登录查看更多内容

What are the most effective ways to address aviation information security risks?

由人工智能和领英社区提供技术支持

Information security is a critical aspect of airport management, as it affects the safety, efficiency, and reputation of the aviation industry. Cyberattacks, data breaches, and human errors can compromise the confidentiality, integrity, and availability of sensitive information, such as passenger data, flight plans, air traffic control, and airport operations. Therefore, airport managers need to implement effective strategies to address the information security risks that they face. In this article, we will discuss some of the most effective ways to do so.

此文章中的业界达人

由社区从 6 条内容中精选。了解更多

1 Identify and assess the risks

The first step to address information security risks is to identify and assess them. This involves conducting a comprehensive analysis of the airport's information assets, systems, and processes, as well as the potential threats and vulnerabilities that could affect them. Airport managers should use a risk management framework, such as the ISO 27005 standard, to evaluate the likelihood and impact of different scenarios, and prioritize the most critical ones. By identifying and assessing the risks, airport managers can gain a clear understanding of their information security posture and gaps.

添加您的观点

Agnidipta Sarkar

CxO Advisor | Digital Resilience Practitioner | Zero Trust Ambassador | Cyber Defense Expert | Standards Evangelist
举报内容
In my experience, you need to identify the context first. Different parts of airports have various computing complexities with varying security requirements, including IT operations dealing with customers handling their tickets, baggage, and boarding procedures. Then there are shops and third-party suppliers, and then there are OT operations that move baggage and manage the airport operations for flights. Thus, while identifying risks is essential, using more pervasive approaches beyond a single standard is vital. Assessment of cybersecurity risks must consider other standards like ISA62443, ISO27001 and NIST CSF. Airports are mission critical, hence assessing risks without considering cyber defence would leave huge gaps in cyber-security.

已翻译

赞
KAPIL NABAR

Independent Aviation Professional, Founder of N-Tourismpreneur, Founder of Kapil's Coffee, Contract Mfgr of Nutraceuticals, Cosmetics, VET Feed & PET Care, Ayurvedic, Home Care and Liquid fill Capsules, & B. Consultant
举报内容
Securing the skies is paramount in aviation. To combat information security risks: Education: Equip your team with robust cybersecurity training to recognize threats. Robust Policies: Develop and enforce strict information security protocols. Constant Vigilance: Regularly assess vulnerabilities and stay updated on evolving threats. Collaboration: Foster industry-wide cooperation to share threat intelligence. Technology: Invest in cutting-edge cybersecurity solutions to fortify your defenses. Incident Response: Prepare for the worst with a well-defined response plan. Culture of Security: Make information security everyone's responsibility, from pilots to ground staff.

已翻译

赞

加载更多内容

2 Implement and monitor the controls

The second step to address information security risks is to implement and monitor the controls. This involves applying appropriate measures to prevent, detect, and respond to the identified risks, based on the risk assessment results. Airport managers should use a control framework, such as the ISO 27002 standard, to select and implement the best practices for information security, such as encryption, authentication, backup, firewall, antivirus, and incident response. Moreover, airport managers should monitor and audit the effectiveness of the controls, using metrics, indicators, and reports, to ensure that they are functioning properly and meeting the objectives.

添加您的观点

Agnidipta Sarkar

CxO Advisor | Digital Resilience Practitioner | Zero Trust Ambassador | Cyber Defense Expert | Standards Evangelist
举报内容
Addressing information security risks requires a deep understanding of the airport's businesses and how they use information. In my experience, risk assessment without this context creates a gap in security design that goes unnoticed until a breach occurs. Thus, the second step should be validating a security architecture and design to ensure that the airport's businesses thrive because digital information is available when needed. This validation must come from the business stakeholders, especially those who manage the airport shops, baggage operations, security operations, and flight takeoff and landing. Identifying controls and operational procedures must happen after the security architecture and design including policies, are approved.

