Customised Detection & Reaction:
Lessons from TCAS, the Aircraft Collision Avoidance System
Imagine two aircraft flying at an altitude of more than 10,000 metres in the same area, both operating perfectly: nothing for the pilots to report, no anomalies, no compromise. They are exactly where they should be, proceeding smoothly along their assigned flight paths.
But what about when they are considered together?
There is a technology designed to answer this question: TCAS (Traffic Alert and Collision Avoidance System). TCAS is an airborne collision avoidance system. Its role is to monitor nearby aircraft—which must be equipped with transponders—and assess how their respective positions are evolving to identify a potential collision risk. It was designed to operate as a final safety net, independently of ground-based air traffic control systems.
Let me explain more clearly: knowing that other aircraft are nearby is useful, but it is not the most important information.
What really matters is determining whether two trajectories that appear normal when observed separately are creating a dangerous situation when considered together.
When this happens, TCAS comes into play and operates at different levels.
First, it may alert the crew through a Traffic Advisory: it identifies traffic whose position and evolution require attention. In practice, it puts the pilots on alert but does not yet indicate a manoeuvre to perform.
If the risk increases, TCAS II may issue a Resolution Advisory, indicating a vertical manoeuvre or a vertical speed restriction to increase or maintain separation.
In extremely concise terms, TCAS first observes the relationship between the trajectories of two aircraft, then assesses how that relationship is evolving and, only when specific conditions are met, moves from alerting to response.
So far, we are talking about detection and reaction—if you will allow the simplification.
In terms of the parallel with cybersecurity, the situation becomes even more interesting when both aircraft in our example are equipped with TCAS. This is because the systems “communicate” and coordinate their respective Resolution Advisories, adopting complementary vertical resolutions. In other words, if an upward response is selected for one aircraft, the other system narrows its options to a compatible downward response. Nevertheless, each system independently determines the intensity of its own Resolution Advisory based on the geometry of the conflict.
And do you know why? Because two systems that correctly identify the same problem but respond independently could make decisions that, when combined, fail to resolve it.
And do you know why? Because two systems that correctly identify the same problem but respond independently could make decisions that, when combined, fail to resolve it.
It is not enough to understand that something is happening, nor is it enough to decide quickly to intervene.
A response delivers real value only if it takes into account what is happening around it and the consequences it will have for the system as a whole.
At this point, the connection with cybersecurity becomes less unusual than it may initially have seemed.
When we think about IT/OT infrastructure, our immediate instinct is to look for an anomaly: an access event, a connection, a process or any other “anomalous” element.
When we think about IT/OT infrastructure, our immediate instinct is to look for an anomaly: an access event, a connection, a process or any other “anomalous” element.
However—to give just one example—a valid credential accessing an authorised resource may be entirely legitimate, just as communication between two systems may be legitimate. But when identity, asset, connection origin, time, sequence of operations and previous behaviour are considered together with that same activity, the overall picture—and therefore its meaning—may change.
It is much like the two aircraft: considered individually, there is no problem, but their relationship may tell a different story.
Let us explore the parallel with TCAS in greater depth.
Blocking a process, interrupting communication, isolating an endpoint or preventing access: these are all entirely reasonable actions in the event of an attack.
The problem, however, is that within an OT ecosystem, what happens next may be just as important as what we are trying to stop.
A communication may be used for lateral movement while simultaneously being required by an operational process. A compromised device must be contained, but before isolating it, it would be useful to know what it controls and what will happen to the rest of the infrastructure if it becomes unreachable.
Seeing and blocking are not always the perfect combination.
Seeing and responding according to the logic of the compromised OT environment—as a specialised technician familiar with that specific infrastructure and that specific OT endpoint would do—now that is the perfect combination.
This is one of the reasons why, within AGGER’s Automated Cyber Resilience IT/OT/IoT platform, we have worked on enabling detection and reaction to be customised down to the individual endpoint. Different assets may perform different functions, and the same threat should not necessarily trigger the same response everywhere.
Ultimately, TCAS does something very intelligent: it does not merely determine that two aircraft are getting too close. When intervention becomes necessary, it prevents the solution adopted by one from becoming a problem for the other.
This is exactly what I would expect from an automated reaction, especially in OT.
