Digital future of travel at airports: navigating the evolving cyber threat landscape

As technology continues to advance, the digital transformation of the travel industry has revolutionised the way we navigate airports. From online check-ins and electronic boarding passes, to biometric identification and smart luggage tracking, airports have become increasingly reliant on digital systems.

However, this digital future comes with its own set of challenges, particularly in terms of cyber-security. As the cyber threat landscape evolves, airports must implement robust mitigations to ensure the safety and security of travellers and their data.

Auckland Airport is the third busiest international airport in Australasia. More than three quarters of all international visitors to New Zealand arrive here, with over 21 million passengers having travelled through our terminals in 2019.

At Auckland International Airport, our mission is to ensure the safety and security of all passengers, employees, and critical systems by maintaining a robust and resilient cyber-security strategy. We are committed to protecting the integrity, confidentiality, and availability of sensitive data, infrastructure, and services from evolving cyber threats that could potentially disrupt operations and compromise the trust of our stakeholders.

Evolving cyber threat landscape and mitigations for a secure digital future

The digitalisation of Auckland Airport’s processes has opened new opportunities for cyber-criminals to exploit vulnerabilities. Some of the top three key cyber threats that Auckland Airport faces include data breaches, ransomware attacks and Internet of Things’ (IoT) vulnerabilities.

1. Data breaches

Data breaches are on the rise globally, making information security and privacy a top priority for many businesses.

• Data loss protection policies and monitoring: today’s threats are more potent than ever, with employees cited as the primary risk. This trend, coupled with the expansion of data privacy laws around the world, has led to the growing realisation that enterprise information protection and management solutions are must-have tools for data protection and regulatory compliance, especially when dealing with customer data and information.

It’s only through robust information protection, a management strategy and layered, thoughtful security practices that one can protect an organisation and its data. Information security is the practice of defending information – in all forms – from unauthorised access, use, examination, disclosure, modification, copying, moving, or destruction.

There are numerous global and industry standards and regulations mandating information security practices for organisations. Information privacy, or data privacy, is the relationship between the collection/dissemination of data and the public expectation of privacy. The safeguarding of personal data, i.e., data about individuals such as contact information, health, financial, and other personally identifiable information, is the objective.

• Encryption and data loss prevention: at Auckland Airport, we have implemented encryption mechanisms to protect sensitive data, both in transit and at rest. Additionally, we have deployed data loss prevention (DLP) solutions to monitor and prevent unauthorised access or the transmission of sensitive information.

2. Ransomware attacks

Malicious actors may launch ransomware attacks, encrypting critical airport systems and demanding a ransom for their release. Such attacks can severely disrupt airport operations and cause significant financial losses.

At Auckland International Airport, we have implemented several key mitigation measures. These include:

• Regular data backups: backups are stored at more than one location, including an offline copy which is not accessible to the network during a potential attack. 
• Network segmentation: Auckland Airport’s network is divided into separate segments or zones to limit the spread of a ransomware infection.
• Strong access controls: we have implemented strict access controls to limit user privileges, ensuring only authorised personnel can access non-public labelled data. This includes National Institute of Standards and Technology (aligned password policies, multi-factor authentication (MFA), and a regular review of user access rights.
• Patch management: we maintain a rigorous patch management process to promptly apply security patches and updates to operating systems, applications and network devices. We regularly review and update software to address vulnerabilities that could be exploited by ransomware.
• Security awareness training and tabletop exercises: we have introduced regular security awareness training for airport staff to educate them about ransomware threats, social engineering techniques, phishing emails, and other common attack vectors. Encourage employees to report suspicious activities or potential security incidents promptly. In addition to regular awareness training, we complete tabletop exercises to technical and executive leadership groups to ensure processes, roles and responsibilities are clearly understood and actioned in a ransomware scenario (also known as an Incident Response Plan).
• Incident monitoring and detection: Auckland Airport’s environment has robust security monitoring tools that can detect suspicious activities and potential indicators of a ransomware attack. We have implemented real-time log monitoring, intrusion detection systems (IDS), and security information and event management (SIEM) solutions.

3. IoT vulnerabilities

With the increasing use of Internet of Things (IoT) devices in Auckland Airport (including smart infrastructure and connected security systems), vulnerabilities can be exploited to gain unauthorised access and disrupt operations.

• Device authentication and access control: Auckland International Airport has implemented strong authentication mechanisms to ensure that only authorised devices can connect to the IoT network. This includes the use of unique credentials, certificates, or biometric authentication for device access. Additionally, we enforce strict access control policies to limit device communication to authorised endpoints and prevent unauthorised access.
• Secure network architecture: we have designed the IoT network with security in mind by segmenting the network into separate zones, using firewalls or virtual LANs (VLANs), to isolate critical systems from potentially compromised IoT devices. We have also employed network segmentation to restrict communication between different types of devices, ensuring that compromised devices cannot directly access critical infrastructure. Operational technology (OT) networks are monitored and scanned continuously for suspicious activities using customised enterprise solutions.
• Vendor and supply chain management: at Auckland Airport, we have established a rigorous evaluation process for IoT device vendors (and in general, for all our partners), ensuring they have robust security practices in place. We prioritise vendors that provide regular security updates and who have a track record of addressing vulnerabilities promptly. We assess the security of third-party components used in IoT devices to prevent potential supply chain attacks.
• Vulnerability assessments and penetration testing: we regularly assess the security of IoT devices through vulnerability assessments and penetration testing. We identify weaknesses and address them promptly to ensure a robust security posture. Considering the specialised skills required, we have engaged with external security experts to conduct comprehensive security assessments.

By measuring cyber-security success through these key indicators and achieving notable milestones from the travellers’ perspective, Auckland Airport can inspire confidence with their ability to protect sensitive data and maintain a secure environment. Prioritising cyber-security not only safeguards the privacy and safety of travellers, but also safeguards the airport’s reputation and trust in the face of evolving cyber threats. Continuous improvement and adaptation to emerging risks is crucial in maintaining a robust cyber-security posture.

Exposure to risk

The digital future of travel at airports holds great promise in terms of convenience, efficiency and passenger experience. However, the increasing reliance on digital systems also exposes airports to evolving cyber threats. By implementing robust mitigations, such as comprehensive cyber-security frameworks, multi-factor authentication, employee training, encryption, network segmentation and continuous monitoring, airports can navigate the evolving cyber threat landscape and ensure a secure digital future for travellers. Collaboration and information sharing among industry stakeholders is crucial for staying one step ahead of cyber-criminals.