How Information Systems Infrastructure of an International Airport May be Secured Against

Introduction

There is a need to assess main cyber threats to an international airport’s critical information system in order to be in a position to address security needs of such an organization. In Ten Steps to Building a Secure Organization, John Mallery notes that to successfully address the security needs of an international airport, many professionals surrender to some very common misconceptions that a business may not be a target of malicious activities. He, however, cautions that any business connected to the Internet is a potential target to harm.

Security of international airports has been tightened since the 9/11 terrorist attacks in the US. The 9/11 Commission Report of 2004 holds forth if the government and the security apparatus in the country fully appreciate the threat that the Al Qaeda and other terrorist groups pose. Before the 9/11 events, airport security were not aware of any security weaknesses that could be exploited by Al Qaeda or any other terrorist organization. For example, the FAA allowed 4-inch long blades on flights, since they were not considered to be a security threat. An attempt to ban such weapons in 1993 was due to the fact that they created congestion, rather than posed a security threat. It is also interesting to note that the cockpit door was rarely fitted with a lock by most airline industries. This was, however, not to last as the 9/11 events changed the whole scenario. Nevertheless, it should not be assumed that there was no concern for physical security in the aviation industry before 9/11. The aviation industry was concerned about security, only that the 9/11 national catastrophe changed the enterprise level (The 9/11 Commission Report, 2004). According to the National September 11 Memorial and Museum, failure to imagine an imminent attack prevented the US from identifying security weaknesses that could potentially be exploited by terrorists to harm innocent citizens. However, they note that the 9/11 events made the US exposed to various threats even within its homeland. This prompted the US government to put in place tight security arrangements, as provided by the NCTA, National Commission on Terrorist Attacks.

Modern international airports face various threats, such as biological, nuclear and chemical attacks (Kerr, 2008). According to Medalia (2004), there is also a threat of foreigners detonating a nuclear device within the borders of the United States. However, these are just physical threats. Countries are also facing technological threats that pose danger not only to physical infrastructure but also people. It is important to realize that the government uses interconnected computers to manage public services and leverage technology for various services. There can be state-sponsored attacks to target citizens or deny them certain services, take control of some unbeknownst control systems of leadership or steal vital information. On June 9, 2011, the then director of CIA, Leon Panetta, in his hearing to Secretary of Defense acknowledged the likelihood of such attacks by saying:

“There is no question that the whole arena of cyber attacks, developing technologies in the information area represents potential battlefronts for the future… there is a strong likelihood that the next Pearl Harbor that we confront could very well be a cyberattack that cripples our power systems, our grid, our security systems, our financial systems, our governmental systems”.

According to him, there has been a shift in the asymmetrical threat from terrorist groups, such as Al Qaeda, to cyber attacks. However, this does not mean that Al Qaeda is not a threat anymore, but rather that cyber attacks against the US and its allies are growing in number. According to Bennett (2012), cybersecurity will be the number one threat for the aviation industry in the future.

Aviation Industry and Cyber Security

After the 9/11 attacks, the concept of airport security was altered forever. A lot of people were afraid of using planes, and the airline industry suffered heavy losses. As a result, the TSA, or the Transportation Security Administration, was formed and new technological advancements implemented at major international airports (Coskun & Hoey, 2005). The security arrangements put in place by the TSA were not meant to instill fear in passengers, but rather make the public more confident about flying. Commenting on the challenges facing an IT expert in trying to make an international airport safe, McAllister (2011) quotes Dominic Nessi, the then Deputy Executive Director and Chief Information Officer, as saying:

Organizations, including airports, are rapidly trying to balance the desire of users to have mobile applications and mobile hardware with the new security risks that they bring. The bottom line is that the hardware and new application evolve faster than the preventative measures that an organization needs to take can be developed. …The makeup of an airport’s system and the network make airports a target. Because of the types of systems that we have in an airport, we’re going to have a lot of exposure just by virtue of the system itself. We can mitigate our vulnerabilities through good cybersecurity measures (McAllister, 2011; 18).

According to Nessi, threats to international airports may be posed by airline websites, credit card information, passengers’ wireless devices, external airport operations, as well as systems required to perform airports’ internal operations. Nessi notes that some of the potential targets that face the threat include enabled aircraft systems, wireless and wired networks, access control and intrusion systems, as well as network-enabled systems. Human interference in software, hardware and connection points may result in providing access to such systems.

