Rail cybersecurity refers to the technology and processes that aim to secure rail systems, operations, and passengers from cyber attacks.
To be effective, rail cybersecurity solutions must be built specifically for the rail’s unique architecture, and have the ability to monitor, identify, and quickly respond to cyber incidents. Equally important, railway operators, infrastructure managers, and OEMs need to know what actions to take to prevent and mitigate threats.
As the prevalence of cyber attacks against rail organizations rises, rail cybersecurity has become a top priority on both the organizational and national levels — as it should.
Properly managing rail cyber risks is crucial. Today, increasingly connected OT, IIoT, and third-party software introduce new attack vectors.
In this article, we will explain what rail cybersecurity is, why it needs to be a priority for all rail professionals, and how to fulfill emerging security standards.
Why Rail Cybersecurity is Demanding More Attention
As the industry undergoes digital transformation, operational systems, control systems, signaling systems such as ETCS, and telecommunications networks are becoming highly interconnected. Bespoke stand-alone systems are being replaced with advanced, digitally connected assets that can be accessed remotely by public and private networks.
The vulnerabilities these systems introduce have become attractive targets to malicious actors.
According to Gartner, by 2025, 30% of critical infrastructure organizations, such as rail, will experience a security breach that will result in halting operations or mission-critical systems.
The NIST outlined six key rail cybersecurity threats to be aware of:
1. Delaying or intercepting the flow of information through the ICS networks, which could disrupt or halt ICS operation
2. Making unauthorized changes to instructions, commands, or alarm thresholds, which could damage, disable, or completely shut down equipment. Such changes could lead to environmental impacts and passenger harm.
3. Sending false information to system operators, either to disguise unauthorized changes or to cause the operators to initiate inappropriate actions.
4. Inserting malware into ICS software or modifying configuration settings.
5. Interfering with the operation of equipment-protection systems, which could damage costly equipment that is difficult to replace.
6. Disabling or interfering with the operation of safety systems, which could endanger human life.
The ability for a malicious actor to hijack and control crucial operational, safety, and communication systems should be a major concern for both rail organizations and national governments. By 2023, Gartner predicts that the financial impact of cyberattacks to OT and other cyber-physical systems, resulting in fatal casualties, will reach $50 billion.
As we can see from recent railway cyber attacks, attacks on OT assets have become more common, and the effects are costly.
3 Key Cybersecurity Standards to Know
Federal governments all over the world have introduced new regulations and standards designed to reinforce rail cybersecurity and prevent attacks. Here’s an overview of the three most important ones:
1. In the EU, the European Committee for Standardization (CEN) released CLC/TS 50701 in 2021. This technical specification, also referred to as “Railway Applications Cybersecurity,” includes requirements and recommendations for protecting rolling stock and fixed installations in a unified way across Europe.
2. The TSA took an even stronger approach with the release of its Security Directive 1580-21-01. The Directive, effective December 31, 2021, applies to all freight railway carriers (owners and operators), and compels them to the following four actions:
- Designate a cybersecurity coordinator who will be available to the TSA and the Cybersecurity and Infrastructure Security Agency (CISA) at all times;
- Report all cybersecurity incidents to CISA;
- Develop a cybersecurity incident response plan to reduce the risk of operational disruption;
- Conduct a cybersecurity vulnerability assessment according to TSA’s directions.
3. In an effort to fortify rail cybersecurity globally the International Electrotechnical Commission (IEC) adopted a series of standards known as IEC 62443, which provides a flexible framework for addressing and mitigating security vulnerabilities in industrial automation and control systems (IACSs). The standards address various rail stakeholders, including operators, service providers, and manufacturers, and offer role-specific approaches to prevent security risks.
Learning about these standards, as well as guidance on how to fulfill them, encourages railway operators and manufacturers to strengthen cybersecurity defenses by implementing a security-by-design approach, where cybersecurity protocols are included in the design of the project.
Strengthen Your Defenses With a Solution That’s Built For Railway
To ensure safe and reliable transport, and at the same time avoid operational disruption, railway organizations require a cybersecurity solution that is built specifically for the domain’s protocols, technologies, methodologies, and systems. It must be designed to fit into railway systems’ unique architecture, operational workflow, and address their vulnerabilities.
A rail cybersecurity solution such as Cervello does just this.
A solution designed specifically for railways replaces the traditional perimeter defense model with a Zero Trust, yet fully passive and non-intrusive framework. Cervello’s proven methodology for rail cybersecurity involves five steps:
1. Integration – A flexible and scalable integration fitted to quickly start monitoring railway infrastructure without causing any system downtime or interfering with highly sensitive railway networks is fundamental.
2. Visualization – Cervello maps and segments all connected assets and clusters into their respective security zones. This gives rail operators and infrastructure managers the necessary context to impose safety restriction, meet railway safety standards, and quickly respond to suspicious activity.
3. Detection – Cervello uses a fully passive, non-intrusive approach that assumes any connection or command is suspicious, providing early threat recognition.
4. Investigation – When a threat is discovered, our platform performs deep forensics to produce a precise view and complete threat profile, including all of the potentially impacted connected systems, assets, and operational consequences.
5. Response – Once the platform identifies the source of the attack, it immediately dispatches a highly optimized and actionable response playbook on how to remediate the threat and contain any operational disruptions.
To protect core rail functions — including signaling systems, telecommunications, and rolling stock — a rail cybersecurity solution is a must. It is built to understand the unique needs of each system, dynamically map corresponding and interconnected assets, and monitor commands for suspicious activity.
3 Actionable Steps to Start Enhancing Your Rail Cybersecurity
Here are three concrete ways to start building up your rail cybersecurity defenses.
1. Become informed on rail cybersecurity standards and best practices. Increasing regulatory oversight and requirements may seem overwhelming, but becoming familiar with new standards and best practices will help position you to more easily manage them. For example, check out the NIST Framework and CISA Toolkit. For European rail organizations, take ENISA’s recommendations into account.
2. Assess your current security posture and risks. A railway solution is built to fit into rail’s unique architecture. It continuously maps and segments your OT assets, signaling system technologies, IIoT, and more to gain a holistic view of your entire security posture. With this visibility, it’s easy to identify existing vulnerabilities and security gaps.
3. Evaluate your cybersecurity governance. Today, rail organizations need a formal and systematic approach to defining and enforcing cybersecurity processes. Moreover, it must be embedded into the core of your organization — not tacked on as an afterthought. Assigning a CISO to lead rail cybersecurity, as well as building a CSOC to create a cyber incident response plan, is essential to adequate cybersecurity governance.
The Rail Cybersecurity Imperative is Rising
Understanding the prevalence, threat, and impact of cyber attacks — as well as how you can prevent and mitigate them — is essential.
Railway operators, infrastructure managers, and manufacturers are all seeing their roles expand to include rail cybersecurity awareness and know-how. The only way to protect operations, infrastructure, and passengers is by being prepared. With the right knowledge base, cybersecurity solution, and processes, it’s possible to strengthen your defenses and prevent cyber attacks from causing irreparable damage.
