INTRODUCTION

Information security is an essential topic to any airports because it causes a huge loss and impact on the society. There are many control systems in an airport, and the report only focus on air traffic control system (ATC). The risks, mitigations strategies, risk management plan is analysis the technology problem and solution to the computer system of ATC. In this report, the hazard, financial and operational risks that cause by information technology vulnerability is assess in the first session. The second session discusses the risk management techniques for the risks that identify in first session. Lastly, the risk mitigation plan is discussed the critical business function and plans to deal with computer outage, power outage when the issues happen.

RISK ASSESSMENT

Activity, Asset, Data information, risk
The Air Traffic Control (ATC) is responsible for several activities in the airport. It involves separation assurance, landing services operating, navigation and ground control. Separation assurance is one of the main ATC components. It maintains the separation of aircraft from each other to avoid collision (Dwyer & Landry, 2013). The separation assurance tracks the position of each aircraft, and air traffic controller collects the information and provides it to the pilot. Both of automated tasks and manual tasks are involved in this function. The flights information such as identification, location and situation is recorded and used in the system. The separation assurance involves different facility such as radar and control tower. At the same time, this function is responsible for the safety of all the human life related to airport. The assets that can be affected by the system include common airport facility and human life. Landing service operation provides landing instruction and landing sequences to people. It ensures the aircraft to land safely and on time. This function requests the information of flight position, identification and weather condition to guide the landing or taking off. Risks in this activity can lead to serious hazard accident. The recent example is the Asian Airlines plane crash-landed in July 2013(Keane, 2013). The damage includes physical asset, financial asset and human life. Navigation tasks provide a guide or signal to the aircraft at daytime, night times or bad weather condition. This technique involves several communication facility and systems. The most important information at this activity is the flight location and map. Ground control is an activity that allows airport to control the aircraft position and runway safety. Moreover, each aircraft should have its own terminal or parking space. Further, presence of any person or object on the runways while the aircraft takes off or lands is a matter of safety issue for both the aircraft and such person or object. Table 1 lists all the risks that associated with the activities, assets and data information. Such risks in ATC system can lead to loss on financial assets and physical assets. More importantly, it could cause the loss of human life. Base on the research on Brisbane Airport (2006), the probability of aircraft incident that cause by the system error are very low nowadays. Therefore, there are no high-risk areas in the air traffic system. However, cyber attacks (Egozi, 2013) and human error still can play a serious safety and property loss on airport industry. In addition, the risk on traffic management place on airport operation and financial asset still remains important to airport.

Table 2 presents the risk analysis for all the risks and mapping the risks that is identified.

Airport Control

To protect and prevent the loss in airport, several control are use in the airport system. Validation and authorization technique are use most commonly to defence the unauthorized access or hacker. The airport also uses encryption, firewall, anti-virus software to prevent the risk from hacker or unauthorized access. Security camera and video are used to monitor the ground situation. However, for human error or system capacity problem, airport industry usually takes standards. Table 3 below illustrates the in-place control.

Table 1.
Mapping between activity, asset, data information, threat, vulnerability and risk

