Airport IT Support / Network Management / IT Maintenance / IT Service Management

ServiceTec has introduced a range of services designed to assist airports and airlines combat the ever-growing risks to Cyber Security.

ServiceTec’s Security Testing Services were developed, and will be overseen by, Dr. John McCarthy PhD BSc (hons) MBCS, Alan Benjamin Research Fellow – a renowned world authority on Cyber Security strategy, development and implementation, and an internationally recognized author of number of papers on all aspects of Cyber Security.

Vulnerabilities are being discovered continually by malicious individuals and researchers, and being introduced by new software. The Payment Card Industry (PCI) Data Security Standard (DSS), developed to encourage and enhance cardholder data security and facilitate the broad adoption of consistent data security measures globally, comprises a minimum set of requirements for protecting cardholder data and provides a baseline of technical and operational requirements designed to protect cardholder data. Requirement 11 of PCI DSS requires organizations to regularly test security systems and processes to ensure security controls continue to reflect a changing environment.

ServiceTec’s Security Testing Services provide airports with detailed internal vulnerability assessments of their IT Infrastructures, accompanied by comprehensive documentation on all of the identified problems and corrective measures.

“Cyber Security can be described as the protection of systems, networks and data in cyber space and  is concerned with the protection against cyber risks, which broadly fall into three areas: Cyber Crime, Cyber War, and Cyber Terror,” explained Dr McCarthy. “In 2012 at the Black Hat Conference in Las Vegas, a hacker showed he could use just $2,000 worth of store-bought electronics to convince an ADS-B (the FAA's preferred air traffic control system) that a non-existent plane was coming in for a landing.”

Delivered remotely from an environment outside the airport IT environment, ServiceTec’s Security Testing Services include quarterly vulnerability scans (as required by PCI DSS 11.2.1), internal and external scans following significant changes (as stipulated by PCI DSS 11.2.3) and web application vulnerability testing.

The combination of vulnerability assessment and scanning tools, and the experience of ServiceTec’s security engineers, identifies existing vulnerabilities in web applications and across all major network operating systems, services and network devices commonly used in airport IT environments.

Internal IT Infrastructure Vulnerability Assessment
ServiceTec’s Internal IT Infrastructure Vulnerability Assessment evaluates and increases the security of Airport IT environments by identifying security vulnerabilities IT assets and recommending corrective measures to mitigate risks.

Using a horizontal approach and focusing resources to identify vulnerabilities within the shortest period of time, ServiceTec’s Internal IT Infrastructure Vulnerability Assessment is the ideal starting point for IT security corrective processes. IT assets covered by network-layer vulnerability assessments include:

Network server operating systems
Regular network services performed by the servers, (e.g. mail, web, FTP, directory services,)

Databases used to store IT and business information
Routers, switches, firewalls and other network elements integrated with airport protection schemes.

Web Application Vulnerability Testing
ServiceTec’s Web Application Vulnerability Testing service evaluates and increases the security of web applications by identifying security vulnerabilities in the applications’ programming and functions, and recommend corrective measures to mitigate the risks.

Evaluations are undertaken remotely to identify more than 30 different types of vulnerabilities in web applications and are based on industry best practices (e.g. OWASP Top 10, PCI 6.5 requirement). The ideal starting point for application security corrective processes, ServiceTec’s Web Application Vulnerability Testing services include:

• Injection flaws (SQL Injection, OS Command Injection, etc.) and buffer overflows
• Insecure cryptographic storage and communications
• Improper error handling and access control
• Cross-site scripting (XSS) and Cross-site request forgery (CSRF).

Results
All results are revised by a senior ServiceTec security engineer to ensure that there are no false positives or non-relevant issues listed.  Results are delivered as a descriptive report that elaborates on:

• The tested environment or application
• The actual results of the analysis of the environment, application, tests and/or attacks
• Vulnerabilities found
• Risks evolving from the found vulnerabilities and their potential impact
• The suggested solutions wherever applicable.

About PCI DSS
The Payment Card Industry (PCI) Data Security Standard (DSS) was developed to encourage and enhance cardholder data security and facilitate the broad adoption of consistent data security measures globally. PCI DSS provides a baseline of technical and operational requirements designed to protect cardholder data, and applies to all entities involved in payment card processing – including merchants, processors, acquirers, issuers, and service providers, as well as all other entities that store, process or transmit cardholder data.

PCI DSS comprises a minimum set of requirements for protecting cardholder data, and may be enhanced by additional controls and practices to further mitigate risks.

About ServiceTec
In the fast paced airport environment, airport authorities, airlines, handling agents, freight forwarders, government authorities and other airport tenants must ensure that their Information Technology systems are running 24 hours a day, seven days a week. Since 1989, ServiceTec has developed and refined the expertise to support business and mission critical systems in airports of all sizes and passenger traffic demands. With over 2 million hours experience, ServiceTec continues to set the standards against which other support companies are measured.

Delivering the full range of managed IT services, ServiceTec supports well in excess of 50,000 system devices and some 1,000 self service devices at the world’s busiest airports. Operating from bases in North America, Europe and the Far East, ServiceTec currently supports systems at San Francisco, Minneapolis-St. Paul, Nashville, New York, Oakland, Heathrow, Schiphol, Manchester, Berlin Brandenburg and Munich. Visit www.servicetec.com for more information.

Jeremy Biggs
Marketing Consultant
ServiceTec
T: 07887 928785
E: jeremybiggs@servicetec.com