Business Continuity Management and Contingency Planning Needed to Mitigate Against Potential Cyber Disruption
The news cycle over the last 12 months has not been kind to airports. Despite managing record passenger numbers and investing heavily in improving operations, delays and disruption are far more interesting to readers. In September 2018, Bristol Airport reported a cyber attack on its Flight Information Display System leaving passengers without digital information about flight times and gate numbers. Other UK airports also experienced similar failures resulting in the use of whiteboards to help keep passengers updated. In December Gatwick Airport had to close its airspace, causing significant delays, due to drones being flown close to the perimeter. Heathrow and New York airports encountered the same scenario in January. Whilst both threats are very different – one a shutdown of flight information systems, the other a physical incursion into airspace – the result was the same, both resulting in significant disruption to passenger and airline operations, leading to financial losses and reputational damage.
Airports are also impacted by disruption to airline operations. The British Airways datacentre outage in 2017 led to chaos at several UK airports with over 600 flights cancelled. Although not a security related incident, the reliance on IT systems and processes meant that failure at a datacentre had a wide-ranging impact. British Airways was also the victim of a cyber-attack in 2018 which resulted in the significant loss of passenger data. This did not result in delays, but it did again lead to a lack of passenger confidence in air transportation due to the interdependent relationship between airports and airlines.
Regulation and counter drone technology should eventually solve the unmanned system issue and although this will not reduce the threat of drone collisions entirely, it should significantly lower the long-term risk. However, the vulnerability of information and operating systems in aerospace will persist and the threat will evolve as the pace of digital transformation continues and the air transportation ecosystem grows ever more complex. The data flows and shared operations between airports, airlines, ANSP’s (Air Navigation Service Providers), ground-handlers and even aircraft and engine OEMs, means that disruption in part of the chain can impact the entire ecosystem. If we take an example like the security operation, then an IT outage or cyber-attack to the increasingly networked screening and detection process could result in staff redeployment, manual security checks of passengers and flight delays.
The increasing connectivity and convergence of systems and processes within airports will continue to advance, leading to the evolution of both landside and airside operation systems. Check-in is becoming a remote process, with most passengers now checking-in from their device. Baggage operations may move that way over time with solutions such as AirPortr already offered by some airlines. As automation increases and driverless concepts become a reality, it is not inconceivable that autonomous vehicles will pick up greater quantities of luggage from passengers prior to arrival at the airport. Already the check-in desk is becoming outdated and increasing automation of bag drop means that passengers can now get to security on international flights without any human interaction. A single biometric token is beginning to make the entire process more seamless, with passengers using their mobile and passport to pass through security, boarding and immigration gates. All these systems are integral to airport operations and all could be compromised by IT outages or cyber-attack.
It is unreasonable to expect airports to prevent all cyber-attacks - they are far too complex, with many systems and stakeholders resulting in multiple vulnerabilities. Good security configuration and an array of cyber services to prevent and detect internal and external malicious actors will not provide 100% guaranteed protection. It is therefore critical that airports consider the impact of a cyber-attack on each operation and develop contingency plans to deal with the event. Airports have good experience of contingency planning to cope with adverse weather conditions or runway incidents. Coping with Irregular Operations is part of an airport’s DNA. However, cyber does provide an additional challenge insofar as an attack can impact the breadth of the organisation, its partners and take longer to remediate.
Airports should ensure that the benefits derived from digital systems are not negated due to the increased likelihood of a cyber-attack. Business Continuity Management (BCM) and Enterprise Security Risk Management (ESRM) should be central to the evaluation of threats, risk and response, but also needs to be accompanied by greater situational awareness in the airport and improved cooperation between key airport stakeholders. This includes the Business Continuity Plan (BCP), Crisis Management or Emergency Management Plan and Disaster Recovery Plan (DRP), together with IT tools and automation to help deal with an event as it unfolds.
Centralising operational data, establishing risk and automating contingency planning processes is a significant undertaking. Airports should balance this investment against organisational reputation. Customer loyalty takes time to build but can be lost quickly by a single IT event. Improved organisational resilience will help airports manage events more effectively, keeping passengers safe, informed and hopefully in the terminal a little less longer when a disruption does occur.
1. Airport cyber security must be a shared responsibility led by the airport but with all stakeholders contributing to the overall strategy and delivering against the policies. This includes a widely communicated BCM strategy that assesses the risk and impact of a cyber attack on all airport processes with plans stored digitally, updated and re-communicated regularly.
2. Digital and Physical systems are converging which means that processes are more linked. Airport situational awareness should evolve and provide a centralised operational command to detect, respond and recover to threats quickly and efficiently.
3. Globalisation of systems and processes requires the industry to collaborate across borders, sharing threat intelligence and best practices.