# Smart Airport Cybersecurity: Threat Mitigation and Cyber Resilience Controls +
## 5 Smart Airports Attacks: Scenario Development
### Attack Scenarios Analysis Along with Mitigation and Resilience Measures
#### 5.2.7 Malicious Attack: Email Phishing and Social Engineering Attacks  
Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information. It is a confidence trick for the purpose of information gathering, fraud, or system access [35]. Phishing is typically carried out by email spoofing or instant messaging, which often directs users to enter personal information at a fake website, identical to the legitimate one. Social Engineering and communications, purporting to be from social web sites, banks, online payment processors or IT administrators, are often used to lure victims. Such a scenario attack is presented in Figure 13. Even though organizations can install filtering capabilities, phishing emails still may get through, since phishers can use images instead of text to make it harder for anti-phishing filters to detect them. Hackers are spoofing email sender addresses from major companies and services, tricking recipients into thinking the malicious message is from a known source. Also, evil-twins is a phishing technique, where phisher creates a fake wireless network, that looks similar to a legitimate public network. This can be found in an airport and whenever someone logs on to the bogus network, fraudsters try to capture passwords and/or credit card information [35].  
Impact Evaluation: Depending on the network privileges of IT devices all security factors can be serious impacted such as confidentiality, integrity and availability of airport operations. The degree of harm phishing attack is likely to cause is dependent on attacker's motivation and victim's organizational position and access privileges. A recent cyber-attack example, where ransom was attacker's motive, happened in September 2018, at Bristol Airport. As a result, the airport's information screens failed to operate for two days [38].  
Cascading effects: Once airport's authorization clearances and user access systems are compromised, the attacker depending on his motives can penetrate and attack other connected systems. Data alteration aims at whatever malicious act can compromise airport administration systems, where Airside and Landside operations may be infected causing passenger delays, cancelled flights and finally can jeopardize civilian's safety, including potential terrorist facilitation.  
Mitigation Actions: The mitigation actions require a combination of technological, process, and people-based approaches. These actions include anti-spoofing control, filtering, dual authentication, malware protection and other technical security measures. In addition, user training, security awareness, encouraging employees to \"Think before clicking a link\" and being suspicious regarding emails that look strange or very attractive, including invitations from social media. Email addresses should be carefully examined and filtrated, while IT security team should be notified accordingly. It is obvious that many infiltration attempts could be stopped as a result of recipients being suspicious, mistrustful and paying more attention.  
Resilience Measures: Phishing and social attacks work by exploiting weaknesses in human psychology and organizational culture. With security awareness and employees' training, it is feasible to create an environment, which empowers users to report incidents for helping and increase the reporting rate of suspicious emails. These incidents can be further investigated with the use of virtual environments and sterile sandboxes, so as to inform and alert all airport stakeholders, as well as increase systems cyber resilience.