Designing for cyber-resilience

Imagine being at the airport for a well-deserved holiday. Arrived at the airport early and bought snacks and coffee, everything under control…so far. When walking to the check-in desk to place the baggage on the conveyor belt and nothing happens. It looks that the belt is not working.

Seems like a technical glitch at the beginning but after 5 minutes, there is a line forming behind, people are huffing and puffing. Staff are on the phone, lots of commotion in the desk area. After some time, customers are told that the baggage handling system has been compromised. No baggage is moving. Flight plans are all set, the planes are ready, passengers are present but they are not on the plane. Why? Because the baggage are not loaded. The entire operation system broke down. This is when it is no longer a cyber incident but an operational disruption. A situation many companies dread happening to them.

It is fair to assume that critical decisions were made with respect to system architecture, third-party integrations, operational dependencies yet cybersecurity was likely not included/embedded in those decisions. In many organisations, decision management and risk management are treated as standard lifecycle activities. However, they are often applied without fully integrating security considerations. In the TNO Report R10875 Cyber-resilient system design methodology, risk management is explicitly positioned as part of the system design workflow, rather than a separate exercise. [1] If applied in this context, the airport authority could have explored what would happen if the system became unavailable, how dependent operations are on this single chain, and what fallback options are acceptable to decision-makers and key actors.

Ultimately, this is what resilience comes down to: ensuring that key decisions consider not only how a system performs under normal conditions, but how it sustains operations under disruption. At the airport, that means enabling passengers to continue their journey with minimal disruption (even when part of the system fails).

Let’s assume the airport has a simple operational scenario in the design, which is “ The baggage system is unavailable for 30 minutes during peak-check in”. How are we going to proceed?

In such scenario, the possible fallbacks are manual check-in procedures, alternative baggage handling (e.g., mobile carts, designated holding area) or temporary routing strategies (baggage re-route with available conveyor segments, re-routing to another handling unit or terminal). These alternatives mentioned in the practical example are means for mission continuity. In addition, these alternatives are solutions that can be agreed by decision makers and risk management team for inputs to design authority.

Cyber-resilience should be treated as a quality, not a constraint

Often times it is reliability, performance, safety, security, efficiency that are considered as system quality standalone but resilience, especially cyber-resilience is not held in the same category. It is either a constraint or a control but not a holistic quality. There is a need to balance resilience with other qualities during trade-offs. The balance can be achieved if the organisations are explicit about what level of disruption (time delay) is acceptable and what risks they are willing to take. This is about understanding the risk appetite of the organisation both internally and externally across the stakeholders. In this airport example, customer service provider and the baggage handler may all have different tolerances for failure or have different agreements. Without the alignment among between roles, the decision may be always incomplete.

Understanding how the alignments work and what the role owners expectations can be beneficial in choosing trade-offs. For example, how do we respond to the failure of baggage handling system in times of operation? We can consider adding redundancy which will have an additional conveyor belt that takes the baggage to the airplane, we can enable manual fallback operation which was also mentioned in the earlier example, or  we can isolate critical components. We can also introduce monitoring and rapid recovery mechanisms for early detection and efficiency. The truth is, all of these options have cost, performance, operational complexity as well as security exposure in the trade-offs. What can be done?

Figure 2:  Operational modes for mission continuity

Figure 2 provides two possible solutions which balance safety, performance and cyber-resilience and we may choose one of the two depending on how the trade-offs are carried out. It is part of the design decision in which we need to determine how to continue baggage handling while working with reduced throughput and ensure cyber-resilience meanwhile (limiting the impact while resuming operation).
Even if there are solutions for continuing the operation of the system when compromised, without clarifying the roles and establishing the shared understanding of how alignment and communication should happen can make the simplest disruptions difficult to manage. Some may hesitate and delay the decision making, resulting in loss of money, valuable time, and even credibility.

As shown in figure 3, in order to avoid a potential disaster, organisations need the following:

Clear ownership

There is a need to define roles and owners, not only for operating the system, but also for designing the system, managing risks and making decisions if something goes wrong.

A shared understanding of the system and its risks

Everyone involved operators, engineers, suppliers needs to see the same picture. Without that, discussions stay fragmented and solutions remain reactive. his is also observed in the SecureArch study [2], where informal communication and differing perspectives lead to gaps in alignment and governance. We can see further understanding of this in the TNO R10875 report in detail.

Traceability of decisions

It should be clear why certain design choices were made, what risks were accepted, and what alternatives were considered. This is what allows organisations to respond quickly, rather than starting from scratch each time.

Clarity in roles enables effective recovery and governance

Although airports follow standards, governance ensures clear roles, decisions, and rules during disruptions whether they are expected or unexpected in a rapidly changing threat landscape.

Once the ownership and common ground are established, we must then consider governance, agreements, and rules. We cannot simply move baggage through alternative routes or switch to manual handling without adhering to processes, procedures or standards such as IATA resolution 753 [2]. We also cannot expect a quick recovery if it is unclear whether the airline, the baggage handling provider, or the system supplier is responsible for fixing the issue.

Where resilience meets continuity, disruption is contained, not felt.

We are back at the airport, the conveyor belt is not moving as the baggage handling system is compromised. Yet, let’s imagine a different outcome. The system detects the disruption early. Through segmentation, the issue is contained and degraded mode is activated. Staff is notified, baggage process is slower than usual but not stopped entirely. Staff decided to trigger the manual procedures and switched to pre-defined fallback operation mode. How? The roles are defined, responsibilities are clear and therefore decisions are taken quickly. At worst case scenario, the flight may be delayed and at the best case scenario check-in took longer than normal but all passengers boarded with a delayed take-off of 30 minutes. This exemplifies the balancing of cyber-resilience and mission continuity: A controlled performance under disruption.
Cyber incidents are inevitable yet it does not mean systems shall not be cyber-resilient. The real question is not whether systems fail but how they behave when they do.  If we continue treating cyber-resilience as an afterthought, we will keep seeing conveyor belts stop working. If we bring cyber-resilience in decision-making early, treat it as a quality, align people, processes, responsibilities then disruptions won’t mean to imminent collapse. We will keep steady reputation and business instead.

References