The rail sector plays a major role in the global transportation industry and serves as the backbone for trade, economic growth and social development. Manufacturing, mining, agriculture, water treatment and consumer goods rely on the rail sector for fast, reliable and environmentally friendly transportation. Today, rail network components represent a bottleneck for vital goods, resources and services.
The rail sector, like many other industries, has seen a push over the last decade to modernize legacy systems, adopt new technologies and increase efficiency and optimization. This often results in a blended ecosystem of computerized equipment interacting with older hardware components—creating numerous systems that need to be integrated and monitored.
As security by obscurity becomes an idea of the past, gaining visibility of operational technology (OT) systems and Internet of Things (IoT) devices is critical to effectively secure the rail sector. In this blog, we’ll review cyber risk scenarios that rail asset owners are facing along with current rail sector regulations and frameworks to help asset owners perform risk analysis. Finally, we’ll share some risk management strategies you can use to protect your critical networks.
What Risk Scenarios Are Rail Operators Facing?
An attack on a rail system could have far-reaching consequences, from supply chain impacts for industries like manufacturing, to interrupted delivery of chemicals used in water purification, impeded fuel delivery, or essential workers being prevented from commuting. In its Railway Cybersecurity publication, the European Union Agency for Cybersecurity (ENISA) describes a variety of cyber risk scenarios for rail operators and patrons. This list is intended to help railway stakeholders when performing a risk analysis.
ENISA outlines the following seven threat scenarios:
- An attacker compromises a signaling system or automatic train control system, causing an accident. While ENISA notes that this is a low likelihood scenario, the potential impact—including possible human casualties—makes it a primary concern for the rail sector.
- Attackers sabotage train traffic supervising systems, stopping rail traffic. This type of attack would use malware designed to allow remote access to the industrial control systems (ICS) that supervise rail traffic.
- Attackers compromise booking management systems to steal clients’ personal data. To carry out this type of attack, malicious actors steal administrator credentials. They then use the credentials to access customer data in order to leak or sell it.
- An unsecure, exposed database leads to a sensitive data leak. Third-party vendors can expose rail networks to this kind of threat when they do not provide adequate cybersecurity.
- A distributed denial-of-service (DDoS) attack prevents travelers from buying tickets. The attacker in this scenario uses a botnet network to inundate devices with requests, making it impossible for users to access them. This type of attack could target the rail network directly or could impact its operations by targeting the network’s Internet Service Provider (ISP).
- The rail network’s IT services are disrupted after a disastrous event. Whether it’s the result of a natural disaster, human error or sabotage, this scenario involves the damage to a data center, which disrupts IT systems and related activities.
In 2019, DSB, the Danish state rail operator, was hit by a DDoS cyberattack impacting its ticketing systems, and successful ransomware attack disrupted ticket sales at stations owned by Italian State Railways and its subsidiaries in 2022. This year in Poland, unauthorized broadcasting of radio signals sabotaged critical rail transport systems. More than 20 freight and passenger trains were brought to a halt via a spoofing attack that triggered emergency stop functionality.
While a ransomware attack impacting rail activities is a top threat scenario, data centers, ticketing systems, or third-party vendors can also be targets for attacks. The complexity of rail systems, alongside the potential risks of third-party vendors, creates a vast and varied attack surface: rail systems comprise sets of trains, tracks, overhead power cables, masts, cantilevers, and signaling systems. Rail operators also maintain and operate signaling systems, traction systems, train control systems, passenger information systems and station infrastructure.
Recently, unmanned trains have become the world’s largest robotic systems - and rely on IoT sensors for efficiency and safety. The criticality of rail systems and operators, alongside their complexity and exposure, make rail systems and businesses an increasingly attractive target for threat actors.
Rail Sector Frameworks and Regulations
While regulations and frameworks vary by country and region, they broadly address aspects such as track maintenance, train operations, safety protocols, employee training, equipment standards and emergency preparedness. Cyber-specific requirements are also growing, drawing on general best practices and industry-driven standards, especially to prevent cyber scenarios with real world impacts.
Railways are considered critical infrastructure in many countries where cyber standards and governance regimes are rethinking their cybersecurity strategies and compliance efforts. Adhering to relevant standards and regulations can be a good first step to reduce the likelihood of a threat actor achieving the risk scenarios outlined above, and of minimizing the damage of a cyber event.
The table below provides an overview of standards, regulations, and compliance measures available to rail operators, some mandatory and some voluntary.
Cyber Risk Management Strategies
Rail organizations can strengthen the security posture of their critical systems and protect against cyber threats by adopting a comprehensive cybersecurity strategy. Frameworks like the MITRE Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) Framework for ICS, and zero trust implementation strategies, can help ensure the safe and reliable operation of critical systems, networks and components.
MITRE ATT&CK for ICS
The MITRE ATT&CK Framework for ICS provides a fast and effective methodology for security operations center (SOC) analysts and incident responders to understand the significance of any detected behaviors. By cataloging and classifying common tactics used in cyberattacks, MITRE ATT&CK can help rail owners and operators develop defense strategies that are based on known threat activities.
The framework categorizes malicious activity into 11 tactics broken down by each step of an attack path from “Initial Access” to “Impact.” Within those 11 categories are approximately 100 unique techniques along with detailed descriptions of specific threats commonly associated with each technique. While it is not a cybersecurity solution and cannot measure the context of an individual organization’s risk profile, its categories are baked into many available security tools on the market.
Zero Trust
The rail sector depends on complex interoperable networks of OT and IoT devices. Some systems cannot be patched or properly hardened, some networks cannot be isolated, and some remote access cannot be severed. To improve cybersecurity in this complex, interdependent sector, a zero trust approach is becoming an increasingly attractive component of defensible architectures. When all devices and applications are consistently managed, segmented and have their privileges minimized by default, malicious actors are less able to exploit third-party vulnerabilities to attack rail network systems.
According to the U.S. National Security Agency, a zero trust model should seek to limit the amount of inherent and unvalidated trust between systems, networks and users through the application of three main principles:
- Never trust, always verify - Use dynamic security policies to authenticate and explicitly authorize every user, device, application and data flow to the least privilege required.
- Assume breach - Operate as if an adversary is already present within your environment. This means denying access to resources by default and continuously monitoring all requests for access, configuration changes and network traffic for suspicious activity.
- Verify explicitly - Use multiple dynamic and static attributes to determine whether to grant access to resources.
A Path Forward for Rail Security
Cyberattacks threaten to disrupt rail operations, cost significant losses in ransomware and remediation efforts, destroy equipment, or cause physical harm. Given the risk scenarios and regulatory requirements that rail owners and operators are facing, it’s increasingly important to build defensible architectures, improve resilience, and manage vulnerabilities.
Avoiding the worst-case scenario and achieving requisite compliance is only possible when cybersecurity teams can accurately detect and respond to the threats they face. This requires four main capabilities: asset visibility, vulnerability management, threat intelligence, and security analytics and anomaly detection.
The Nozomi Networks solution can help rail asset owners get complete visibility into all communicating devices and traffic patterns on their network, and automatically identifies and scores device vulnerabilities. Our platform also builds detection capabilities to alert security teams to potential threats, and correlates threat intelligence information with broader network behavior to deliver maximum security and operational insights.
To learn more, book a demo.
