Why Cybersecurity Compliance in Rail Transportation Has Never Been More Important, Or More Challenging to Keep on Track

As the world’s Rail transportation industry becomes more sophisticated, embracing digital technologies to enhance efficiency, safety, and operational capabilities, it is also exposed to a myriad of cybersecurity threats. The Internet of Things (IoT) has ushered in the use of sensors on trains, tracks, and platforms that allow entire rail systems to be interconnected and monitored in real-time. However, all of these various system touch-points can also be an opening that a hacker needs to gain access to the network and wreak havoc.

As a result, cyber attacks on the rail industry have become much more common, and in October 2022, the TSA issued a cybersecurity security directive for passenger and freight railroad carriers to enhance cybersecurity resilience. It requires railroad carriers to conduct a regular cybersecurity vulnerability assessment that examines current practices, identifies risks to IT and OT systems, and outlines a full plan for remediation. In particular, it calls for network segmentation policies and controls that keep operational technology systems separate from other IT systems as a safeguard in case of a breach.

Meanwhile, attacks targeting railroad cybersecurity persist. In April 2023, the Alaska Railroad Corporation, a state owned Class II railroad operating freight and passenger trains, was attacked, surrendering sensitive information about its employees and vendors. In August, the Belt Railway Company of Chicago, which operates the nation’s largest switching and terminal railroad, had data stolen in a ransomware attack. And in September 2023, the Norfolk Southern Corporation saw rail operations disrupted due to an attack on its data center, impacting their dispatching system, train movements, and functionality of their terminal operating system.

It’s not just the disruption of rail service and stolen data that is at risk. Passenger and railway worker safety is also compromised. According to Control Global, to date, rail cyber-related incidents involving municipal railways, mass transit, long-distance passenger rail and freight, have killed hundreds of people globally. Ensuring the cybersecurity compliance of rail transportation networks is critically imperative, yet it comes with its own set of challenges.

Rail Network Security is Complicated

Rail transportation systems have evolved into intricate networks of interconnected systems, including train control systems, signaling systems, communication networks, and passenger information systems. The complexity and interdependence of these systems create a challenge in maintaining comprehensive cybersecurity. A breach in one system can potentially compromise the entire network, making it crucial to address vulnerabilities across the entire infrastructure.

Legacy Infrastructure

Many rail systems worldwide rely on legacy infrastructure that was not designed with modern cybersecurity threats in mind. Aging hardware and software components often lack the necessary security features, making them more susceptible to cyber attacks. Upgrading these systems to meet current cybersecurity standards poses a significant challenge due to financial constraints, operational disruptions, and compatibility issues.

Regulatory Compliance Standards

The rail transportation sector is subject to various regulatory frameworks for securing industrial automation and control systems – including the widely adopted IEC 62443, IEC 63452 and CLC/TS 50701 standards. However, complying with these cybersecurity requirements can be complex. Rail operators must know how to navigate the landscape of evolving regulations, requiring constant vigilance and adaptability to remain compliant.

Data Protection and Privacy Concerns

Rail transportation networks generate and handle vast amounts of sensitive data, including passenger information, operational data, and maintenance records. Protecting this data from unauthorized access, disclosure, or tampering is a critical aspect of cybersecurity compliance. Ensuring compliance with data protection and privacy regulations, such as the General Data Protection Regulation (GDPR) in Europe, adds another layer of complexity to the cybersecurity for rail networks.

Supply Chain Risks

The supply chain for rail transportation systems involves various vendors and third-party suppliers. Each link in this chain presents a potential entry point for cyber threats. Ensuring the cybersecurity of the entire supply chain is challenging, especially when dealing with global suppliers. Vetting and monitoring the security practices of all involved entities is essential to preventing vulnerabilities from being introduced at any stage of the supply chain.

Human Factor

The human element remains a significant factor in cybersecurity compliance challenges. Employees, from train operators to IT and OT professionals, must be educated and trained to recognize and respond to cyber threats. Social engineering attacks, such as phishing, can exploit human vulnerabilities, making it essential to instill a cybersecurity-aware culture throughout the organization.

Meeting the Cybersecurity Challenge Starts with Network Segmentation

As rail transportation networks continue to evolve, the cybersecurity challenges they face will persist and even intensify. One specific way to protect these networks is through network segmentation. Network segmentation involves dividing the network into smaller subnetworks, or segments, and restricting access between them. This can be accomplished by implementing firewalls, access control lists, and other security measures to control traffic flow between segments.

Network segmentation limits the scope of a cyber-attack. If a hacker gains access to one segment, they are prevented from moving laterally to other parts of the network. It also allows for more granular control of security policies. Different segments can have different security policies depending on their level of criticality. Segmentation can also be used to isolate systems that are not subject to regulatory requirements, making it easier to demonstrate compliance with standards.

Conclusion

Addressing these challenges will require a holistic approach that combines technology upgrades, adherence to regulatory frameworks, and a robust cybersecurity culture. The rail industry must invest in modernizing its infrastructure, stay abreast of cybersecurity regulations, and foster a cybersecurity-conscious workforce to ensure the safety and security of both passengers and critical transportation assets. Only through a comprehensive and proactive strategy can the rail industry keep its cyber security from going off the tracks.

About the Author

Robin Berthier is Co-Founder and CEO of Network Perception, a startup dedicated to designing and developing highly-usable network modeling solutions. Dr. Berthier has over 15 years of experience in the design and development of network security technologies. He received his PhD in the field of cybersecurity from the University of Maryland College Park and served the Information Trust Institute (ITI) at the University of Illinois at Urbana-Champaign as a Research Scientist.

Robin can be reached at [email protected]. More information about Network Perception can be found at www.network-perception.com/