Cyber Defense eMagazine March Edition for 2022

intruders were able to gain control over simulated assets. 1 Would-be attackers’ knowledge of railway
systems has progressed even further in the seven years since this experiment.
On the one hand the distributed network architecture of the railway infrastructure allows incredible
adaptability and for the use of a wide variety of modular assets. On the other hand, many of these assets
are no longer up-to-date or patchable. So, the fast-changing nature of cyber threats clashes with/comes
up against the long service life and diversity of equipment, making the enforcement of security policies
daunting. The same high-connectivity pathways that increase accessibility for trusted railroad engineers
also increase accessibility for malicious intruders, which is why specially designed cybersecurity
appliances and software can be so essential.
Every system needs individual protection
Each rail subsystem is a different set of assets with its own individual cybersecurity requirements. Every
rail subsystem application classified as security-relevant has been systematically type-tested and
secured according to the relevant certifications before leaving the factory. However, the downside of
certifications is that they introduce general patterns into defenses that hackers can learn to anticipate
and exploit. Defenses for critical services need to go beyond the bare minimum necessary to meet
certifications or regulations and include protections that give hackers a hard time. Furthermore, the
ongoing support of dedicated security researchers is necessary to adapt these defenses against new
cyber threats.
User-friendly tailored solutions
Cybersecurity begins with education of the staff, but the busy day-to-day work of railway personnel rarely
leaves space for that. Thus, all defensive solutions must be as failsafe and streamlined as possible to
promote ease of use. Ideally railway subsystems need appliances that have the necessary protocol
sensitivity to check network traffic for suspicious actions and deny unusual or unlikely behavior. Such
appliances have the further benefit of significantly reducing the likelihood of human error.
Each subsystem is dependent on solutions created to meet its specific needs. TXOne Networks suggests
an OT zero trust approach to securing operational environments, which includes three phases:
segmenting networks, scanning inbound and mobile assets with a portable rapid-scan device, and
securing endpoints with defensive solutions tailored to the endpoint’s type (legacy or modernized).
Stop intruders and isolate malware
Traditional intrusion prevention systems (IPSes) were mere filtering systems, which are no longer
adequate protection for critical infrastructure networks. Instead, modernized solutions like TXOne’s Edge
series of next-generation IPSes and firewalls bring more sophisticated protection to assets at the station
and wayside. Edge series defenses, based on the OT zero trust methodology, detect suspicious behavior
1
Vlad Gostomelsky, “Securing the Railroads from Cyberattacks”, Mass Transit Magazine, Dec 17 2019
Cyber Defense eMagazine – March 2022 Edition 81
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.