Cyber security in airports

When it comes to cyber security, many organisations only have to consider their own physical, or logical, boundaries. They may have limited connectivity to a supply chain, but they can control who or what is able to access their systems. Meanwhile, airports have a more complex set of connectivity issues. Imagine a situation where a passenger arrives at an airport to find that their flight is delayed due to a cyber incident. Their initial reaction may be to blame the airport, but there are many other systems involved with getting passengers and their bags onto a flight, and getting the aircraft off the ground. For example, one might wonder what systems the check-in staff (handling agents) are tapping their details into, without considering that they may be using their own system — and what exactly a handling agent is and what relationship they have with an airport — or one may be aware that they are simply accessing a departure control system (DCS) that is hosted somewhere, not necessarily on the airport site. Who hosts the DCS and who maintains it, and contractually who owns the legal relationship between the DCS and the handling agent? This is not the airport but the airline with whom one is flying. Then, of course, the DCS providers host their systems and equipment in data centres, yet again run by third parties in many cases. This paper attempts to explain some of the issues associated with this complex set of relationships and sets the background for some of the challenges that airports face when it comes to cyber security.