The railway sector perspective on cyber security: “Integrated approach to security and safety without duplication”

Dr Libor Lochman, executive Director of the Community of European Railway and Infrastructure Companies (CER)1 emphasised CER business priorities: Legislation; Digitalisation; Rail Corridors; Regulatory Framework. These are strongly inter-linked by concerns over Cybersecurity, especially since Railway Corridors cannot be realised without interconnection of information and control systems to meet the demand of railways, their staff, and their customers. Integration provides a win-win partnership, and needs a secure collaboration to ensure gains are not interrupted or challenged. Intentional as well as accidental cyber threats need to be better understood and remedied. A shared approach can ensure minimisation of disruption/loss of precious concerns: rail services; economic losses; commercial/sensitive information; reputation.

The coordinated security strategy should be proportionate, holistic, flexible, and based on cooperation between a range of actors (RU, IM, National Authority, Suppliers, Service Providers, Cybersecurity Expertise, etc.).

The railway approach must address a range of concerns: risk assessment; clear technical, procedural, managerial security measures; training and awareness; information sharing about good practice.

Rail compliance with the NIS Directive is necessary, and an EU-Rail ISAC should not lead to duplication. It should benefit from an integrated approach alongside current cooperative developments such as the “Common Safety Methods” which already includes the proposed Rail “Common Occurrence Reporting” System. Enhanced cooperation and coordination should emphasise a better exchange of information and best practices to benefit all actors in the development of an increasingly cyber-secure European Rail Area.

Dr Lochman recommended that further European action could usefully identify main obstacles, foster Research and Technology Development (RTD), overcome resistance, and help with finance of new shared actions.


1 CER - http://www.cer.be



“CyberSecurity4Rail” Railway Industry Conference - Brussels 4th October 2017

Conference Report

  1. Welcome and overview: “Co-operation is essential in the quest to manage technology and people for security”
  2. Cyber security – don’t be a victim: “Information is power and control of information has unexpected consequences”
  3. The regulators’ view on cyber security: “Multi-modal transport requires data exchange and interconnection”
  4. Security in the SERA – policy considerations: “The need for common understanding, guidelines and best practices”
  5. The Network and Information Security Directive (NIS Directive): “A host of European actions in cyber security”
  6. The railway sector perspective on cyber security: “Integrated approach to security and safety without duplication”
  7. How airlines protect against cyber-attack: “Adversaries are not systems, but people who are smart and who pursue goals”
  8. Secure networks for collaborative services: “Networks are the risk – meshed networks provide a segmented and secure response”
  9. First panel discussion: Product liability, staff training & awareness, information sharing in both safety and security…”
  10. Cyber security and resilience of transport infrastructure: “Current European initiatives in cyber security supporting Rail”
  11. Perspectives from a European railway operator: “Trains as data centres – protecting train IT as a cyber-crime target”
  12. Lessons learned from EU projects SECRET and CYRAIL: “Rail as critical infrastructure requires strong projects to protect it”
  13. Perspectives of a railway infrastructure manager: “Extensive premises, public accessibility – DB managing security risks”
  14. The telecommunications view: “Risk management depends on agility”
  15. The IT provider view: “Understand vulnerability and develop avoidance and mitigation strategies”
  16. Second panel discussion: “The need for co-ordinated action”
  17. Closing keynote address: “Achieving an EURail-ISAC, without replication or over-regulation….”
  18. The Way Forward: “Establishing a European Railway ISAC based on a common understanding”
  19. Annexe - Conference Evaluation Summary – Consensus



 

Media Partners: