InfoSec Island

Why not? What is the crucial difference, from the unauthorised intrusion POV? "This should not happen, therefore it cannot happen" is not an appropriate response here. http://www.infosecisland.com/blogview/16696-FACT-CHECK-SCADA-Systems-Are-Online-Now.html

(Note that I didn't mention anything about webservers, or Internet; are you sure the in-flight entertainment systems are separated from the control network by anything else than a firewall rule? See other embedded systems, and how secure they are. Start with...IDK, Toyota's gas pedal code, see how well such safety-critical code was written: https://users.ece.cmu.edu/~koopman/pubs/koopman14_toyota_ua_slides.pdf )

Monitoring and support backdoors are common and pervasive in most networking gear. This isn't something that should be considered lightly.

There's been some hullaboo about Chinese manufacturers putting backdoor access into their devices, Huawei Technologies and ZTE Corporation particularly: http://www.infosecisland.com/blogview/21930-China-Has-Backdoor-Access-to-Eighty-Percent-of-Communications.html

Legally mandated backdoors exist on Cisco gear as well: http://www.forbes.com/2010/02/03/hackers-networking-equipment-technology-security-cisco.html

It's full name is the Certified Information Systems Security Professional. There's a good writeup of the problems with CISSP here:

https://infosecisland.com/blogview/15450-My-Canons-on-ISC-Ethics-Such-as-They-Are.html

and here:

http://erratasec.blogspot.com/2011/07/ethical-problems-of-cissp-and-isc2.html

It's often described as 'a mile wide and an inch deep'. However, it's not really the example of broad security knowledge it sets out to be and is considered a joke certification in my niche (technical security).