More and more, the railway sector is becoming a victim of cybercriminals. On its part, the industry is reacting to threats through projects such as the EU 4SECURail and an encompassing approach to cybersecurity.
Embodying this new approach is UK cybersecurity specialist company RazorSecure, which has recently partnered with rail telecommunications company Comtest Wireles to integrate the industry’s approach.
RazorSecure CEO Alex Cowan says that: “by combining our expertise with that of Comtest Wireless, we can deliver a best-in-class solution that reduces risk and provides peace of mind across the on-train networks, and the wider trackside networks.”
“Cybersecurity is an increasingly important issue across the rail sector and this partnership is a natural extension for Comtest Wireless,” comments Comtest Wireless Steve Dance. “Our partnership with RazorSecure takes this to the next level as our complementary expertise enables both companies to offer an end-to-end solution for rail cybersecurity globally.”
Cowan explains the current risks for the industry and what the partnership with Comtest Wireless can do to help prevent attacks.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalData
Credit: RazorSecure.
Ilaria Grasso Macola (IGM): Why have networks for rolling stock and track signalling historically been separate?
Alex Cowan (AC): The historical view is that signalling and control of the track systems was separate from the operation of the vehicles. This is because they are functionally different and have somewhat different goals and time horizons for the development of new technology.
This view has changed, as it is difficult to build new track, but there are clear benefits to making better use of existing track through digitalisation and bringing together the control of the vehicles with signalling systems.
With the increasing digitalisation of the railway network, particularly the signalling information being broadcast onboard a train (so the driver looks in their cab for information instead of out of the cab window), this system separation makes less sense, and in fact, might create new vulnerabilities.
Increased and strengthened interactions and communications between the train and trackside becomes ever more important. A “lost in translation” moment between the driver and signaller needs to be avoided at all costs.
IGM: What were the perks of this separation?
AC: The benefits of the separation of the train rolling stock and signalling information were in many cases a by-product of the fact that the technologies used were more analogue electronics and mechanical than connected digital systems.
The benefits of this approach were mainly around the clear separation of function and the controlled interactions between track and train.
The main advantage that legacy train and trackside systems had is that they were much simpler from a digital/software perspective. They are significantly harder to maintain from a cost perspective and modern systems will be more reliable and cost-effective.
IGM: Why is now a need for an all-encompassing cybersecurity system?
AC: The rail industry has an incredibly effective culture around safety – the rail network is a very safe place to work and commute. But three or four years ago, when we spoke to the rail industry about cybersecurity, the conversation would generally cover the topic of protecting data, rather than the protection of safety-critical systems.
As more systems are being integrated on the rolling stock and signalling networks, the number of systems that are potentially vulnerable also increases. A typical modern digital train includes upwards of a hundred digital systems.
Each of these is potentially a vulnerability unless it is protected, and with a mid-size fleet of a hundred trains, there are tens of thousands of systems that require protection. The sheer number of systems, some of which might be quite old and difficult to update, can present a large attack surface.
The growing importance of cybersecurity to the rail industry’s long-term commitment to safety is now driving the industry to consider that if a train is not secure, then it can no longer say that it is safe.
IGM: Let’s talk about your partnership with Comtest Wireless. How did it come about?
AC: Comtest Wireless is a leader in rail telecoms, ETCS signalling & interlocking test, measurement & monitoring solutions. RazorSecure’s historical focus has been on securing the systems on the train itself, focusing on potential ways that hackers could penetrate the management and operational systems. Increasingly, these two networks (track and train) are coming together – often in the driver’s control interface.
By offering a combined cybersecurity solution, the new partnership between Comtest Wireless and RazorSecure delivers one integrated cybersecurity solution across the entire rail network – whether on the train itself, the signalling, or the track.
This is particularly important as the rail industry moves to integrate more networks across both rolling stock and wayside systems, providing further opportunities for hackers to probe vulnerable systems, gain entry, and then move laterally between the different systems on the network.
IGM: What will RazorSecure’s role be? What about Comtest Wireless?
AC: RazorSecure’s expertise is in creating cybersecurity solutions for train manufacturers and operators. Our customers are rail manufacturers such as Siemens and operators such as West Midland Railway, Northern, and Capitol Corridor. RazorSecure is primarily focused on protecting rolling stock from the risk of cyberattack and we do this through a combination of hardware and software.
In November 2020, Comtest Wireless launched NetProbe Owl, a cyber sniffer for GSM-R & ETCS security monitoring.
Each company has its own complementary expertise, which enables them to be a great fit for a rail cybersecurity partnership. Both companies operate in different networks that are critical to maintaining an efficient rail system, so it made a lot of sense to bring our strengths together to deliver an effective collaborative solution for the industry.
IGM: What will this partnership bring to the wider railway industry?
AC: For the rail industry this partnership offers a single simple and elegant solution able to quickly identify and eradicate cyber risk from vulnerable networks. Remember, a network is only as secure as the weakest point of entry. That might be a piece of network signalling that is very old and has not been updated; it might be a system on the rolling stock that can be penetrated.
Our combined solution with Comtest Wireless allows us to offer protection to the entire rail industry.
IGM: In the last few years, more railways have become victims of cyberattacks. Why is that?
AC: Historically the cybersecurity industry has focussed on protecting data from viruses or attacks that are typically launched against machines of which there are millions worldwide. This makes it simpler to identify an attack and subsequently protect other machines from the same vulnerability.
However, this relies on the same attack being detected across a wide variety of systems, an approach that works well in an enterprise environment because of the millions of Windows PCs and Linux servers that exist around the world.
A rail environment is very different, each fleet will have a unique network design with a variety of systems that may not have been integrated before. The fleet itself operates over a long period of time and is subject to configuration drift as maintenance occurs or systems are replaced. The uniqueness of this environment, combined with the strict requirements for safety, makes it significantly harder to protect.
The reality is that rail requires a combination of techniques in order to improve cybersecurity, it isn’t just a case of deploying a firewall or a single control. It requires management over the entire life of the train.
IGM: What can the industry do to protect itself?
AC: First, the rail industry needs to have a clear understanding of the numerous connected train and trackside systems. Trains often have a lifespan of 25 years or more and will undergo changes during their lifespan with new connected systems added by each owner or operator. There are trains operating today that predate the internet era and certainly the mobile data era. As information systems are added, replaced and connected, vulnerabilities can appear. The first priority is therefore to identify all the connected systems on a network and understand the behaviour and traffic flows between them.
Next, the industry has to implement the proper cybersecurity monitoring systems to ensure that anything out of the ordinary is identified and stopped in real-time.
Finally, these monitoring systems need to record anything out of the ordinary. Our Security Gateway is intended to be a security “black box” for the railway industry to record and identify potential cybersecurity risks so these can be stopped in real-time and networks can adapt to new threats.
Much of what makes the railways safe is passenger information systems, train management systems and communications between trains and signalling. A compromised system is a risk not only to security but passenger safety, and we want to work with the industry to help ensure safety and security are delivered hand in hand.
