Alex Hall leads Rolls-Royce’s product security division, which works to secure the company’s aerospace engines and other power and propulsion systems.
Ergo, don’t send her questions about securing your inbox. Instead, her group’s mission is to prevent attacks on systems embedded in the company’s products. The most recent high-profile example of the kind of attack they’re trying to prevent: the exploding pagers targeting members of Hezbollah.
“It seems likely the attack was several years in the making,” said Hall, who previously worked at the RAND Corporation. “The attacker in this case was very patient and prepared to invest a lot of time and money to achieve their objectives.
“This is the latest example of a growing trend: Attacks on products. It really focuses the attention on what my division does. On the flip side of that, the more examples we see of successful attacks on products, the more we expect this trend to intensify.”
Rolls-Royce began building its product security division about six years ago from scratch.
“Customers are asking for it and increasingly worried,” Hall said. “Regulators are becoming focused on it. Technology is constantly evolving, producing additional vulnerabilities. Plus, our adversaries are increasingly focusing on critical national infrastructure. And across all of our divisions, Rolls-Royce is critical national infrastructure.
“Morally and ethically, it’s the right thing for us to do. We can’t say our systems are safe if we can’t say they’re secure. And safety is paramount.”
Rolls-Royce is now working with external partners, including researchers at universities in the United States and United Kingdom, to develop tools and methods for engineers to ensure their products are resilient in the face of attack. And the company is designing training programs to spread this knowledge.
“Everyone in Rolls-Royce has a responsibility to keep the people using our products safe even if we don’t have safety in our job title. The same is true for security. Engineers have to help build security into our products, even if security is not in their job title.”