One Security at the Airport: How BER Is Tackling Hybrid Threats and Complexity

Klaus Mochalski and Oliver Braun (SVP of Corporate Security at BER Airport) discuss the immense complexity of airport security. Learn why traditional silo thinking fails in the face of hybrid threats and why physical security and cybersecurity must be integrated under a “One Security” approach. Braun also explains why compliance-based security alone is insufficient and how KRITIS operators can build true resilience through cross-departmental training.

Duration:

28 min

Guest in this episode:

Oliver Braun

SVP of Corporate Security at BER Airport

FAQ

Facts on the topic

Why is OT security at an airport fundamentally different from a standard manufacturing plant?

In a traditional production facility, the perimeter is strictly controlled: only authorized personnel and verified vendors are granted access. An airport, however, is an open ecosystem handling millions of passengers who are themselves an integral part of the operational process chain.

The Challenge: The greatest threat in modern aviation security today is managing this inherent complexity. When physical passenger flows, baggage handling systems, and IT/OT networks are deeply intertwined, a disruption in one area triggers immediate, massive ripple effects across the entire operation.

‍

What does the "One Security" approach mean for Critical Infrastructure (CRITIS) operators?

"One Security" refers to dismantling the organizational silos between physical security and cybersecurity under a unified Security Governance framework. With modern hybrid threats, it is often impossible to immediately identify the root cause of an incident—was it human error, physical sabotage, or a cyberattack? The Takeaway: World-class cybersecurity is meaningless if an unauthorized individual can physically walk into a data center. Organizations must evaluate and manage risks holistically rather than in isolated departments.

‍

How does critical infrastructure regulation (like the CRITIS Umbrella Act) impact physical and cyber security alignment?

Modern critical infrastructure regulations require operators to build holistic operational resilience. Regulated entities can no longer treat cybersecurity and facility protection as separate disciplines. Regulatory frameworks increasingly mandate that physical protective measures (such as perimeter security and access control) and digital safeguards (such as OT monitoring and SIEM integration) are completely aligned. Meeting paper compliance is no longer enough, true physical and digital resilience in a crisis is what counts.

How can critical infrastructure operators shift their security mindset from reactive to proactive?

To build effective defenses against modern adversaries, security teams must adopt an external threat actor perspective:

Think Like an Adversary: Attackers do not care about internal organizational boundaries; they simply look for the weakest link in the system to cause maximum disruption.
Break Down Internal Silos: IT, OT, and physical security teams must conduct joint risk assessments and execute cross-departmental incident response drills.
Anticipate Threats Proactively: Instead of merely reacting to alerts, teams must proactively map out complex threat scenarios in advance and maintain efficient, cross-functional response plans.

‍

Summary

‍

Sound Bites

Oliver Braun: “The challenges lie precisely in the fact that, in a factory, I have a secure perimeter, and only trusted suppliers and employees who are familiar with the production chain are allowed to enter that factory. We essentially have the passengers, who are, of course, human beings, who are also part of this travel chain and this operational chain.”

Oliver Braun: “So, from our perspective, the biggest challenge in modern aviation security isn’t the threat itself but managing the complexity of the threat.”

Oliver Braun: “And One Security is, in our view, the only solution, because you simply can’t think about these issues in isolation. After all, we’re not always sure whether it’s human error or a cyberattack.”

Oliver Braun: “The KRITIS-DG does regulate this, after all, and makes it clear that even the best cybersecurity is of no use if the data centers aren’t properly secured physically. And if the physical security of the perimeter isn’t in place, we have to harmonize these measures, which is why we must also assess the risks together.”

Oliver Braun: “You need security governance, that’s really my advice to everyone. You have to break down those silos; even though it’s nice and even though everyone used to be able to make their own decisions, those days are over, and it’s no use if cybersecurity passes a great audit but physical security fails. It really only works when we work together.”

Oliver Braun: “Our adversaries are really just asking themselves, ‘Where can they disrupt us?’ And that perspective is what we’re all missing. [...] I believe that’s the mindset we need to develop, not just sitting there and reacting, but proactively thinking things through and having the most efficient and comprehensive responses ready.”

‍