ID | Activity | Asset | Data Information | Threat | Vulnerabilities | Risks | Example/ References | 1 | - Separation Assurance- Landing Service Operating- Navigation-Ground Control | Server, runways, human life, systems, financial assets, good wills | Part of flight information are not able to record and send | Limitation on computer capacity such as database, network and storage | Unable to handle/process large amount of data in a quick time | Database, network or computer outage | Network outage in airport lead to air flight delay in McCarran International Airport (Velotta,2013) | 2 | - Separation Assurance- Landing Service Operating- Navigation-Ground Control | Whole ATC system, financial asset, human life, reputation | All flight information will not available | Cyber attack on critical infrastructure, include DoS attack, sabotage, or obtains secret information | Week instruction detective system and lack of security and regular audite.g. Allow executing remote command | Aircraft do not receive information from airport and not able to land safety. | Phantom aircraft created by hacked give collision message to pilot (Mark, 2011)Ghost aircraft in controller screen | 3 | - Separation Assurance- Landing Service Operating- Navigation-Ground Control | Financial Asset, Reputation | All data will not available | Power outage in airport | Lack of efficiency backup system and no external power generator | Airport Shut down or flight delay | In July 2011, thousand of flight delay in airport because of power outage(ABC new,2011) | 4 | Landing service, Navigation, Separation assurance | All facility and human life | Flight information: location of aircraft, map, and others | Controller mistakes | Inadequate staff management processNo system detect/check on manual control | Error signal send to aircraft lead to collision | O Hare airport in Chicage report near miss of 2 american airlines planes due to controller error resulting from the assignment of an incorrect plan designator. | 5 | Ground control | Airport Facility and building, Financial asset, human life | Runway information | People/rubbish in runway when landing | Week runway monitor system | Hazard accident by dangerous landing and departing or loss of human life or property in runway. | At August 2013, Indonesian plane skids off runway after hitting 3 cows in runway (France-Presse,2013) | 6 | - Navigation- Landing services-operating | Runway, financial asset and reputation | Map, aircraft location | Bad weather condition | Week/show aircraft management plan and lack of facility to support navigation in bad weather | Hazard incident, flight delay | The 2012 Aero-Services llyushin II-76 crash because of the heavy rain in MayaMaya airport.(Flight Safety Foundation, 2012) | 7 | - Separation Assurance- Landing Service Operating- Navigation-Ground Control | ATC systems | All flight information and security information | Unauthorized access to the System/domain/network by stolen the login or accidently | No detective system | Information are stolen by hacker and terrorist attack | FAA found 763 of vulnerability that provide immediately access to the system (Lindner, 2009) | 8 | - Landing services- Separation assurance | Financial asset, reputation | Flight information | Limitation on airport capacity at particular time | -Week management plans- No extract airport or space | Aircraft delays | Flights cannot be started or completed on schedule because of the queue of aircraft awaiting their turn for takeoff, landing, or use of taxiways and gates at terminal buildings. | 9 | - Separation Assurance- Landing Service Operating- Navigation-Ground Control | Air Traffic System | All information in the software | Virus | - Week anti virus system | Airport does not able to operate and information unavailable to aircraft | Computer virus creates havoc at Houston airport at 2003.(ABC13 Eyewitness News) | 10 | - Separation Assurance- Landing Service Operating- Navigation-Ground Control | Financial Asset. Reputation | All security information | Attack from disgruntled or former employee | - Week security system for internal human resources | Not able to provide navigation and instruction to aircraft and need to stop the operation | Former employee can damaged the system | 11 | - Separation Assurance- Landing Service Operating- Navigation-Ground Control | Reputation, financial assets, landing information | Instant communication information | Loss connection in the communication system because of broken facility | - No backup plan | No instruction given to aircraft lead to collision | 20 air traffic control centers that were downed by a single fiver cable cut on May 4, 1991(Neumann, ) |

Table 2. Risks Rating

Risk ID | Consequence | Risk level | | Business Operation | Safety | Hardware, software, facility and financial assets | | | Description | Impact | Likelihood | Description | Impact | Likelihood | Description | Impact | Likelihood | | 1 | Shut down the airport | 5 | 0.1 | Emerge landing by pilot may lead to safety issue | 7 | 0.1 | System crash because of the issue | 5 | 0.1 | 0.56 /10Small | 2 | Airport shut down. Loss of security information that affect the business operations. | 9 | 0.8 | Collision because of the misleading information send by hackers | 10 | 0.6 | Cyber attack cause the software damage and hardware damaged, Collision lead to damage of buildings/airport facility | 9 | 0.8 | 6.8 /10Medium | 3 | Airport shut down temporarily | 6 | 0.4 | Emerge landing by pilot may lead to safety issue | 7 | 0.1 | Hardware /software Damaged, financial loss | 5 | 0.5 | 1.86/10 Small | 4 | Shut down the airport for long term, loss licience on operation | 9 | 0.5 | Collision lead to loss of huge number of human life | 10 | 0.5 | Financial loss because of human error | 9 | 0.7 | 5.26 /10 Medium | 5 | Aircraft may damaged the facility in runway and normal operation | 4 | 0.5 | Collision in runway lead to loss of human life | 9 | 0.3 | Collision cause asset damaged | 5 | 0.1 | 1.73 /10 Small | 6 | Bad weather condition lead to delay of aircraft | 6 | 0.8 | Bad weather lead to collision lead o collision of huge loss of human life | 10 | 0.3 | Collision lead to damaged on the facility | 5 | 0.5 | 3.4/10 Small | 7 | Company information is stolen and unauthorized control on the system, disrupt the operation | 7 | 0.6 | Could cause collision if the people approve some tasks | 10 | 0.5 | Cause financial loss | 8 | 0.6 | 4.66/10 Medium | 8 | Loss the business, reputation and even money for the aircraft delay | 5 | 0.8 | Can cause unsafely control on the air space | 7 | 0.2 | Cause financial loss | 8 | 0.7 | 3.67/10 Small | 9 | Virus cause airport operation shut down | 6 | 0.5 | Cause loss of human life because of unavailable of computer system | 10 | 0.3 | Cause the hardware and software damaged | 7 | 0.5 | 3.16/10Small | 10 | Stop the business operations | 5 | 0.4 | Cause the loss of human life because of control | 10 | 0.3 | Cause financial loss | 7 | 0.6 | 3.06/10 Small | 11 | Loss of communication facility, | 9 | 0.5 | Cause collision on huge number of human life | 10 | 0.2 | Cause financial loss | 6 | 0.4 | 2.73/10 Small |