已翻译

赞

3 Train and educate the staff

The third step to address information security risks is to train and educate the staff. This involves providing regular and relevant information security training and awareness programs to all airport employees, contractors, and partners, who have access to or handle information assets. Airport managers should use a training framework, such as the NIST SP 800-50 standard, to design and deliver the training and awareness activities, such as courses, workshops, newsletters, posters, and quizzes. The training and awareness programs should cover the information security policies, procedures, roles, and responsibilities, as well as the common threats, risks, and best practices for information security.

添加您的观点

Agnidipta Sarkar

CxO Advisor | Digital Resilience Practitioner | Zero Trust Ambassador | Cyber Defense Expert | Standards Evangelist
举报内容
The third step should really be establishing the controls and operational procedures that can establish and security program and have mechanisms to measure and continuously improve it when faced with changes. Foundational security controls like microsegmentation that can be adaptive to cyber attacks and can contain them on demand must be the first on the agenda to establish mission critical assurance. The controls maybe mapped to international standards like ISO27001 Annex A, CSA CCM v4, CIS 8.0 or NIST CSF 2.0

已翻译

赞

4 Update and review the policies

The fourth step to address information security risks is to update and review the policies. This involves maintaining and revising the information security policies, standards, and guidelines, that define the rules and expectations for information security management at the airport. Airport managers should use a policy framework, such as the ISO 27001 standard, to establish and document the information security policies, based on the risk assessment and control results. Furthermore, airport managers should review and update the policies regularly, or whenever there are changes in the airport's environment, objectives, or requirements.

添加您的观点

Jonathan Daniels????

Fellow, ASTM | Serial Entrepreneur | Inventor | Designated Airworthiness Representative (DAR) | Remotely-Piloted Systems (UxS) Consultant | Scuba Dive Instructor| Retired Military Officer|
举报内容
Consistent and cyclical review os very important. The policies of three years ago may no longer address the issues of today. The introduction of IoT devices change policies about bluetooth usage, and many modern strategies use simple solutions (ie, filling USB ports in on laptops with epoxy to prevent unauthorized usage). There are new industry standards related to unauthorized electronic intrusions that are worth complying with.

已翻译

赞

5 Engage and collaborate with stakeholders

The fifth step to address information security risks is to engage and collaborate with stakeholders. This involves communicating and coordinating with the internal and external parties that have an interest or influence on the airport's information security, such as regulators, customers, suppliers, and service providers. Airport managers should use a stakeholder framework, such as the ISO 27014 standard, to identify and manage the stakeholders, and their needs, expectations, and feedback. Additionally, airport managers should collaborate with the stakeholders to share information, resources, and best practices, and to address common challenges and opportunities.

添加您的观点

6 Learn and improve from incidents

The sixth and final step to address information security risks is to learn and improve from incidents. This involves analyzing and learning from the information security incidents that occur at the airport, and implementing corrective and preventive actions to improve the information security performance and resilience. Airport managers should use an incident framework, such as the ISO 27035 standard, to report, investigate, and resolve the incidents, and to document and communicate the lessons learned and the improvement actions. By learning and improving from incidents, airport managers can reduce the likelihood and impact of future incidents, and enhance the information security culture and maturity.

添加您的观点

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Airport Management

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

What are the most effective ways to address aviation information security risks?

1

2

3

4

5

6

7

1 Identify and assess the risks

2 Implement and monitor the controls

3 Train and educate the staff

4 Update and review the policies

5 Engage and collaborate with stakeholders

6 Learn and improve from incidents

7 Here’s what else to consider

Airport Management

给文章评分

感谢您的反馈

更多Airport Management相关文章

更多相关阅读内容

What are the most effective ways to address aviation information security risks?

1

2

3

4

5

6

7

1 Identify and assess the risks

2 Implement and monitor the controls

3 Train and educate the staff

4 Update and review the policies

5 Engage and collaborate with stakeholders

6 Learn and improve from incidents

7 Here’s what else to consider

Airport Management

给文章评分

感谢您的反馈

查看其他技能