# Smart Airport Cybersecurity: Threat Mitigation and Cyber Resilience Controls +
## 5 Smart Airports Attacks: Scenario Development
### Attack Scenarios Analysis Along with Mitigation and Resilience Measures
#### 5.2.1 Malicious Attack: Distributed Denial of Service attack  
The main characteristic of smart airports is the networked, data-driven response capabilities through smart components and integrated IoT devices. Any smart device connected to airport's network may support crucial key functions of interoperability between aircrafts, airport administration, air traffic control, and other forms of communication. Distributed Denial of Service (DDoS) attack is one of the most interesting and widely seen cyber-attack in the recent times, as presented in Figure 7. In DDoS attack, a hacker temporarily enslaves a number of internet-enabled devices into an arrangement and then make simultaneous requests to a server or an array of servers for a specific service, thereby overwhelming the server and make it ignore legitimate requests from end-users. The Mirai Botnet code is an example of DDoS attack, which infects poorly protected internet devices, to find those that are still using their factory default username and password [23]. The effectiveness of Mirai is due to its ability to infect thousands of these insecure devices and co-ordinate them to mount a DDoS attack against a chosen victim. Successful DDoS attack can result in either access deny for the legitimate users or system's inability to distinguish legitimate users from fake ones. Impact Evaluation: Launch of a DDoS attack impacts the availability of smart airport's resources and services. The consequences are varied according to the time needed for recovery of business operations. This type of attack may lead to actions, like cancelation of flights, passenger delays, unavailability of cloud-based services, or even outage of staff communication systems. Such an attack happened in June 2015, at Warsaw Chopin airport, where approximately 1,400 passengers were grounded for five hours, while Polish airline was the victim of a DDoS attack [24]. Cascading effects: Once a smart airport's network is flooded and non-responsive to requests, many of its functionalities become unavailable. Some of the consequences of such unavailability may refer to the proper operation of passenger management systems, including kiosk devices or passenger check-in and boarding. Moreover, the domains of safety and security, as well as the Airline/Airside Operations may be vulnerable to this attack, as their operations are mainly based on the airport's network. Last but not least, the asset group of IT and Communications may probably be affected as it contains internet-connected assets. Indicative examples of these assets are cloud-based data and application services, passenger-airline communication systems, as well as common communication systems. Figure 6: Cybersecurity malicious threats categories. Mitigation Actions: Security hardening of airport's smart devices and IoT systems is a quite important mitigation action, as there is need for the reduction of the existing attack surface. This action can be achieved by changing default passwords, disabling services, closing ports, as well as regular patching of systems. Smart airport's network should be protected by firewalls and follow a defense-in-depth approach, in order the traffic between the network segments and hosts to be more restricted. Moreover, another way to protect against DDoS attacks is through volumetric protection from the Internet Service Provider (ISP). Most ISPs have the ability to automatically detect potential DDoS attacks and to filter/throttle back requests from possible sources. The ISP is then able to identify and mitigate abnormal traffic to only deliver 'normal' requests to the final IP address [22]. An alternative method of defense could be to have a secondary Internet connection and another IP range, so as to be used in a case of emergency, in order to secure airport operations. Resilience Measures: In order smart airports to react immediately to a potential DDoS attack, involves the combination of attack detection, classification and response tools, aiming to block illegitimate traffic.