Table 3: In place Control

ID | Technical Control | Management Controls | Operational Controls | 1 | Display the usage and provide automatically warning until it reach 80% | Standards for employees to check the storage, and increase the storage if necessary | Records data regularly | 2 | Access Control on airport internal networkLogon identifier, system logs and audit trails and use firewalls and Encrption technique | Certification and security assessment of ATC system.Program management | Training the staffs and aware the security of system.Incident response when detect the hackers. | 3 | Automatically backup system to ensure no data loss | None | Use backup power generator | 4 | Automatically system for manual control such as sending map, weather information. | Standard on maximum working hours per day | Training staff | 5 | System detect and validation Function, Access control, firewalls and Encrption technology | Certification and security assessment | Awareness and Training | 6 | Video and camera to monitor the runway. Access management system to monitor the run way | Standards on when to access to the runway | Use locked doors, guards, access logs to control people access into runway | 7 | Automatically report the weather condition from weather station | Risk assessment and planned | Training staff | 8 | Validation, Logon identifier, system logs and audit trails and use firewalls and Encryption technique | Certification and security assessment, program management | Training, maintain the | 9 | System provide aircraft plan landing position and time automatically and re-sequences the aircraft base on the condition | Standards on how to manage the aircraft | Training | 10 | Anti virus | Program management | | 11 | Validation and Identification function on difference departments | Human resource management and standard | Training and background security check on new staff | 12 | Access management system to monitor the communication system and give warning to manager | Security and risk assessment on the communication system | Maintain the facility |

RISK MANAGEMENT

As discussed by Gibson (2011) risk management involves identifying and understanding the threats and vulnerabilities that define risks, assessing the likelihood and impact of its occurrence, putting some controls to mitigate it in order to reduce the severity of a loss. The risk assessment above already identifies the existing risk of an airport traffic control systems including its risk matrix. This section will discuss the necessary controls needed to mitigate the identified risks using some risks management techniques such as avoidance, transfer, acceptance, cost-benefit analysis and others.

Basically, to ensure proper regulation in the national airspace system, every airport traffic control system shall anchor and comply with the aviation standards of their respective area or country and with international standards as well, such as International Civil Aviation Organisation (ICAO) and National Institute of Standards and Technology (NIST). Ensuring the proper implementation of their respective guidelines and procedures will help avoid occurrence of accidents. Moreover, most airports uses the common risk management framework, in Australia for example, the following framework is used to ensure maintenance of aviation safety.

Figure 1. Common Risk Management Framework for Airspace and Air Traffic Management

After assessment, the next important step is to how these identified threats should be treated. While the risk matrix shows the likelihood and impact of every risk identified, developing the most appropriate control is necessary to reduce the occurrence of the risks. While the goal is to strengthen the availability, integrity and confidentiality of airport traffic control system, necessary controls shall be implemented. Moreover, the existing controls may not be adequate thus upgrade and improvement is also needed.

