Cybersecurity in Railways and Metro Rail Systems: Challenges and the Way Forward

By Akash Deep Srivastav, Joint General Manager (IT), Uttar Pradesh Metro Rail Corporation Ltd.

In an increasingly digitized world, the transportation sector has undergone a significant transformation, with railways and metro rail systems embracing technological advancements for efficiency and convenience. Critical infrastructure systems such as railways and metro rail systems have become increasingly reliant on digital technologies and networked systems to ensure efficient operations. While these advancements offer numerous benefits, they also introduce a new realm of vulnerabilities and threats in the form of cyberattacks. Cybersecurity in Railways and Metro Rail systems has emerged as a paramount concern, necessitating proactive measures to protect these vital transportation networks. Protecting critical infrastructure such as railways and metro systems from cyber threats is imperative to ensure passenger safety, operational integrity, and public trust.

The Digital Transformation of Railways
Passenger safety has been the dominant theme in the railway industry till now. It has been considered as safe with respect to cybersecurity issues, mainly because it relies on proprietary systems, segregated networks and specific protocols for operations, communication and signalling.

However, the railway sector is undergoing digital transformation with the advent of Information Technology. The changing landscape of digital solutions, combined with increasing customer demands are pushing railways to replace their existing legacy systems with more modern and standard based infrastructure such as IP communication networks, to improve reliability, efficiency, capacity as well as comfort of passengers.

The internet technologies enabling such digital revolution are also bringing new challenges. The Communication Based Train Control (CBTC) system, wireless connectivity, unattended train operations, Wi-Fi in the train, Automatic Fare Collection System and use of IoT devices are so pervasive now that the system cannot be considered closed to cyber-attacks anymore.

Challenges in Cybersecurity for Railways and Metro Rail Systems

1. Complex Network Infrastructure: Railways and metro systems rely on intricate networks of interconnected components, including signalling systems, train control systems, communication networks, fare collection systems and more. Each of these components presents a potential entry point for cyberattacks.

2. Legacy Systems: Many rail systems still operate using legacy technologies that were not designed with modern cybersecurity threats in mind. These outdated systems may lack robust security features, making them vulnerable to exploitation.

3. High Connectivity: The increasing connectivity among various systems, both within the rail infrastructure and with external networks, enhances convenience but also increases the attack surface for malicious actors. The ease of online ticket booking for instance has made ticketing systems prone to cyber attacks and frauds.

4. Human Factor: Insider threats and human error remain significant challenges in maintaining cybersecurity. A simple mistake or a compromised employee could lead to a breach. A simple click on a phishing mail by an employee could jeopardise the entire system.

5. Lack of Security Culture: Developing a cybersecurity-aware culture within rail organizations can be challenging, especially when the primary focus has traditionally been on safety and operations.

6. Limited Resources: Most railway and metro systems may struggle with limited budgets for cybersecurity measures, making it difficult to implement advanced security solutions.

Recent Incidents and Wake-up Calls

Several incidents around the world have underscored the potential impact of cyberattacks on railways and metro rail systems. Notable examples include the 2017 “NotPetya” ransomware attack, which disrupted Ukraine’s rail system, and the 2022 cyberattack on the Danish Railway system, which affected train operations and passenger services. These incidents serve as stark reminders of the vulnerabilities inherent in these systems.

The Way Forward: Strategies for Enhancing Cybersecurity

1. Risk Assessment and Management: Conducting regular risk assessments to identify impact and potential threats is crucial. Mindless investment in high end cyber security solutions without doing a proper risk assessment could lead to more harm than benefits. Proper risk assessment enables the development of tailored cybersecurity strategy.

2. Modernization and Updates : Investing in the modernization of legacy systems can enhance their security posture. This includes deploying advanced intrusion detection and intrusion prevention systems to help identify and stop cyberattacks in real-time and minimizing potential damage. Regular software updates, patch management, and transitioning to more secure technologies is a must.

3. Segmentation and Isolation : Implementing network segmentation can help contain the impact of a cyberattack by preventing lateral movement within the network. Critical systems should be isolated from less critical ones.

4. Employee Training and Awareness : Providing comprehensive training to employees about cybersecurity best practices is essential. They should be vigilant against phishing attempts, social engineering, and other common attack vectors.

5. Collaboration and Information Sharing : Establishing partnerships and platforms for information sharing within the railway industry can help disseminate knowledge about emerging threats and effective mitigation strategies. Also, in Indian context threat intel sharing from NCIIPC and CERT-In can be hugely beneficial.

7. Incident Response Planning : Developing robust incident response and business continuity plans ensures that, in the event of a cyber incident, the organization can effectively mitigate the effects and get the business operations back on track swiftly.

8. Regulations and Standards : Governments and regulatory bodies like CERT-In and NCIIPC can play a crucial role by setting cybersecurity standards and regulations specific to railway systems. Compliance with these standards can drive improvements across the industry.

Conclusion

As railways and metro rail systems continue to evolve in the digital age, the importance of cybersecurity cannot be overstated. The potential consequences of a successful cyberattack on these critical transportation networks are too great to ignore. By acknowledging the challenges, implementing proactive measures, and fostering a cybersecurity-focused culture, the railway industry can pave the way for secure, efficient, and resilient operations in the face of emerging cyber threats.