# Smart Airport Cybersecurity: Threat Mitigation and Cyber Resilience Controls +
## 4 Online Survey Results  
An online survey questionnaire was addressed to the 200 busiest commercial airports in Europe and USA, although only one third of them had responded to the survey. Among them, we distinguished fully completed and solid questionnaires and we elaborated their results. Answers received from European airports reached 66%, while 34% came from USA as shown in Figure 1a. The airports have been further classified to Basic/Agile/Smart categories, according to their own statement about being or planning to be smart, in combination with the number of IoT applications that they have indicated to use in their facilities. This classification was chosen, in order to better evaluate the cyber-security preparedness level of airports, based on ICT complexity and technological progress. As a result, 16% of airports have been classified in the basic category, 56% were categorized as agile and the rest 28% of airports were ranked as smart airports, as presented in Figure 1b. Figure 1: (**a**) Source of airports’ replies; (**b**) Airports’ classification based on IoT apps. Although 59% of responders stated having effective cybersecurity policies for IT assets, when they were asked to rank the risks from IoT devices, the majority (76%) pinpointed the lack of security awareness as the greatest risk, followed by internet connectivity risk (29%), which reveals a controversy in security confidence of responders. Airports have defined which smart applications are using in their facilities that underpin key airport activities, as listed in Figure 2. The percentages, listed on the right side of Figure 2, are presenting the overall performance from all airport's answers received, while on the left side, the performance of smart airports is exhibited. As we can see, the most popular smart applications, used in all airports, are passenger check in and boarding services (41%), common use passenger processing systems (41%), while the least used are SCADA applications (6%) and connections with other transport systems (15%). Especially in smart airports, IoT applications like baggage handling, passenger check in, landslide operation controls, common use passenger services and traveler web services are found to be used in frequencies over 70%. Building Management Systems (BMS) and HVAC (Heating, Ventilation, Air Conditioning) equipment controls are also widely used in smart airports (60%). SCADA systems are in their infancy stage overall in airports. Only smart airports have stated to use SCADA with a 20% implementation rate. Since industrial IoT applications are in their emergence, a great expand is expected to transform mainstream busiest airports to smart airports. Research revealed that this early adoption increases smart airport's interoperability, along with vulnerability exposure to cyber threats [2; 7]. Security good practices and tools have been developed and published in literature [5; 6; 7; 13]. The identified practices for smart airports have been categorized into three main groups: (i) Technical good practices; (ii) Organizational good practices; and (iii) Policies and Standards. Figure 3 exhibits the technical good practices implemented in all airport's categories, based on survey answers and airport classification. An analytical description of these measures, along with survey responses per airport category, have been presented in our previous work [4]. As we can observe, the most implemented technical based practices for all airports are: (i) Firewalls and network segmentation; (ii) Software and hardware updates; and (iii) Disaster recovery plans. On the contrary, the least implemented technical based practices are: (i) BYOD: Bring Your Own Device Controls; (ii) Change default credentials; and (iii) Application security and secure design. Figure 2: IoT applications in airports. Smart airports have the greatest implementation rate of technical practices, reaching 70% on average, since advanced complexity of smart applications, requires advanced cybersecurity defense.