Furthermore, the most likely and high impact risks of an airport traffic control system are generally sourced by human threat both intentional and unintentional. Occurrence of such exploits generally leads to catastrophe thus should be regularly and effectively mitigated to ensure catastrophic accidents like collision and near miss incidents among aircrafts. It does not only cause material loss to the industry but human lives as well. This risk management plan will emphasize on the mitigation of these various risks caused by humans as well as uncontrollable events like force majeure as shown below:

Threat-Source | Motivation | Threat Actions | Hacker, cracker | ChallengeEgoRebellion | • Hacking• Social engineering• System intrusion, break-ins• Unauthorized system access | Computer criminal | Destruction of informationIllegal information disclosureMonetary gainUnauthorized data alteration | • Computer crime (e.g., cyber stalking)• Fraudulent act (e.g., replay, impersonation, interception)• Information bribery• Spoofing• System intrusion | Terrorist | BlackmailDestructionExploitationRevenge | • Bomb/Terrorism• Information warfare• System attack (e.g., distributed denial of service)• System penetration• System tampering | Industrial espionage (companies, foreign governments, other government interests) | Competitive advantageEconomic espionage | • Economic exploitation• Information theft• Intrusion on personal privacy• Social engineering• System penetration• Unauthorized system access (access to classified, proprietary, and/or technology-related information) | Insiders (poorly trained, disgruntled, malicious, negligent, dishonest, or terminated employees) | CuriosityEgoIntelligenceMonetary gainRevengeUnintentional errors andomissions (e.g., data entryerror, programming error) | • Assault on an employee• Blackmail• Browsing of proprietary information• Computer abuse• Fraud and theft• Information bribery• Input of falsified, corrupted data• Interception• Malicious code (e.g., virus, logic bomb, Trojan horse)• Sale of personal information• System bugs• System intrusion• System sabotage• Unauthorized system access | Source: NIST 800-30 as shown in FAA ISRA SMS by Raytheon |

Risk Control

While avoidance is the most preferred technique to treat risks, human errors seem unavoidable because by nature human commits mistakes. Furthermore, a lot of circumstances cause human to commit such. As a result, every industry or organisation resulted commonly to mitigation instead. However, some risks can also be transferred specifically those cause by nature and other uncontrollable environmental forces. In addition, risks can be transferred through outsourcing and insurances.

A number of attacks could possibly exploit an airport traffic control system as discussed previously. For example, hackers could disrupt communications between ATC and the aircraft by sending messages or spam the ATC screens with bogus signal misleading both parties that could cause delay or accidents. Unfortunately, the existing air traffic system such as Automatic Dependent Surveillance-Broadcast (ADBS) is still vulnerable to these attacks. As Lo (2013) reported, the communication on such system is actually unencrypted thus very vulnerable to unauthorised access caused by hackers, crackers, disgruntled or previous employees or anyone with malicious intent of disrupting the system. These are some of the reasons why controls are indeed necessary for air traffic control or the airport industry as a whole.

Basically, controls can be classified into administrative, technical and physical in accordance with what it provides. For example, administrative control involves controls brought about by management such as policies, training and awareness. While technical controls uses technology in preventing or reducing an exploit, physical or operational controls involve physical security or those controls that protect the environment (Darill 2010).

Air traffic control system generally uses electronic access controls in preventing a threat-vulnerability pair. Such controls are necessary to the integrity and availability of the information required in the taking off and landing of an aircraft. A report reveals that necessary controls include network management, patch management, user accounts and passwords, user rights and files permission, audit and monitoring of security-relevant events and physical security. These controls may prevent or reduce various risks such as, unauthorized disclosure, modification, destruction of information, and service disruption (GAO report 2005).

