Importance Of Cyber Security

For Airports, There is No Silver Bullet for Cybersecurity

Cyber security has become the most pressing, yet most misunderstood, segments in IT. While advances in technology have allowed organizations to reduce the number of threats that get through, the damage caused by cyber attacks continues to increase. Further, complicating this, the amount of devices and systems that connect to networks is expected to increase by 200% by 2020 (Moor Insights & Strategy). Within an airport’s infrastructure “Cyber” typically covers various solutions from IT networks, computers, servers, industrial control systems (ICS), HVAC metering & monitoring, lighting, access control, passenger screening, closed circuit TV (CCTV), etc. While disparate, these systems

While this is a start, most have not deployed consistent security processes and procedures that address the rapidly expanding use of mobile computing, wireless, the Internet of Things (IoT)/Internet connected devices, and Bring Your Own Devices (BYOD)/personal equipment which is introducing not just more complexity but significant security vulnerabilities. For many airports, cyber security has become as important as physical security. Systems, data, and critical infrastructure must be protected. The exchange of data between these systems has increased exponentially, thereby creating the likelihood of a potentially damaging impact by a sophisticated attacker, terrorist organizations, bad actor countries, or disgruntled employees. However, it is estimated nearly 70% of all security breaches are caused by human

Part of this is understanding what actors and motives attackers use to justify their attacks including geopolitical and an understanding of system vulnerabilities. Additionally, airports must understand the targets and vectors (channel) an attacker would use to compromise internal systems.

Protect: Airports must make the investment to address and prioritize how they reduce their attack platform. Moreover, policies, and procedures to ensure countermeasures and resources are allocated and are being carried out. Security training curriculum and materials should be developed to ensure all (new) employees, tenants, and staff to understand how to ensure cybersecurity policies and procedures are enforced.

Detect: Ongoing monitoring and reporting standards must be implemented to detect anomalous activity of internal systems, human activity, and data breaches. Upon detection, policies and procedures must be in place to ensure attacks are communicated to the right people based on their level of access and relevance to their role within the organization. Further, it is important to maintain a log of all detected attacks to ensure administrators can identify anomalies and learn to predict attack patterns to improve response times and