The Canadian Centre for Cyber Security (the Cyber Centre) has published "The cyber threat to aviation", an unclassified assessment of cyber threats facing Canada's aviation sector. The document is one entry in a series of cyber threat assessments focused on the country's critical infrastructure. It carries the marking Unclassified//TLP:CLEAR, which the Cyber Centre explains is used when information carries minimal or no foreseeable risk of misuse. In plain terms: you can forward it, print it, and put it in front of your board without asking anyone's permission, subject to standard copyright rules.

The full assessment is available from the Cyber Centre at cyber.gc.ca.

The Cyber Centre names three intended audiences for the report:

• leaders in the aviation sector
• cybersecurity professionals with aviation infrastructure to protect
• the general reader with an interest in the aviation sector's cyber security

That is a wide net. A single document is being asked to serve a CISO at an airline, an engineer responsible for airport systems, and someone who simply flies a lot and reads the news. Readers in the second group should set expectations accordingly.

What the assessment does not contain is technical mitigation guidance. The document says so directly: for guidance on technical mitigation of these threats, readers are told to contact the Cyber Centre. The published contact for follow-up questions or issues is contact@cyber.gc.ca. An unclassified threat report that ends with "call us for the fix" is a bit like a smoke detector that beeps and then hands you a phone number. The beep is still useful. It's the part most organizations never get.

On methodology, the Cyber Centre states that its key judgements rely on reporting from multiple sources, both classified and unclassified, and that the judgements are based on the Cyber Centre's own knowledge and expertise in cyber security. Two things feed that expertise, according to the document. First, the Cyber Centre defends the Government of Canada's information systems, which it describes as giving it a unique perspective on trends in the cyber threat environment. Second, the foreign intelligence mandate of the Communications Security Establishment Canada provides what the Cyber Centre calls valuable insight into adversary behaviour in cyberspace.

That combination matters. Most threat intelligence that lands on a security team's desk comes from vendors who have a product to sell at the end of the PDF. This one comes from a body that watches government networks and has access to foreign intelligence, and it is releasing the sanitized conclusions for free. You will not get the classified sources. You will get judgements shaped by them. For a sector where the operational side runs on systems that were not designed with hostile networks in mind, that is a better starting point than most.

What this report does not yet cover is the substance of those key judgements. The portion of the assessment reviewed for this article describes the document's purpose, audience, classification, contact details and assessment base. It does not include the named threat actors, specific attack patterns, or any figures the Cyber Centre may present in the body of the report. Readers should not assume anything about the findings from this summary alone, and this publication is not going to fill the gap with guesses. Go read the full document. It's TLP:CLEAR for a reason.

The assessment also does not state any regulatory obligation, deadline, or penalty. It is a threat assessment, not a compliance instrument. Aviation operators looking for mandated controls will need to look to their actual regulators. What the Cyber Centre offers here is a picture of who might be coming and why, and an open door to ask for help with the how.

Identity and security teams at airlines, airports, air navigation providers and maintenance organizations should start by reading the assessment in full and mapping its audience and scope against their own environment. Then take an inventory of every account, human or service, that can reach operational and safety-related systems, and confirm that remote and third-party access to those systems is behind multi-factor authentication with no standing privilege left over from the last vendor engagement. Finally, take the Cyber Centre at its word: if the mitigation guidance isn't in the document, email contact@cyber.gc.ca and ask for it, because a free threat assessment you never follow up on is just a very well-sourced bedtime story.