Threat-Source | Risks | RM Technique | Administrative or Management Control | Technical Control | Operational or Physical Control | Hacker, cracker | • Hacking• Social engineering• System intrusion, break-ins• Unauthorized system access | * Mitigate or Reduce | * Develop and strictly implement “no sharing” of accounts and passwords policy * Regular conduct of firewall effectiveness testing * Regular auditing and monitoring of security relevant events * Regular update of employees information campaign on social engineering | * Improve and update electronic access controls * Provide additional redundant server * Install a user verification system | * Improve physical security (retina scan access, face recognition, finger or hand print scan, etc.) * Update CCTV surveillance with 24/7 recording | Computer criminal | • Computer crime (e.g., cyber stalking)• Fraudulent act (e.g., replay, impersonation, interception)• Information bribery• Spoofing• System intrusion | * Mitigate or Reduce | * Ensure passwords are changed frequently * Established password parameters (no. and type of characters) * Implement procedures to control the use of user accounts * Impose one user one password policy * Limit user rights and file permissions | * Improve intrusion detection system * Improve firewall system * Regular testing and update of router * Improve user account and password security * Require encryption to prevent disclosure to unauthorized personnel | * Improve physical security (retina scan access, face recognition, finger or hand print scan, etc.) * Update CCTV surveillance with 24/7 recording | Terrorist | • Bomb/Terrorism• Information warfare• System attack (e.g., distributed denial of service)• System penetration• System tampering | * Avoidance * Mitigate or Reduce Residual Risk | * Awareness and Training * Strict policy on access codes turnover * Established password parameters (no. and type of characters) * Implement procedures to control the use of user accounts | * Improve patch management * Improve user account and password security * Require encryption to prevent disclosure to unauthorized personnel | * Improve physical security (retina scan access, face recognition, finger or hand print scan, etc.) * Update CCTV surveillance with 24/7 recording * Hire security personnel on watch 24/7 | Industrial espionage (companies, foreign governments, other government interests) | • Economic exploitation• Information theft• Intrusion on personal privacy• Social engineering• System penetration• Unauthorized system access (access to classified, proprietary, and/or technology-related information) | * Avoidance * Mitigate or Reduce Residual Risk | | | | Insiders (poorly trained, disgruntled, malicious, negligent, dishonest, or terminated employees) | • Assault on an employee• Blackmail• Browsing of proprietary information• Computer abuse• Fraud and theft• Information bribery• Input of falsified, corrupted data• Interception• Malicious code (e.g., virus, logic bomb, Trojan horse)• Sale of personal information• System bugs• System intrusion• System sabotage• Unauthorized system access | * Avoidance * Mitigate or Reduce Residual Risk | * Segregation of duties * Awareness and Training * Strict policy on access codes turnover * Established password parameters (no. and type of characters) * Implement procedures to control the use of user accounts * Proper turnover of access codes * Limit user rights and file permissions | * Improve patch management * Improve user account and password security * Require encryption to prevent disclosure to unauthorized personnel | * Improve physical security (retina scan access, face recognition, finger or hand print scan, etc.) * Update CCTV surveillance with 24/7 recording | Unintentional human errors (lapses, mistakes, slips due to fatigue, stress, or lack of knowledge) | * Sending or choosing the wrong information * Making a wrong decision | * Avoidance * Mitigate | * Awareness and training * Reasonable shifting hours work * Implement regular breaks * Proper turnover of shift policy | * Use robotic system | * Update CCTV surveillance with 24/7 recording | Source: GAO report 2005, NIST 800-30 and Dionisio, 2010 |

Cost-Benefit Analysis

Before controls are to be implemented, a cost-benefit analysis shall be conducted to verify if the cost of putting up the control is lesser than the benefits that the organization or industry will get with such control. In other words, in the event cost of control is much higher than the benefits it would provide, such control may not be implemented at all. The risks that may arise without the controls shall be accepted or transferred. As mentioned, consequence of an air traffic risks is usually devastating, hence, to be avoided or at least reduce. While collision is the most catastrophic consequence of a possible exploitation, other outcomes include flight delay and flight decongestion. Nevertheless, generally resulted to a great loss in the industry.

The total loss before the control shown on the financial reports of Sydney airport (2012) and Melbourne airport (2012) were used as examples. The property, plant and equipment totalled around 360 million in Sydney Airport. When an incident happens, around 1%-10% of plant and equipment will be damaged. In the same time, the airport needs to spend large amount of money on passenger, governments or other stakeholders. The loss also consider the loss of income per day. Sydney airport (2012) earn more than 1 billion of revenue per years. It means that it can get 2.89 million income per day. When airport shut downed the business for a few day, airport can loss more than10 millions of income. In the Cost Benefit Analysis, large incident can general 80 million losses, and small incident can result in 60 million of loss. The risks of shut down airports for few day will have 10 millions of loss.

As human error is one of the most important, training are important to airport. Base on the analysis from ABS(2004), the annual training for transport industry is 500 dollar per employee. As there are 12113 employee in Sydney airport, it need 6 million dollar to train employees every years.

The hardware cost around 68000 in an airport, therefore the regular updated on hardware may request around 17,000 to 34,000 dollar. As regular updated required a lot of labour force, the company may need to spend on this section.

Base on our research, the security system and intrusion detection system usually need multi millions to build (Hoffer, 2010). The estimation for update cost every year is 10% of the total value.

