I interviewed for a cybersecurity position with BA a little while back, it was a bit odd in general. I mentioned a few issues I thought were serious holes on their website, equivalent to the breach they ended up being fined for.
They said a pentest would find them if they were important.
I think we parted with both parties unimpressed with the other.
BA was the one who got pwned with a card skimmer script on their checkout page, so this tracks.
On the other hand, in-flight Wi-Fi "security" and actual company property security don't have anything to do with it. The in-flight Wi-Fi isn't protecting anything, it's just there as an annoyance to get a few extra bucks similarly to catering (and just like the latter, typically outsourced to a third-party which just allows them to white-label it).
Starlink-based ones have enough bandwidth for the whole plane to have workable bandwidth (just rate-limit based on client so no single heavy user hogs the entire bandwidth).
There's also an European one whose name currently escapes me which uses a custom flavor of LTE and special ground stations that also happily provides hundreds of mbps.
Capacity is primarily an issue on the legacy BGAN-based ones where you have a handful of mbps for the entire plane.
EAN is a joint venture between Inmarsat (now Viasat) and Deutsche Telekom. The system uses a combination of ground based LTE and satellite connectivity.
> They said a pentest would find them if they were important.
Is it just me, or are pentests about as useless as a UK home survey? Like, they're not going to move the furniture to look for issues.
I've experienced many companies who think due diligence is done by paying a 3rd party company to do the annual pentest. Meanwhile, the eng that actually work on the product, and know about potential issues, can't get leadership buy-in to invest in security.
They're not all bad. We're selling our house and the buyer's surveyor was incredibly thorough - he picked up on some small issues I'd never even noticed even though they were right in front of my eyes the last few years (nothing serious though). He was so good that I'd definitely use him for any future moves.
Pentests can be brilliant if you know the scope you want to have tested. The additional benefit being the business is more likely to pay (engineering time!) for fixes of the issues reported.
They said a pentest would find them if they were important.
I think we parted with both parties unimpressed with the other.