For awareness Medium Monitor
OT-ISAC reports flag aviation risks from shared providers and airport systems
Industrial CyberAmadeus · transport, aviation
What happened. OT-ISAC published two reports on Asia-Pacific aviation risk. They cover third-party accounts, remote access, legacy controllers and airport systems. One examines unauthorised access to Amadeus reservation data affecting several airlines' customers; the origin of the credentials is unknown.
Who is affected. Asia-Pacific aviation, including airports and airlines such as Japan Airlines, All Nippon Airways, Cathay Pacific and Singapore Airlines, and Amadeus reservation system users.
What to do. Review third-party service accounts and remote-access routes into airport operational technology, and check supplier connections to reservation and baggage, lighting, fuel and building systems.
When to act. For awareness: background reading, nothing to schedule
Editor's reading
ForOT security leadIT securityleadership
- Purdue level
- L4
- L3.5
- L3
Why: Reservation data and service accounts sit in enterprise IT (L4), while remote-access infrastructure and airport systems such as baggage and building management reach into site operations and the DMZ.
- Are you exposed?
Review which third-party and service accounts can reach reservation systems or airport operational technology, and how each connects.
- If you cannot fix it yet
- Limit and monitor third-party service accounts, and rotate their credentials.
- Require multi-factor authentication on supplier remote-access paths into airport operational technology.
- Watch for
- Logons by third-party or service accounts at unusual times or from unfamiliar locations.
- Remote-access sessions from supplier networks into airport operational technology.
- ATT&CK for ICS
- T0886Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Industrial Cyber (opens industrialcyber.co)
More on Transport