The CBA table is shown below: Control | Cost | Loss Before Control | Expected Loss After Control | Benefits | Updated training and information campaign to employees | 6 million | 80 million | 50million | 46 millions | Updated CCTV surveillance system | 1 billion | 80 million | 50 million | 19 millions | Anti-Virus Software | 1 million | 80 million | 50 million | 29 millions | Regular update and testing of routers and switches | 1 million | 80 million | 60 million | 19 millions | Improve security system | 10 million | 60 million | 30 million | 20 millions | Purchase of additional server | 0.034 million | 10 million | 2 million | 7.96 million | Update Intrusion Detection System | 10 million | 60 million | 40 million | 10 million |

Monitor and Review

Risk management do not end in risk treatment. As a continuing process, such treated risks shall be monitored and reviewed regularly to ensure that identified risks are still controllable. Further, other risks may be identified in the process. Monitoring includes regularly testing of controls to ensure if its effectiveness to reduce risks that may arise in case of exploitation.

Communication
An equally important strategy in risk management is a good communication. Threats and vulnerabilities shall be regularly communicated in the organisation to ensure understanding and effective treatment in case of exploitation. Effective communication does not only inform risk management plan to all personnel but also effectively implement the plan through creating a culture of reporting any exploitation or threats that may arise in the process.

RISK MITIGATION

Business impact analysis
As we mentioned above, we can conclude that critical business functions and critical resources are:
The controller accessing the web site Internet access, the web server, the web application, Network connectively and the firewall are critical resources to support this function.
The web server accessing the database server The web server, the web application, Network connectively, the database server and the firewall are critical resources to support this function.
The pilot accessing controller Radar and radar applications are critical resources to support this function.

Impact of Computer Outages
Threats like Cyber attack, controller mistakes, unauthorized access to the system, virus, attack from disgruntled or former employee or broken facility may cause computer outages. In the ATC centers, the computer mainly used by IT people is the IBM 9020. When cyber attacks leads to computer outage, there may be significant delays. For example, on August 2008, when a software malfunction caused a nearly three-day air traffic snarl in the Northeastern United States, centered around Hampton. And the database mismatch that caused a complete breakdown of all eastern US flight traffic routing (Hutto, K. 2008).

Impact of Power Outages
Compared with computer outages, an electrical power outage is much more serious. When it occurs, it means that controller can’t give pilots information about weather, traffic situation, location and so on. Without backup generator, power outage would be extremely dangerous because pilots can only responsible for themselves to avoid midair collision. However, the power outages result from extreme weather, such as typhoon and lighting strikes, can’t be avoided.

Business Continuity Plan

How to deal with computer outage
As we mentioned above, when a 9020 outage happens, the controllers still have a backup system—DARC. DARC can digitize the raw data from the radar to create a comparatively clean image on the control consoles (University of Princeton,2007). Even if DARC doesn’t work, a second backup called broad-band system can be used. It displays radar data without computer enhancement and thus provides no data block for individual targets.

At the same time, TCAS (Traffic Alert and Collision Avoidance System) can be used to prevent collision. TCAS is designed for use by general aviation, and it can indicate to the pilot the presence of a transponder-equipped aircraft without providing either range or bearing information; it would be the responsibility of the pilot to locate the intruder by visual means and to take the appropriate action.
One important thing for BCP team is to train controller as well as other staff using DARC and TCAS. Training employees could make them more familiar with the system, thus speeding up the backup process.

How to deal with power outages
When power outages happen, it means that pilots can’t get instructions from traffic control tower. In this situation, BCP team should contact other airports and ask other airports to When power outages happen, it means that pilots can’t get instructions from traffic control tower. In this situation, BCP team should contact other airports and ask other airports to assist the pilots as soon as possible. Even a second delay may lead to a disaster. For example, In 1994, a power test making by a technician caused a short circuit for 1 second. However, this 1 second caused about 477 delays in Chicago Airport. Since the assistance from other airport is a strategy to deal with power outage, it’s important for BCP team to communicate with staff from other airports as quick as possible. Besides, BCP team should have a good relationship between other airports to ensure that their staff could do a favor quickly.

Disaster recovery plan

Similar to CIRT, disaster recovery plan is usually under the umbrella of airport emergency plan by common practices; it is a document that lay out actions that restore the system to pre-emergency condition. It mainly includes crisis counselling, rehabilitations, reconstruction, public communication and damage – reduction programs.

Figure 1 outlined the common structure of an emergency response organisation, public information division is responsible for information control, liaison department is accountable for communication between departments, finance department make sure when incident happen ICS will have enough funds to undertake their operation. For the preparation of a disaster, a DRP should specify who will execute recovery action in case of emergency, in airline industry ICS usually replace CIRT in that manner.