In view of the above, there is growing concern over how IT infrastructure of an international airport may be protected against cyber attacks. According to the Airport Consultants Council (2008), various systems, including an intruder detection system, biometrics systems, X-ray technologies, and enhanced body scanners, have been introduced to screen passengers and their luggage. It is also worth noting that individual airline companies have created new technologies that are able to identify passengers and check them in through kiosks as well as the Internet. Other airlines have developed new smartphone application technologies that are able to track flights, thus allowing for paperless boarding at the entrance. These companies have also made wireless Internet available at airport terminals and on flights. However, there are many other complex information technologies and systems that enable airports to efficiently and safely function on a daily basis (Airport Consultants Council, 2008). As we have seen from above, with improvement of physical security after the 9/11 attacks, there has been an increased use of new technologies in cyber attacks. According to the Transportation and Research Board, due to the complexity of different forms of businesses and their operations, airport IT systems have to consist of different types of technologies with different data owners and maintenance practices (Transportation Research Board, 2009). This paper will look into ways of protecting different systems and technologies, which is especially important in light of the increased number of cyber attacks against IT and security infrastructure of international airports.

Objectives of the Study

The main purpose of this research paper is to identify systems and technologies that can help an international airport counter cyber attacks. The paper will explain threats and vulnerabilities, as well as give recommendations on mitigation procedures. It will generalize the infrastructure of an international airport basing it on commonalities in passenger and employee experience. Some of the technologies that will be studied include: Radio and Communication, Networks and Web Services, Baggage Tracking and Inspection, Passenger Screening, Flight Tracking and Information Systems and Biometrics and Access Control.

Radio and Communication

There are many forms of radio and other communication equipment used at an international airport. Communication equipment, and especially VoIP (Voice over Internet Protocol), is particularly prone to cyber attacks. VoIP is a system that accepts voice transmission over telephone and converts it into a packet that travels over the network to different destinations, as directed (Airport Consultants Council, 2008). VoIP is especially preferred because it is a cost-effective and efficient way of communicating within a large environment, as opposed to using complex telephone lines. VoIP is vulnerable to cybercriminals because they can eavesdrop, collect and use confidential information for blackmail purposes. Criminals are known to conduct VoIP hacking attacks and compromise VLAN from remote locations and then use a computer to mimic an IP phone. They can then breach the network, spoof caller identification features or flood it with fake transmissions, thus disabling communications (Hickey, 2007). Employees should, therefore, be aware of this vulnerability and report suspicious activities over the network. Unsecured lines should not be used for discussing sensitive information.

Networks and Web Services

International airports have a complex wired campus network, which allows access of data through secondary and even tertiary distribution. Management of these networks is very critical to the operation of airports (Airport Consultants Council, 2008). Most of airports’ systems are connected to the campus network, and it is very important to secure such networks. It is vital, therefore, to have concrete security policies and train employees on network configuration and support of these policies. The policies will have to be coordinated with an outside airline network to ensure that breaches do not occur, even in the event of compromised internal security. For outside connections, they should meet minimum security requirements. Hard drives, emails and other items on the network should be encrypted using suitable materials and tools. Valuable assets on the network should be given a replacement cost and their security prioritized according to their value. Backup plans should also be put in place and practiced regularly (Miliefsky, 2007).

Until recently, airport personnel relied heavily on wireless networks. Therefore, Wi-Fi access points need to be secured, especially when there are different broadcasters located across different sections of an international airport. To enhance security of wireless networks, strict policies must be put in place, which clearly define who is allowed to broadcast services at a specific point. It is important that each network should define and minimize the physical radius of a wireless broadcast. In doing so illegal users will be prevented from connecting (Airport Consultants Council, 2008).

Baggage Tracking and Inspection

One of the most critical ground systems at an international airport is the Baggage Handling System (BHS). The BHS is responsible for tracking bags, as well as following flights and passengers to their destinations. According to the Airport Consultants Council (2008), unless the BHS is operational, all flights will be grounded, which will result in devastating effects for the affected airport. A study conducted by Airtight Networks in 2008 found that there are many unsecured users at an airport who can access the BHS through their computers. The report also found that even a wired BHS is still vulnerable, as servers can be patched and locked down. Clients, therefore, must have access restrictions, and the information accessed must be secured from potential intruders. Employees ought to be trained on the importance of securing peripheral devices and their passwords.

International airports have huge volumes of bags passing through them on a daily basis, hence the need to have a secure method of scanning baggage for dangerous materials, such as explosives.

