Md Touhidur Rahman

Blog

  • Threat, Vulnerability and Risk: Understanding the Difference in Aviation Security

    In conversations about security, three words come up again and again: threat, vulnerability and risk. They are often used as if they mean the same thing, but they don’t. Understanding the difference is the foundation of every good security decision, in aviation and beyond.

    A simple everyday example

    Think about your home. A burglar in the neighbourhood is a threat. A window left unlocked is a vulnerability. The loss of your belongings, or harm to your family, is the consequence. The risk is the chance that the burglar finds the unlocked window, combined with how bad the result would be.

    Lock the window and the risk falls, even though the burglar is still out there. That simple idea sits at the heart of security management.

    What is a threat?

    A threat is anyone or anything that could cause harm. In security, a threat usually combines intent (the wish to cause harm) with capability (the means to do it). In aviation, threats can range from people trying to carry prohibited items, to criminal activity, to those seeking to misuse their access.

    Organisations usually have little direct control over threats. They can monitor them and understand them, but they cannot simply make them disappear.

    What is a vulnerability?

    A vulnerability is a weakness that a threat could exploit. Vulnerabilities can exist in several places:

    • People: gaps in training, awareness or vigilance.
    • Processes: unclear procedures or checks that are skipped.
    • Physical security: doors, fences or barriers that don’t do their job.
    • Technology: equipment that is poorly maintained or systems that are not protected.

    Unlike threats, vulnerabilities are largely within an organisation’s control. That is why most security work focuses on finding and fixing them.

    What is risk?

    Risk brings everything together. It is the combination of how likely something harmful is to happen and how serious the consequences would be. Risk exists where a threat, a vulnerability and a consequence meet.

    Venn diagram: risk exists where a threat, a vulnerability and a consequence overlap Threat who or what could cause harm Vulnerability a weakness that could be exploited Consequence the harm if it happens Risk Risk sits where all three meet
    Remove any one of the three and the risk is reduced.

    This is why the same threat can mean very different levels of risk in different places. Where vulnerabilities have been addressed, or where the consequences would be limited, the risk is lower.

    Measuring risk

    A common way to compare risks is a risk matrix. Each risk is rated on two scales: how likely it is, and how severe its impact would be. Where the two meet gives an overall rating.

    Risk matrix: likelihood against impact gives low, medium or high risk A simple risk matrix Medium High High Low Medium High Low Low Medium LikelyPossibleUnlikely MinorModerateSevere Impact → Likelihood →
    Higher likelihood and more severe impact mean a higher priority.

    A matrix like this doesn’t give perfect answers, but it helps organisations compare different risks on the same basis and decide where to focus first.

    Managing risk

    Once a risk is understood, there are a few broad ways to deal with it:

    • Reduce it by fixing vulnerabilities, adding layers of protection or limiting possible consequences.
    • Avoid it by stopping or changing the activity that creates the risk.
    • Share it with partners who are better placed to manage part of it.
    • Accept it when the remaining risk is low enough and further measures would not be reasonable.

    Risk management is never a one-time exercise. Threats change, new weaknesses appear and measures can lose their effect over time. That is why it works best as a continuous cycle.

    Risk management cycle: identify, assess, treat, monitor, then repeat A continuous cycle 1. Identifythreats and weaknesses 2. Assesslikelihood and impact 3. Treatreduce, avoid or accept 4. Monitorreview and improve
    Identify, assess, treat and monitor, then start again.

    One important point: risk can be reduced, but it can never be removed completely. Some level of residual risk always remains. The goal is to bring it down to a level that is acceptable and to keep it there.

    Why this matters in aviation

    No organisation has unlimited time, people or money. A clear understanding of threat, vulnerability and risk helps aviation organisations put their resources where they make the biggest difference. That is why the international aviation community encourages a risk-based approach to security, built on several layers of protection rather than a single line of defence.

    It also helps everyone speak the same language. When staff, managers and partners share the same understanding of these terms, conversations about security become clearer and decisions become better.

    The bottom line

    A threat is who or what could cause harm. A vulnerability is the weakness they could exploit. Risk is the likelihood and impact of that happening. Organisations can’t always control threats, but by understanding risk and steadily reducing vulnerabilities, they can make air travel safer for everyone.

    In a future article, I’ll look at another side of risk: data protection. I’d welcome your thoughts in the comments or through the contact page.

    The views expressed here are my own and do not represent the official position of my employer or any regulatory authority. This article is for general awareness only.

  • Why Aviation Security Training Matters for Everyone at the Airport

    When people think about airport security, they usually picture the screening checkpoint: X-ray machines, metal detectors and officers checking bags. But aviation security depends on far more than one checkpoint. It relies on thousands of people across an airport doing the right thing every day, often without anyone watching.

    What makes that possible is training. Good security training turns rules on paper into habits people actually follow.

    Security is everyone’s job

    An airport brings together many different people: airline staff, ground handlers, cleaners, caterers, engineers, retail workers, drivers and contractors. Each of them may notice something unusual, such as an unattended bag, a door left open, or someone in an area where they shouldn’t be.

    International standards recognise this. They expect people working in aviation to receive security training suited to their role, from basic awareness for all staff up to specialist training for those performing security duties.

