Uncrewed Aircraft Systems (UAS) require a particularly high level of cybersecurity protection. Technical failures or deliberate interference can lead to malfunctions and, in the worst case, turn drones into a hazard for people and infrastructure. To address these risks, the industry association UAV DACH is working with Germany’s Federal Office for Information Security (BSI) to develop dedicated baseline IT security profiles for the commercial operation of uncrewed aircraft. The latest volume covering the Specific operating category has now been published.
As connectivity continues to expand across industries, the need for effective cybersecurity measures grows alongside it. In Germany, the Federal Office for Information Security (BSI) serves as the national cybersecurity authority responsible for creating the framework conditions for secure digitalization. In the context of drone operations, key challenges include third-party interference, data theft and unauthorized or malicious use.
Building Secure and Resilient UAS Operations
Digital interfaces are often the most vulnerable points in terms of IT security and cybersecurity. UAS environments contain numerous interfaces between the aircraft, control systems and payloads, creating multiple potential attack surfaces.
Providing guidance, recommendations and security requirements that help operators establish safe and resilient drone operations is therefore a core responsibility of the BSI. It is also a priority for UAV DACH.
Within the association’s Competence Group IT Safety & Security, experts work to identify structural and technical vulnerabilities and develop practical mitigation strategies. Their work covers all major mobile and stationary components of a UAS that are required for flight operations, maintenance and repair activities.
The group has also developed a reference architecture that illustrates how an operational security concept can be structured. The framework addresses facilities and physical spaces, computer networks and communications, IT systems and business processes, providing operators with a comprehensive approach to cybersecurity management.
