# Smart Airport Cybersecurity: Threat Mitigation and Cyber Resilience Controls +
## 5 Smart Airports Attacks: Scenario Development
### Attack Scenarios Analysis Along with Mitigation and Resilience Measures
#### 5.2.6 Malicious Attack: Misuse of Authorization  
Disgruntled employees, contractors or business associates having in possession access credentials may are able to misuse their authorization privileges and act as insider threat, aiming to steal  
Figure 11: Network attack on CCTV systems.  
information for personal gain or to benefit another organization. In addition, an intruder may gain access to airport's network, using Advanced Persistent Threat (APT) as presented in Figure 12, remaining undetected for an extended period of time, while escalating authorization privileges. The intention of an APT attack is usually to monitor network activity and steal data rather than to cause damage to the network or organization. To maintain access to the targeted network without being discovered, threat actors use advanced methods, including continuously rewriting malicious code to avoid detection and other sophisticated evasion techniques [35]. Some APTs are so complex that they require full-time administrators to maintain and restore the compromised systems and software in the targeted network.  
Impact Evaluation: Data which may be extracted are related to airport management and thus containing critical information for instance about airport vulnerabilities, airlines operation data or even passenger personal information. This can lead to large penalties, fines and loss of confidence. Data protection laws applicable worldwide, like the European General Data Protection Regulation (GDPR), provide severe penalties of up to 4% of company's global turnover. Such an incident happened in 2018 with British Airways, where personal and financial data of approximately 380.000 customers were exposed. The airline admitted this data breach, while claiming that between those data weren't any passport details or other sensitive personal data [36]. With compromised airport's administration systems, there is a serious impact on operational safety both in landslide and airside areas, which affects all security parameters: confidentiality, integrity and availability of airport's essential services and operational systems.  
Figure 12: Misuse of authorization with APT.  
Cascading effects: Since the infected device may have access to plethora of information, privilege escalation from threat actors, who have breached their target systems, including gaining administrator rights, offer them the ability to move around the enterprise network at will [19]. Additionally, they can attempt to access other servers, as well as other secure areas of the network, facilitating their malicious indents and targets. Compromising airport's systems puts at serious risk essential services and facilitates security attacks, causing civilian fatalities and serious financial losses.  
Mitigation Actions: An effective user access management should be in place for granting and revoking access to all information systems and services. In addition, the use of utility programs that might be able to override system and application controls shall be restricted and tightly controlled. A variety of countermeasures are also necessary, including data encryption and antimalarialware, in order to mitigate such attack's impacts [37]. Airport's cybersecurity team should focus on detecting anomalies in outbound data to see if the network has been the target of any APT attack.  
Resilience Measures: The continuous monitoring and audit of systems and log files are crucial for the resilience of smart airports, since the data loss prevention is enhanced. Thus, any unauthorized action made by malicious insiders is immediately detected and appropriate actions are implemented. Moreover, airport's employees and business associates should be granted the least level of privilege, and should be able to access only information that is needed, according to their working position and duties. Efficient security awareness and training to all airport employees could harden authorization misuse attempts, while incident response capabilities for security staff should be developed and regularly tested.