In the case of power and computer outage in ATC centre, ICS will make instant response and also the disaster recovery. ICS should implement their backup electricity supply or computer system timely to let the tower continue operating. If any employee injured, both physically and mentally, provide medium to long-term medical assistant. If there were hardware broken down due to the outage, reconstruct ion should be carried out if necessary. Possibly, there will be rumours going around and deal significant damage to the company’s reputation, public communication will hold the responsibility to clarify the fact and provide a clear view to the public community for damage control. DRP should also state clearly the seriousness of incident; if everything fail ICS should seek for external help. Information such as contact detail of electricity provider, internet provider, hardware supplier, national emergency response team and law enforcement should be written clearly in the DRP.

To be more specific, we can use an example to illustrate how DRP can be benefit to an organisation. It is possible that animal might trespass into the tower and sometimes damage property. If it bites off a power cord of the receptionist’s computer, it is classified as an incident, due to that computer is easy to replace and does not really matter to the operation of ATC. But when it happens to the server’s cable and leads to an outage of the system that serves the whole building, the impact is much severer and the server is relatively hard to replace so it is a disaster to the organisation. DRP also focus on the long term prevention of future reoccurrences, therefore set up traps for animals around the ATC, and may be build up fence around major equipment rooms.
Figure 1
Computer Incident response team

A common structure of CIRT is shown in diagram 2 . The response team is commonly called Incident Command system (ICS), which is designed under the National Response Framework of Federal emergency response agency. The Air operation division is responsible to any incidents within the tower , where ATC is operating.

ICS provides a set of standardised programmes, besides provide immediate technology support; they also deliver training, resource management, personal and equipment qualification and certifications, communications and information management and continuous system improvement. Take computer outage and power outage as an example, ideally, ICS should provide instant IT support when computer system go down, identify the root of the problem, whether it is hardware or software, taking appropriate action once identified the problem (e.g. replacing hardware when there is malfunction/ breakdown of hardware, have installation equipment ready in the case of a failure of software). In case of power supply problem, ICS should contact electricity immediately as well as perform check-ups to determine if it is their own problem. They need to have the authorities to access certain areas of the airport when the incident happens, it should be specified in the emergency plan along with the timeframe of react (e.g. ICS should react with 30 minutes after they are informed), how long can they retain their authorities and who can launch the emergency plan. Lastly they have to write a report to upper management to inform them what they have done and what was happened, if possible they should investigate the root of the problem, an example is shown in table 1.

Refering to the example that cause outage in DRP, CIRT would locate where the problem is by looking in their computer monitoring system , assess the possibility of changing the power cord or server then go to the site and change it. If it could not be replaced, obtain authority from upper management to launch the backup server when necessary.

Table 1 AIRPORT EMERGENCY PLAN ACCIDENT/EXERCISE EVALUATION FORM | Date/time of the accident: | Location: | Description of the accident: | Weather: Ceiling/Visibility Wind velocity & direction | Surface Conditions: | | | Severity of the incident (Low/ Medium/High) | Action taken : | Is the situation applicable to launch emergency response (Y/N):_____ | Signature of ICS Chief executive (Mr. XXX )and manager on duty (Insert name:_____): _____________ ___________________ |

Figure 2

CONCLUSION

Air traffic control relies generally on automation thus, information risk and information system risk management is necessary to ensure availability, integrity and confidentiality of the system. While risks in air traffic system are very extreme and catastrophic that incur large loss to the industry and cost human lives as well, an effective risk management plan should be in placed and effectively implemented. A business continuity plan, incident response and disaster risks plan should also be established and maintain to sustain the effectivity of the whole risk management plan. The underpinning here is that its about time that management of risks in information system shall be given much weight in every industry for uncontrolled IT risks may lead to a disaster.

References:

ABC 13 Eyewitness News,2013. "Computer virus creates havoc at Houston airport". [ONLINE] Available at: http://archives.californiaaviation.org/airport/msg24857.html. [Accessed 20 October 2013].

ABC New, 2013. Thousands delayed after power outage at Sydney Airport - ABC News (Australian Broadcasting Corporation). [ONLINE] Available at: http://www.abc.net.au/news/2011-07-30/power-out-at-sydney-airport/2817296. [Accessed 20 October 2013]. Bill Lindner,2009. FAA's Air Traffic Control Apps Highly Vulnerable / Infopackets.com. [ONLINE] Available at: http://www.infopackets.com/news/security/2009/20090520_faas_air_traffic_control_apps_highly_vulnerable.htm. [Accessed 20 October 2013].

