Cybersecurity vs Operational Continuity

Implement Zero Trust Architecture under NIS2 critical-infrastructure obligations so cybersecurity operates invisibly without impeding time-critical ATM access.

CyberTRIZ analysis · Aviation contradiction A159 · one of 8,235 worked contradictions published by CyberTRIZ.AI

Regulations

EU_NIS2 IEC_62443 ISO_27001 ICAO_ANNEX_17

Business Context

Air Traffic Management has become increasingly dependent upon digital technologies including surveillance networks, controller workstations, flight data processing systems, satellite navigation, communication networks, weather information systems, and collaborative operational platforms. These interconnected technologies significantly improve operational capability while simultaneously expanding exposure to cyber threats capable of disrupting critical aviation services.

The Contradiction

Strengthening cybersecurity improves protection against cyberattacks, unauthorized access, data manipulation, and operational disruption. However, additional cybersecurity controls may increase authentication requirements, restrict operational accessibility, complicate system administration, and potentially delay time-critical operational activities. Reducing security controls improves operational accessibility but increases cybersecurity vulnerability.

Why It Exists

Air Traffic Control requires immediate access to operational information at all times, while cybersecurity frequently introduces additional verification, monitoring, and protection mechanisms that may influence operational responsiveness. Both operational continuity and cybersecurity remain essential and cannot be compromised.

Triz Perspective

Cybersecurity should become an invisible operational capability rather than an operational obstacle. AviationTRIZ encourages resilient digital architectures where security functions continuously without reducing controller productivity or operational responsiveness.

Solution Directions

Expected Benefits

Improved cybersecurity, uninterrupted operational continuity, reduced cyber risk, stronger regulatory compliance, enhanced controller productivity, increased digital resilience, and greater confidence in Air Traffic Management systems. ## ontradiction A160

TRIZ principles applied

P15 DynamicsP11 Beforehand Cushioning

Controls that address this (22)

EU_NIS2-CTRL-001 - Daily safeguarding reconciliationoperational · critical priority · Daily reconciliation between safeguarded customer balances, core ledger balances and safeguarded bank accounts. Variances above EUR 100 must EU_NIS2-CTRL-002 - Critical ICT incident reportingoperational · critical priority · All major ICT incidents impacting payment services, customer data or availability must be classified within 4 hours and reported under DORA EU_NIS2-CTRL-003 - GDPR breach notification workflowoperational · critical priority · Personal data breaches must be assessed within 12 hours and reported to the Belgian DPA within 72 hours where risk to data subjects exists.