Cybersecurity Lacking At Most Of The World’s Major Airports

When it comes to cybersecurity Amsterdam, Helsinki and Dublin were ranked the three safest airports by Immuniweb, but overall these facilities fared poorly when it came to protecting their websites, mobile platforms and systems.

The study found 97 of the world’s 100 largest airports have have security risks related to vulnerable web and mobile applications, misconfigured public cloud, dark web exposure or code repositories leaks. Some of the most egregious findings were:

• 97 percent of the websites contain outdated web software.
• 24 percent of the websites contain known and exploitable vulnerabilities.
• 76 percent and 73 percent of the websites are not compliant with GDPR and PCI DSS, respectively.
• 100 percent of the mobile apps contain at least five external software frameworks.
• 100 percent of the mobile apps contain at least two vulnerabilities.

This translated into 47 percent of the airports studied receiving a C grade, meaning there were security vulnerabilities or several serious misconfigurations found; 11 percent got a B, several minor issues or insufficient security hardening; 14 topped out with an A or A+ with the latter meaning there were no issues and the former only a few minor problems discovered.

Twenty-four airports received a failing F. This means exploitable and publicly known security vulnerabilities were found. This included having outdated components, outdated CMS, vulnerable components or a vulnerable CMS.

The report was also particularly damning of the failure of most airports to be GDPR or PCI DSS compliant. Only 24 percent of the main websites and 12 percent of subdomains were GDPR compliant. PCI DSS was almost as bad with only 27 percent falling within regulations.

When it came to securing email only 32 of the 147 email servers properly implemented SSL/TLS, 44 servers had poorly implemented the protocol and 48 percent do not support SSL/TLS encryption at all leaving them open to Man-in-the-Middle attacks and having traffic intercepted.

“Cybercriminals may well consider attacking the unwitting air hubs to conduct chain attacks of the travelers or cargo traffic, as well as aiming attacks at the airports directly to disrupt critical national infrastructure,” said Ilia Kolochenko, CEO and founder of ImmuniWeb.