    The main types of training

    • Awareness training gives everyone with airport access a basic understanding of why security matters, what to look out for and how to report concerns.
    • Role-specific training prepares people for particular security tasks, such as screening, access control or protecting aircraft and cargo.
    • Recurrent training keeps knowledge fresh, because skills fade over time and threats and procedures change.
    • Management and supervisory training helps leaders oversee security, support their teams and respond to incidents.

    What makes training effective

    Not all training is equally useful. A presentation that people sit through once a year is easily forgotten. Training is most effective when it:

    • Explains the “why”. People are far more likely to follow a rule when they understand the risk it protects against.
    • Is practical. Realistic scenarios, hands-on exercises and real examples stay in the memory longer than slides.
    • Fits the audience. A cleaner, a ramp agent and a security officer need different content, in language they understand.
    • Is assessed. Checking understanding shows whether the training actually worked.
    • Is refreshed regularly. Short, frequent reminders are often more effective than long, infrequent sessions.

    The human factor

    Security work can be repetitive, and repetition can lead to complacency. Fatigue, distraction and pressure to work quickly can all affect performance. Good training acknowledges these human factors openly and helps people stay alert, focused and confident in raising concerns.

    Building a security culture

    The ultimate goal of training is not just compliance but a strong security culture, where people see security as part of their everyday job rather than an obstacle to it. In a positive security culture:

    • staff feel comfortable reporting concerns without fear of blame
    • leaders set the example by following the rules themselves
    • good security behaviour is recognised and encouraged
    • lessons are shared openly so everyone can improve

    Training plants the seed, but culture is what keeps security working day after day.

    Travellers have a role too

    Passengers aren’t trained like airport staff, but they still help keep flights safe. Simple habits make a difference: never leave bags unattended, never carry items for strangers, follow instructions at screening, and tell airport staff if something seems wrong.

    The bottom line

    Technology and procedures are important, but people remain the heart of aviation security. Well-trained, alert and motivated people are one of the strongest protections the industry has. That makes investing in training one of the most valuable things any aviation organisation can do.

    I’d welcome your thoughts in the comments or through the contact page.

    The views expressed here are my own and do not represent the official position of my employer or any regulatory authority. This article is for general awareness only.

  • The Threat Already Inside the Fence: Understanding Insider Risk in Aviation Security

    Airport security is designed around a simple idea: everything going airside gets checked. Passengers are screened, bags are X-rayed and liquids are restricted. Yet many people who work around aircraft every day arrive with something no passenger has. They have legitimate access and they know how the system works.

    That is the insider threat. It is widely recognised as one of the most difficult challenges in aviation security. The reason isn’t technical. It’s human.

    What do we mean by “insider”?

    In general terms, an insider is anyone whose job gives them access to secure areas, security-sensitive items or sensitive information, and who uses that access to cause harm or to help someone else cause it. The International Civil Aviation Organization (ICAO) treats this as a priority area and has published guidance and awareness material on the subject.

    Three points are worth stressing:

    • It is not only about terrorism. Insider risk also covers theft, smuggling and the leaking of sensitive information.
    • Not every insider is malicious. Some are unwitting, such as a person who shares an access card or speaks too freely about procedures. Others may be pressured or coerced.
    • “Insider” is a broad term. Airports bring together many organisations and many types of workers, and each brings different practices and cultures.

    Why it is so challenging

    Most security measures aim to keep an adversary out. An insider is already in. Their presence in a sensitive area is normal and expected, and they may understand how security measures work. Around the world, investigations into past incidents have shown how much damage can follow when a trusted person misuses their access.

    The lesson is simple: passenger screening is only as strong as the controls on everyone else who has access.

    Insiders aren’t born. They develop.

    A useful way to think about insider risk is as a journey rather than a moment. A person who was trustworthy when first employed may face very different circumstances years later. Motivations can include personal pressures, life events, grievances, ideology or coercion, usually in combination.

    This is why checks carried out only at the hiring stage are not enough on their own.

    Managing insider risk in layers

    No single measure solves the problem. The widely accepted approach is multi-layered, covering the whole period during which a person holds access. In broad terms:

    • Before access: sound recruitment practices and background checks, repeated over time.
    • During access: giving people only the access their role requires, protecting sensitive information, and applying security measures to staff as well as passengers.
    • Throughout employment: good supervision, trusted reporting channels and attention to staff wellbeing.
    • When access ends: promptly withdrawing credentials and access rights.

    Security culture: the layer that holds the others together

    Procedures and technology matter, but the strongest defence is a workforce that sees security as everyone’s responsibility. People who understand why rules exist, and who feel safe raising concerns, are far more effective than any single control.

    Building that culture takes good training, supportive leadership and consistent communication. It is slow work, and it is the work that matters most.

    Where data can help

    Organisations increasingly use data to support their security decisions. Used responsibly and with proper privacy safeguards, data can help spot unusual patterns and direct attention where it is most needed. It supports human judgement rather than replacing it. I’ll explore this topic in a future post.

    The bottom line

    We have become very good at screening people we don’t know. The harder task is managing risk from people we know and rely on, without creating a culture of suspicion. Getting that balance between trust and verification right is at the heart of modern aviation security.

    I’d welcome your thoughts in the comments or through the contact page.

    The views expressed here are my own and do not represent the official position of my employer or any regulatory authority. This article is for general awareness and discusses publicly available information only.