# Smart Airport Cybersecurity: Threat Mitigation and Cyber Resilience Controls +
## 5 Smart Airports Attacks: Scenario Development
### Attack Scenarios Analysis Along with Mitigation and Resilience Measures
#### 5.2.4 Malicious Attack: Tampering with Airport Self-Serving Systems  
Airline companies foster the use of Common Use Passenger Processing System (CUPPS) to facilitate 24 h/7 days a week customer support and speed up check-in and passenger control processes via automated smart devices. Self-serving check-in infrastructures are being installed nowadays, being used and shared by multiple airlines, along with third parties which also have started to operate common services [7]. The majority of these devices run commonly used operating systems, firmware or proprietary software. Although these devices leverage intranet connectivity for accessing only content to company servers, they often provide remote management functionalities and they may be subject to tampering attacks, as they are exposed in public spaces. An attack scenario is exhibited in Figure 10. Such attacks can also affect various airport systems and SCADA equipment, from baggage handling and access control to air-conditioning and power distribution systems, which are widely distributed across airport infrastructures. While in the past these systems were air gapped, nowadays are networked and interdependent. Thus, smart airports are more likely to be victim of tampering attack, due to their adoption of IoT technologies. Los Angeles Airport has experienced a number of cyber incidents in the past, related to malware that targeted networked baggage systems [2]. Impact Evaluation: Successful tampering can result in the attacker having unauthorized access to the machine and potentially lead to privilege escalation. This enables attacker to change the behavior of the machine, both in terms of the customer facing actions and the interactions with other connected systems. Such an attack happened at Iran's Mashhad Airport, in May 2018, where hackers took control of the airport's monitors, in order to express their support to Iran Protests [33]. Disruption of CUPPS or SCADA systems may create inconvenience to passengers and impact airport's services availability and operational efficiency, such as creating flight cancellations, long passenger waiting queues and longer boarding times [7]. It can also impact integrity of information, for example facilitate the boarding of unknown passengers into the plane and lead to more serious security risks involving safety. Last but not least, tampering on airport devices may impact privacy and data protection, where privilege escalation can lead to loss of personal or sensitive passenger's data, such as passport, identity or credit card details. Figure 9: Malicious Software Installation. Cascading effects: Once an airport CUPPS or SCADA devices are compromised, the attacker may be able to infect other interconnected systems and related databases. The lack of logging and forensic capabilities of such systems prevents early diagnosis and response, undermining trust on system's provided services [22]. Except from any interruption of the provided service operation, a threat that arises here is the alteration of data, aiming at whatever act can compromise the safety of passengers, including potential terrorist facilitation. Although the majority of airports use segregated networks, depending on the effectiveness of the controls, cascading effects have the potential to impact the secure operation of Airside and Landside operations. Mitigation Actions: The most important mitigation action is to restrict usage of external media drives or wireless connections, disable unused services, so as to minimize equipment communication ports. Also, it is vital to provide along with network segmentation, the adequate physical security. Users shall ensure that unattended equipment has appropriate protection either with security guards, video monitoring or surveillance systems. Moreover, data encryption can minimize privacy risks, while Intrusion Detection & Prevention Systems (IDS/IPS) can support early detection and prevent further impacts on airport operational systems.