If compromised, such a system may face devastating consequences. The Aviation and Transportation Security Act of 2001 requires all baggage to be screened with explosion detection systems, such as the Explosive Detection System (EDS) scanner. The EDS scanner uses Computer Aided Tomography (CT) to detect signature threats of explosives. After a bag is loaded into a scanner by TSA personnel, the EDS will indicate whether there is a threat. If there is no threat, the bag will move on, but if there is a threat, the machine will sound an alarm and the agent will review resulting images to determine if there is a need for further scrutiny of such a bag (McAvoy, 2011).

Passenger Screening

Passengers arriving at an international airport must check in by using a kiosk or airline ticketing desk prior to arriving at an airport. For individual airline ticketing in counters, passengers use the Common Use Passenger Processing System (CUPPS) that allows multiple airlines at a specific airport to share data on common workstations while tying the airline’s back-office systems. The CUPPS are only safe if the back-office systems and all their connections are safe, too. This means that if an airline system is not safe, CUPPS will be vulnerable. If compromised, passenger processing for the airlines will be affected, and so will passenger data. Passengers with a fake identification may gain a boarding pass by using a different name. Therefore, TSA agents must be vigilant during photo identification because illegal access to terminal is potentially very high.

Another passenger screening tool that has recently been used at most international airports is a full-body scanner. The scanner relies on Advanced Imaging Technology (AIT) that is similar to an X-ray machine used in hospitals. AIT can view objects hidden under clothes or even in a person’s cavities. Used by the TSA, these scanners are controlled by a computer program that may be susceptible to attacks. The images may be stolen or manipulated, or the scanner may lose power if there is an electrical fault. It is, therefore, important for the TSA to ensure that the computers on which the program is installed have passwords, biometrics and smart cards, as well as power backup supply to lessen any vulnerability (Swafford, 2011).

Biometrics and Access Control

Biometrics systems are peripheral devices used for indentifying a person by scanning unique body features, such as fingerprints. After identification, a file is used to check criminal databases that may be available against the person (Airport Consultants Council, 2008). According to Find Biometrics (2011), when added to the database, a fingerprint can be used to verify travel documents, as well as cross-border criminal databases. Some international airports also make use of eye iris scanners to speed up processing of passengers and enable faster access to information. Sometimes, a person may alter fingerprints by using multiple identification procedures. The biggest vulnerability that comes from using biometric systems at international airports stems from back-end databases. These systems can be easily accessed, unless firewalls are installed and properly secured and monitored. Therefore, the systems need to be password-protected, while default user accounts need to be deleted (Lee, 2006).

Another system frequently used by the TSA to control access at international airports is called the Badge Access System. Airport personnel wear badges that indentify their names, purpose and position, and can automatically allow or deny them access to various airport entry points (Airport Consultants Council, 2008). However, the badge system is also vulnerable, especially through its management by security personnel. Employees ought not to be given more access than required, and access must be monitored, while ensuring that restrictions are followed at all levels. However, the management should be aware that outside attackers can easily obtain a badge and gain access to restricted areas, such as airport terminals or even aircrafts. Therefore, badges must be used alongside with access to PIN or biometric systems to improve security.

Flight Tracking and Information Systems

International airports have various Flight Information Display Systems (FIDS) that allow passengers and airport employees to monitor current situation, weather information, aircraft delays and any other arising issues. The FIDS are connected to a range of databases from different airports (Airport Consultants Council, 2008). If databases that are feeding information to the FIDS are compromised, flight crews will not know where to park aircrafts, passengers will have no information on which gate to use, and thus airport operations will be disrupted.

Database exploitation usually occurs through spoofed client sessions, whereby an attacker devises database questions that help him gain access to restricted information. To hack into a flight information database, hackers may use a VBS script or a virus to perform illegal actions, such as deleting database information. By using a TCP attack and a password, hackers can easily gain access, because the information flows over complex collocated servers (Dulaney, 2009). In 2011, the Department of Transportation issued a warning saying that unauthorized users were able to gain access to FAA’s ATC tracking system because it was not securely patched (Hall , 2011). It is, therefore, important that servers are patched, backups are available, and access to systems is only granted to authorized personnel.

Conclusion

The paper has highlighted that an airport’s information system infrastructure comprises a number of complex and undetectable sources. Technological advances are taking place at a vigorous rate, and IT professionals should understand how to utilize them to protect airports from cyber attacks. Each of technological advances has its unique benefits and vulnerabilities. It is, therefore, vital for the management of international airports to ensure that the personnel working there is well-trained, security policies are in place and properly enforced, security systems are regularly checked for vulnerabilities and emergency backups are readily available.