Dwyer J, Landry S (2013), “Separation Assurance and Collision Avoidance Concepts for the Next Generation Air Transportation System”, Center for Human Factors in Advanced Aeronautics Technologies,[ONLINE] Available at: http://chaat.cla.csulb.edu/research/Publications/03Separation%20Assurance%20and%20Collision%20Avoidance%20Concepts.pdf. [Accessed 19 October 2013].

Dionisio, A. 2010, Air traffic controller fatigue and human error, [online] Available at: http://anthonydionisio.com/research/dionisio_gcp_fatigue_human_error.pdf [Accessed: 16 Oct 2013].

Egozi, A., 2013, “High probability of a cyber attack on civil aviation” [ONLINE] Available at: http://www.israeldefense.com/?CategoryID=484&ArticleID=846. [Accessed 16 October 2013].

Flight Safety Foundation, 2013. ASN Aircraft accident Ilyushin 76T EK-76300 Brazzaville-Maya Maya Airport (BZV). [ONLINE] Available at: http://aviation-safety.net/database/record.php?id=20121130-0. [Accessed 20 October 2013]. France-Presse A (2013). Indonesian plane skids off runway after hitting cow | Inquirer News. [ONLINE] Available at: http://newsinfo.inquirer.net/460631/indonesian-plane-skids-off-runway-after-hitting-cow. [Accessed 20 October 2013].

Gibson, D. 2011, Managing risk in information systems, Sudbury, MA: Jones & Bartlett Learning.

Government Accountability Office, 2005, INFORMATION SECURITY Progress Made, but Federal Aviation Administration Needs to Improve Controls over Air Traffic Control Systems, [online] Available at: http://www.gao.gov/new.items/d05712.pdf [Accessed: 12 Oct 2013]. Groning M. and Ladkin, P, 1996, Air traffic equipment control outage http://www.rvs.uni-bielefeld.de/publications/Incidents/DOCS/Institution/NTSBoutages/outages.html [Accessed 12 October 2013]

infrastructure.gov.au. 2013. Common Risk Management Framework for Airspace and Air Traffic Management, [online] Available at: http://www.infrastructure.gov.au/aviation/airspace_reform/files/crmf_2010_final.pdf [Accessed: 16 Oct 2013]. Keane G.A. ( 2013), “Asiana crash leads to rash of aborted landings.”, Sydney Morning Herald [ONLINE] Available at: http://www.smh.com.au/world/asiana-crash-leads-to-rash-of-aborted-landings-20130730-2qwc3.html. [Accessed 19 October 2013].

Kevin, H. 2008, FAA Suffers Network Outage - Security of Air Traffic Control Network Questioned http://ezinearticles.com/?FAA-Suffers-Network-Outage---Security-of-Air-Traffic-Control-Network-Questioned&id=3332522 [Accessed 20 October 2013]

Lo, C. 2013. Air traffic control: an easy target for hackers? airport-technology.com, [online] 12 April 2013. Available at: http://www.airport-technology.com/features/featureair-traffic-control-easy-target-hackers [Accessed: 19 Oct 2013] Office of Technology Assessment and the Congressional Budget Office (OTA&CBO), 1984, Airport System Development, U.S. Government Printing Office Washington Paul Mark,Air traffic system vulnerable to cyber attack - tech - 12 September 2011 - New Scientist. [ONLINE] Available at: http://www.newscientist.com/article/mg21128295.600-air-traffic-system-vulnerable-to-cyber-attack.html#.Ul5Arxa3ck8 [Accessed 16 October 2013]. Peter G. Neumann, 1994. Computer-Related Risks. 1 Edition. Addison-Wesley Professional. University of Princeton,2007, Technology and the future evolution of ATC system. University of Princeton, viewed 27 March,2007, <http://www.princeton.edu/~ota/disk3/1982/8202/820207.PDF>) U.S.Department of Transportation (2010) ,Airport emergency plan ,Advisory Circular , United State John, G., Technology and the future evolution of the ATC system , Ch 5 Velotta R (2013), McCarran monkey wrench: Network outage that caused long lines, manual check-in was biggest crash in three years - VEGAS INC. [ONLINE] Available at: http://www.vegasinc.com/news/2013/jul/26/mccarran-monkey-wrench-network-outage-caused-long-/. [Accessed 20 October 2013].