Melbourne Airport is building up its cyber detection and response capabilities in order to secure 30 million annual passenger journeys, which are enabled by multiple technology systems.

Speaking on the iTnews Podcast, head of cyber security Cheuk Wong said he is heavily focused on having visibility across the airport’s technology ecosystem, from its internal IT to baggage handling systems and even its wi-fi networks.

“Visibility is very important because if I don’t know what’s happening in the environment, I can’t protect it,” he said.

“The more visibility I have, the better that information is fed to our third party [security operations centre], who helps look at potentially suspicious activity and alert us if there’s anything that we need to be worried about and then help us in the response process.”

Wong was hired as Melbourne Airport’s head of cyber security in 2018 and leads a “small, but very effective” team of security specialists who sit within the larger technology division.

In his six years at the airport, Wong has helped shape a cyber security roadmap around understanding the IT environment, constantly changing risks and proactive detection and response.

“When I first came here, there wasn’t really a [cyber security] strategy. Even over the past year, our strategy has changed,” he said.

“[It] has adapted over time, based on emerging risks; things changing within the environment and the high-risk items within the airport itself.

“If you don’t understand what’s going on in the environment, how are you able to effectively protect it?

“What we focused on is trying to understand our environment better. Having that visibility allows us to question what’s going on.

“[It helps us to] respond reactively when something happens [and be] able to predict in the future in terms…what are the things that could actually go wrong?”

A needle in a haystack

Wong’s focus on system visibility has led Melbourne Airport to start incorporating artificial intelligence into its detection capabilities, starting with sifting out phishing emails.

“We use an… email security tool that uses AI and then. And it not only looks at the individual emails, but it looks at the broader ecosystem across all the email mailboxes within Melbourne Airport,” Wong explained.

“It then tries to put some logic behind detecting a conversation as a whole from the point that who sent the message, what [is the context] of the messages [and] how many people it has gone to.”

In Wong’s words, for an individual to comb through that amount of data is like finding “a needle in a haystack” – a haystack that is rapidly increasing in size.

“You can’t rely on people combing through the data,” he said. “We need to use AI within our environment to help with monitoring, detection and response. There is so much data within the environment [and] there will be more and more data as things get more digitised and more complex.

AI, he added, will help with “understanding those nuances and being able to build better detection and response capabilities”.

Meanwhile, to reduce any risks from within the environment, Melbourne Airport’s human resources team utilises automatic account deletion for employees exiting the organisation.

This, said Wong, helps the airport to be more efficient and manage its risk, with plans for wider adoption in the future. 

Access control

Melbourne Airport currently sees more than 100,000 passengers pass through its terminals per day, a figure equivalent to “filling the Melbourne Cricket Ground”, according to Wong.

Responsible for ensuring a seamless journey for all those passengers is a range of technology systems, including the airport’s own and those of the Australian Border Force and Airservices Australia.

From a cyber security perspective, these are all overseen by a centralised access control that manages physical access across the entire airport, including its four terminals.

Managing access control is a critical part of Wong’s role, as a system failure would mean losing the ability to control access to sensitive areas of the airport.

“I help understand what the business requirements are from a system perspective and help build security controls to ensure that people don’t compromise those systems,” he explained.

“[I] ensure that those systems are available [and that] the integrity of those systems [is] maintained. You don’t want to be people breaking the system, changing access or people giving access to different areas that may be sensitive to the airport.”

However, at the end of the day, the controls in place are only effective if they actually work when needed, Wong added.

“At the end of the day, you can implement as many controls as you want, but [to understand] the effectiveness of those controls, you need to test.

“Security testing is a big part of my strategy [and] my approach to making sure that we maintain a level of appropriate or adequate security for the airport.”