Airports are the bustling hubs of global travel, connecting people and goods to destinations around the world. Behind the scenes, an intricate web of operational technology (OT) systems keeps these facilities running smoothly. From baggage handling and passenger screening to air traffic control and runway management, OT plays a crucial role in ensuring the safety and efficiency of airport operations. However, this critical infrastructure is not immune to evolving cybersecurity threats. Here we will explore the key challenges of securing OT in airports and discuss mitigation strategies, as well as how these efforts align with the updated European Union's Network and Information Systems Directive 2 (NIS2).

Challenges in Securing OT at Airports

  1. Legacy Systems: Many airports still rely on legacy OT systems that were not designed with modern cybersecurity threats in mind. These outdated systems can be vulnerable to exploitation, as they lack the robust security features of their more contemporary counterparts.
  2. Complexity and Interconnectivity: Airports are vast ecosystems of interconnected technologies, making it challenging to identify and protect every potential entry point for cyber threats. The extensive web of sensors, control systems, and data networks creates numerous attack surfaces that must be secured.
  3. Remote Access: As airports strive for greater operational efficiency, remote access to OT systems becomes essential. However, granting access without adequate security measures in place can expose airports to risks, as cybercriminals may target remote connections.
  4. Insider Threats: Employees, contractors, and other personnel with access to OT systems can pose an internal threat. Whether intentional or unintentional, insiders can compromise security by exploiting their privileges.
  5. Vulnerable Supply Chain: OT systems often rely on third-party vendors for hardware and software. If any component of the supply chain is compromised, it can lead to vulnerabilities in the airport's overall cybersecurity posture.

 

Mitigation Strategies for Securing OT in Airports

  1. Risk Assessment: Conduct comprehensive risk assessments to identify vulnerabilities in OT systems. This includes evaluating the impact of potential threats and understanding their likelihood.
  2. Asset Inventory: Create an inventory of all OT assets and their dependencies. Knowing what's in your environment is the first step in securing it.
  3. Network Segmentation: Implement network segmentation to isolate critical OT systems from less secure parts of the network, reducing the attack surface.
  4. Security by Design: When updating or implementing new OT systems, ensure security is built into the design and development phases. This includes regular security testing and patch management.
  5. Access Control and Monitoring: Restrict access to OT systems and monitor user activity closely to detect any suspicious behavior. Implement strong authentication mechanisms, including multi-factor authentication (MFA).
  6. Training and Awareness: Educate employees and contractors about the importance of cybersecurity and their role in safeguarding OT systems. Establish clear guidelines for handling sensitive information.
  7. Supply Chain Security: Vet and monitor third-party vendors to ensure they meet security standards. Demand transparency and hold suppliers accountable for maintaining secure components.

 

NIS2 and the Alignment with Airport OT Security

The European Union's Network and Information Systems Directive 2 (NIS2) provides a framework for enhancing the cybersecurity of critical infrastructure, including airports. It mandates that operators of essential services, such as airports, implement effective security measures to protect their systems and data.

Securing OT in airports is directly aligned with NIS2 requirements. The key components of NIS2, such as risk management, security measures, and reporting incidents, map seamlessly to the challenges and mitigation strategies in this article. By complying with NIS2, airports can strengthen their cybersecurity posture and contribute to the overall resilience of critical infrastructure in the EU.

Conclusion

Securing operational technology in airports is a complex and ongoing challenge, but it is essential to ensure the safety and reliability of air travel. With the increasing threat landscape, it is crucial for airports to continuously assess, adapt, and improve their cybersecurity measures. By addressing the challenges and implementing mitigation strategies, airports can enhance their security and align with the NIS2 framework, ultimately safeguarding the skies for all passengers and cargo transported through their facilities.

 

To find out more contact: nathan.timbrell@fujitsu.com 

Not a member?
Take a look at our member benefits
Member benefits