# Smart Airport Cybersecurity: Threat Mitigation and Cyber Resilience Controls +
## 5 Smart Airports Attacks: Scenario Development
### Attack Scenarios Analysis Along with Mitigation and Resilience Measures
#### 5.2.5 Malicious Attack: Network attack to CCTV systems  
Digital surveillance systems are integrated nowadays with new ways to speed up airport processes and detect threats, including radio frequency identification (RFID) tags for tracking purposes, new thermal imaging scanning devices, intelligent closed-circuit television (CCTV) programs that identify unusual behavior and devices to detect chemical substances [34]. Digital surveillance and CCTV developments include video analytics nowadays, to increase the functionality and effectiveness of both CCTV and access control systems, while solving the inherent difficulties caused by the sheer size of airports and their perimeters. CCTV systems are becoming increasingly interconnected and interdependent with other airport information systems, introducing additional vectors of attack, due to their interconnectivity. Thus, CCTV systems can be exposed to similar vulnerabilities as computers  
Figure 10: Tampering with airport self-serving systems.  
and networked devices. Specifically, weak network security may allow attackers to open a backdoor and exploit software vulnerabilities, which can enable the attacker to gain unauthorized access, as presented in Figure 11. Malware could also be uploaded during patching and with the collaboration of compromised employees (i.e. insider threat). A successful attack on CCTV systems would then allow an attacker to monitor all physical airport infrastructures.  
Impact Evaluation: Compromised CCTV systems impact airport operation safety both in landslide and airside areas, which affects all security parameters: confidentiality, integrity and availability of security systems. In addition, in case that system administrators had to wipe the infected systems and reinstall the CCTV software, it's possible that a good deal of footage to be lost and the system will be rendered inoperable for a time, which creates a serious safety handicap.  
Cascading effects: Once a malicious actor has gained control of any CCTV device, this could lead to catastrophic impacts on airports safety. After a hacker has gained control, he could use the camera for hostile reconnaissance, or inject his own video stream, or even he could use the device to pivot into other devices on the same network; all of which would cause serious problems in airport security and airside operations safety.  
Mitigation Actions: The first mitigation measure is to avoid connecting any CCTV device directly to the Internet, since cameras or CCTV systems, which can be remotely accessible with port forwarding all inbound traffic, are quite vulnerable to malicious attacks. Effective measures are the use of VPN (Virtual Private Network), use of non-standard network ports, while enabling dual factor authentication controls, when using a remote access service. Change of default passwords in all devices is one of the basic precaution actions, along with disabling unused services and closed equipment communication ports. Also, it is vital to provide adequate physical security to remote devices with security guard patrols especially in the perimeter of the airport installations, which can be the Achilles heel (weak point) for airport's safety.  
Resilience Measures: It is important to provide redundancies, by keeping legacy systems in standby mode, being activated when needed to support any relevant incident. Efficient security training to all airport employees could make difficult any attempt to interfere with CCTV systems, while incident response capabilities for security staff should be developed and regularly tested. Finally, an effective contingency plan should be developed, implemented and tested to improve airports resilience.