Threats to Civil Aviation and Security Risk Management
The threat picture
Candidates must be able to name the principal threat categories: unlawful seizure of aircraft, sabotage including explosive and incendiary devices, attacks on airports and ground facilities, attacks using the aircraft as a weapon, attacks on cargo and mail, insider threats, and cyber and unmanned aircraft threats. Each has different indicators and different countermeasures.
Risk management as a discipline
Security risk management follows a cycle: identify assets and threats, assess vulnerability, estimate consequence, calculate risk, select and apply controls, then monitor and review. Risk is commonly expressed as a product of threat, vulnerability and consequence. Controls may be preventive, detective or responsive. Residual risk is the risk remaining after controls; it is never zero and must be formally accepted by someone with authority.
A crucial distinction is between procedural controls (rules and checks) and technical controls (equipment and systems), supported by human performance. Most real failures involve a procedural or human control that was nominally in place.
Traps
- Questions that treat risk assessment as a one-off exercise. It is continuous.
- Confusing threat (an actor's intent and capability) with vulnerability (a weakness in the system).
- Assuming that adding a control removes risk. It reduces it to a residual level that must be accepted.
Worked example
An airport identifies that a service door is propped open by staff for convenience. The threat is unauthorised access; the vulnerability is an uncontrolled access point; the consequence could be an item placed airside without screening. The control is not merely a sign but a combination of access control technology, supervision, and a culture in which propping doors is challenged.