You can put the best lock in the world on your front door, but it is useless if the door is left open. That is the comparison Prudence uses when people ask what her work as a Cybersecurity Manager at Schiphol involves.
“We provide the lock, but we also make sure people understand why the door needs to stay closed. The easier you make it for people, the more likely they are to do it.”
Behind every aircraft that departs from Schiphol is a complex world of digital systems. Prudence and her colleagues help keep that environment secure.
They identify where Schiphol may be digitally vulnerable, from processes and technology to suppliers. They translate those risks into strategy, policy and advice for management. In doing so, they help make the airport more resilient, keep passengers moving safely and keep the door closed to those who should not have access.
A chain is only as strong as its weakest link
One of the biggest misconceptions about cybersecurity?
“That cybersecurity is purely technical and can therefore simply be left to our IT colleagues.”
People play an important role in recognising risks and using systems securely. Cyber attackers therefore often target human behaviour.
“Using social engineering to convince someone to open the door themselves is usually much easier than trying to break the lock.”
That human side of cybersecurity is one of the things Prudence finds most interesting. How do people behave, and how can you help them make secure choices?
“We need people to work with us, so we try to make security measures as user\-friendly as possible. If it takes an endless series of steps to close that door, people simply won’t do it.”
Keeping passengers moving
Schiphol is critical infrastructure. The availability and reliability of its digital systems are essential.
“Take check\-in. At passport control, you can now simply show your face to a scanner. And instead of taking your suitcase to a counter, you attach the label yourself and place it in a bag drop machine.”
The more processes become digital, the greater the consequences when something goes wrong.
Incidents at international airports show how dependent modern airports are on digital systems and reliable information.
“If something fails, passengers can become stranded at the airport. That can lead to chaos and even wider disruption. We cannot afford that. We want passengers to move safely through the gates and aircraft to take off and land safely. That is exactly why this work feels so meaningful.”
Security goes beyond the airport perimeter
Schiphol does not operate in isolation. If trains stop running, the airport feels the impact. The same applies when traffic builds up on the A4 motorway.
Cybersecurity works in much the same way.
Prudence and her colleagues regularly work with airlines, Air Traffic Control the Netherlands and the National Cyber Security Centre.
“Cybersecurity does not stop at the boundaries of your own organisation. That is why we work closely with partners across the chain and with other cybersecurity professionals. We share relevant information so that we can become more resilient together.”
Always learning
Prudence recently attended a cybersecurity event with specialists from different parts of the organisation.
“The conclusion was simple: there is so much happening in cyber that we will never be bored.”
Artificial intelligence, for example, is creating new possibilities for organisations, but attackers are increasingly using the same technology.
At Schiphol, cybersecurity is therefore not only about investing in technology. It is also about investing in people and expertise.
“The threats change every day. I’m constantly learning, adapting and thinking ahead to help make sure the airport remains secure.”