Computer Network Security
for ASCs – A Panel Discussion
to Raise Awareness
Moderator and Panel Member: Dennis Treece, CSO, Massport
Panel Member:
Ray Boisvert, President / CEO, I-Sec Integrated Strategies
Panel Member:
Dave Aitel, CEO, Immunity
ACI/NA Fall Public Safety and Security Conference Toronto, Canada
Agenda
• The ups and downs of Internet Connectivity
• Update on Internet Threats and Internal Threats
• Airport systems risk: vulnerabilities, threats,
consequences
– What’s the worst that can happen if we have IT
security problems?
– What is the most likely thing that will happen?
• What we can do to decrease our risk, what
resources are available to help us?
Internet Facts – Internet Risk
• If you are on the Internet, you can access and are
accessible by 2.4 billion users
• Cell phone ownership is approaching the world
population of 7 billion – many are Internet capable
• Mobile networking is the growing trend - everything to
include your refrigerator and coffee maker will be
networked by the end of this decade
• We use the same transmission paths for banking, social
networking, entertainment, porn, shopping, C2,
government, and medical services, etc – how crazy is
that?
• The question we all face is this: How much of your life
and your airport do you want shared with 2.4 billion
people?
Can You Function Without the
Internet?
No, But . . . .
Private Networks and Air Gaps
• Whose Domain are you in?
• Private networks are not addressable on the Internet. They
begin with “10”, “172”, and “192”. They prevent Internet
exhaustion under IPV4 and allow companies to operate IP
networks internally without worries about address
allocation
• Air Gaps are physical gaps between your network or your
computer and the Internet – another name is “sneaker net”.
Airport Cyber Attack
• Istanbul airports hit by cyber attack
(07-26 17:24)
The passport control system at Istanbul Ataturk
Airport's International departure terminal is now
restored after being locked due to an alleged cyber
attack on Friday, while another airport in the Turkish
largest city was also affected.
Local news agency reported that passengers stood
in lines for hours and some lashed out at airport
officials, as planes' departures were delayed due to the
collapse of the system, Xinhua news agency reports.
Another Example
A Department of Homeland Security system used to conduct background checks may have exposed personally identifiable information of employees and contractors for nearly four years. The vulnerability, found in software provided by a vendor, was discovered by a DHS law enforcement partner, which informed the department this past week. Neither the vendor nor law enforcement agency was identified by DHS.
DHS, which says it addressed the vulnerability immediately, is investigating to determine what, if any, personally identifiable information may have been accessed by unauthorized individuals.
By Eric Chabow
In Gov Info Security, May 24th, 2013
Ray Boivert
Former Assistant Director, CSIS
President / CEO ISECIS
ACI / NA Public Safety and Security Conference, August 13th, 2013
Understanding the “other” threat to
airport security
Big, complex, unpredictable environment
Threats – difficult to define and identify: • Real or Imagined • Current or Emerging • Applicable or Distracting • Singular or Complex • Isolated or Connected • Meaningful or Irrelevant • Local, Broad or Global
Airports are NOT unique
…terror, intelligence, foreign manipulation & subversion…
Less considered Threats
– but the most “current and
contemporary”
Airports: “critical point” of C.I.
Previous: highjack and active shooter Today: sophisticated attack vectors
State Actors Organized Crime Terrorist Organizations Hacktivists Bots Insiders
Why?
Because airports matter!
- fifth dimension warfare (states) - hostage or fraud (organized crime) - disruption (Terror)
- subversion (non-state actors) - sites for infection (spammers) - advantage or revenge (insider)
Responding to Asymmetrical Threats Resilience is Value to Owners and Operators Shareholder Interests and Public Expectations
