The telecommunications view: “Risk management depends on agility”

Mr Guus van Es, General Manager BT Consulting, shared the Telco perspective on cyber security. Mr van Es summarised the BT position on cyber security, addressing Internet of Things (in Trains), Digitalization, Cyber, Big Data and analytics Compliance, among other technical aspects relevant to cyber security.

An overview of risk quantification was presented and shown to be key to cyber security strategy. It was shown how numerous companies’ cyber journey may start with denial (e.g. “not my problem”), but soon moves to worry (relevant news awakens), through learning, to then achieving a sound approach.

Cyber security is a business risk because it arises from IT improvements or changes that provide new attack opportunities. Continued innovation will ensure continued risk, and so we must continually evolve our approach. As a sector, Rail needs to understand the need to collaborate (reduce efforts, costs, and risks by sharing), and to follow leading standards and practices.

Cyber threats demand risk management, so we need to consult with practitioners, and should learn lessons about agility, even in policy making.

“CyberSecurity4Rail” Railway Industry Conference - Brussels 4th October 2017

Conference Report

  1. Welcome and overview: “Co-operation is essential in the quest to manage technology and people for security”
  2. Cyber security – don’t be a victim: “Information is power and control of information has unexpected consequences”
  3. The regulators’ view on cyber security: “Multi-modal transport requires data exchange and interconnection”
  4. Security in the SERA – policy considerations: “The need for common understanding, guidelines and best practices”
  5. The Network and Information Security Directive (NIS Directive): “A host of European actions in cyber security”
  6. The railway sector perspective on cyber security: “Integrated approach to security and safety without duplication”
  7. How airlines protect against cyber-attack: “Adversaries are not systems, but people who are smart and who pursue goals”
  8. Secure networks for collaborative services: “Networks are the risk – meshed networks provide a segmented and secure response”
  9. First panel discussion: Product liability, staff training & awareness, information sharing in both safety and security…”
  10. Cyber security and resilience of transport infrastructure: “Current European initiatives in cyber security supporting Rail”
  11. Perspectives from a European railway operator: “Trains as data centres – protecting train IT as a cyber-crime target”
  12. Lessons learned from EU projects SECRET and CYRAIL: “Rail as critical infrastructure requires strong projects to protect it”
  13. Perspectives of a railway infrastructure manager: “Extensive premises, public accessibility – DB managing security risks”
  14. The telecommunications view: “Risk management depends on agility”
  15. The IT provider view: “Understand vulnerability and develop avoidance and mitigation strategies”
  16. Second panel discussion: “The need for co-ordinated action”
  17. Closing keynote address: “Achieving an EURail-ISAC, without replication or over-regulation….”
  18. The Way Forward: “Establishing a European Railway ISAC based on a common understanding”
  19. Annexe - Conference Evaluation Summary – Consensus


Media Partners: