  The sophistication and complexity of cyber attacks and the variety of
targeted platforms have been growing in recent years. Various adversaries are
abusing an increasing range of platforms, e.g., enterprise platforms, mobile
phones, PCs, transportation systems, and industrial control systems. In recent
years, we have witnessed various cyber attacks on transportation systems,
including attacks on ports, airports, and trains. It is only a matter of time
before transportation systems become a more common target of cyber attackers.
Due to the enormous potential damage inherent in attacking vehicles carrying
many passengers and the lack of security measures applied in traditional
airborne systems, the vulnerability of aircraft systems is one of the most
concerning topics in the vehicle security domain. This paper provides a
comprehensive review of aircraft systems and components and their various
networks, emphasizing the cyber threats they are exposed to and the impact of a
cyber attack on these components and networks and the essential capabilities of
the aircraft. In addition, we present a comprehensive and in-depth taxonomy
that standardizes the knowledge and understanding of cyber security in the
avionics field from an adversary's perspective. The taxonomy divides techniques
into relevant categories (tactics) reflecting the various phases of the
adversarial attack lifecycle and maps existing attacks according to the MITRE
ATT&CK methodology. Furthermore, we analyze the security risks among the
various systems according to the potential threat actors and categorize the
threats based on STRIDE threat model. Future work directions are presented as
guidelines for industry and academia.
