to learn from an established well-working safety-culture, I am afraid that the whole IT biz isn't susceptible to work safety consciously. After all, "move fast and break things" and "fake it til you make it" seem to be the among the driving dogmas of the industry.

Management response

trevorde

YOU'RE FIRED!

Elon Musk

National Health Service?

Anonymous Coward

Just imagine, we could spend money on caring for people instead of propping up a compensation industry.

If I don't document something, it's usually either for a good reason,
or a bad reason. In this case it's a good reason. :-)
-- Larry Wall in <1992Jan17.005405.16806@netlabs.com>