Functional cyber-resilience - Extending the cybersecurity paradigm in critical infrastructures

The digitalization and connectivity is growing fast in many areas of society. This is also the case in critical infrastructures like Air Traffic Management systems. This will inevitably lead to an progressing technology dependency. Over the past years, the awareness has been improved, leading to an increasing attention for cyber-security challenges. In this paper, I will explain why this will not be sufficient in the long run to ensure business continuity. In addition to the risk coming from an increasing dependency, a concentration of technical infrastructures and a decrease of diversity can be observed. On the non-technical side the risk from geo-political differences are increasing as well. To address this, new, risk landscape, we need a different way of looking at system-wide risks. The risks and mitigation should be considered at a, generic, functional level rather than individual, technical, human and organisational levels.