The EU Cybersecurity Agency ENISA has led an international cybersecurity exercise focussed on a cyber attack by a radical group on an airport’s critical systems. Cyber Europe 2018 focused on helping organizations to test their internal business continuity and crisis management plans including media crisis communication, while also reinforcing cooperation between public and private entities.
The scenario was:
“It is a normal day at the airport. All of a sudden, the automated check-in machines display a system failure. Travel apps on smartphones stop functioning. The agents at the check-in counters cannot operate their computers. Travellers can neither check in their luggage, nor pass through security checks. There are huge lines everywhere. All flights are shown as cancelled on the airport monitors. For unknown reasons, baggage claim has stopped working and more than half of the flights must remain on the ground.
“A radical group have reportedly taken control of the airport’s critical systems by means of digital and hybrid attacks. They have already claimed responsibility for the incident and are using their propaganda channels to spread a call to action and attract more people to adopt their radical ideology.”
Over 900 European cybersecurity specialists from 30 countries took part in the Cyber Europe 2018 exercise on the 6th and 7th June 2018.
The exercise was orchestrated by ENISA at its headquarters in Athens, Greece, while the participants either stayed at their usual workplace or gathered in crisis cells. ENISA controlled the exercise via its Cyber Exercise Platform (CEP), which provided a ‘virtual universe’ (integrated environment) for the simulated world, including incident material, virtual news websites, social media channels, company websites and security blogs.
The scenario contained real life-inspired technical and non-technical incidents that required network and malware analysis, forensics, and steganography. The incidents in the scenario were designed to escalate into a crisis at various levels: organizational, local, national and European.
The participating countries were: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, United Kingdom.
