Railway Signalling and Cyber Security
Total Page:16
File Type:pdf, Size:1020Kb
Railway Signalling and Cyber Security Defining guidelines to manage interactions between signalling engineers and security engineers Author: John Boss (s2210428) Date: 20 January 2020 Supervisor: Dr. ir. Jan van der Lubbe, Technical University Delft Second reader: Dr. ir. Pieter Burghouwt, The Hague University of Applied Science A thesis for the completion of the executive master in Cybersecurity from the Cyber Security Academy (A programme by Leiden University, Delft University of Technology and The Hague University of Applied Sciences) This is the public release version, and may be distributed freely John Boss – Railway Signalling and Cyber Security SUMMARY Railway signalling systems were traditionally closed systems using proprietary equipment. Current developments are increasingly using digital networks, open standard protocols (e.g. IP) and more COTS (Commercial Off the Shelf) equipment. Signalling engineers have the challenge to address cyber risks in the signalling system but have limited tools and guidance to do so. The challenge in not just limited to cyber security risks and controls wholly within the signalling system. It is also a “two way street”. Whilst the signalling industry is asking “what is the impact of cyber security on signalling?”, railway companies are asking “What is the impact of signalling on cyber security of the business?”. Railway companies and ministries of transport are seeing the increasing digitalisation with little indication as to how it fits within their cyber security strategies. Cyber security and railway signalling are two different worlds. There are experts in the field of cyber security, and there are experts in the field of signalling. The problem that this paper addresses is the lack of guidelines on how to manage the interaction between these experts to achieve comprehensive cyber security solutions for both the signalling system, as well as the (non-signalling) business systems that have their risk surface impacted by the signalling system. This paper looks at two such experts, a signalling engineer and a security engineer. The one has deep knowledge of signalling systems and limited understanding of cyber security. The other has a deep understanding of cyber security and little to no knowledge of signalling systems. These two individuals need to interact to meet the cyber security challenges described above. The question that this paper attempts to answer is “What are the guidelines for managing interaction between signalling engineers and security engineers?”. The approach looks at the differences between the signalling engineer and the security engineer as well as the environment in which signalling systems are delivered and operate. These are examined to identify the implications they may have for the guidelines. A risk assessment is presented to highlight the types of cyber security risks that need to be addressed, and identify implications for the guidelines. A set of 14 guidelines are then presented that draw on the insights gained. The approach of looking into the different worlds was taken so that the signalling engineer could understand more about security, and the security engineer could understand more about signalling, so much so that the guidelines would appear to be statements of the obvious. It also resulted in a lot of material that needed to be pulled together in a coherent storyline. The following 5 pages contains an overview of the paper. It presents the 14 guidelines against the associated sub questions which they answer and the underlying rationale upon which the guidelines are based. References are included to allow the reader to bounce around the paper to sections that are of interest. Reading from end to end is also an option. Finally, a word of thanks to all the people from railway companies, IMs, ministries, suppliers, the industry and academia who assisted in this research. They gave their time, discussed points of view, provided insights, opened up their secrets, gave access to test labs, reviewed drafts, provided critical challenge and much more. Their assistance was extremely valuable and greatly appreciated. Cover photo: with permission from Banedanmerk A driver console with the ERTMS on board signalling display (blue screen in centre of console). The display brings signalling into the cab, allowing the driver to interact with the signalling system and providing various information to the driver including train speed and movement authority. Page 2 of 100 John Boss – Railway Signalling and Cyber Security The following table provides an overview of the relationship between the research questions, the resulting guidelines and the underlying rationale. The relevant section in this paper where additional detail may be found is shown in parenthesis. The reader should be aware of the definitions in section 1.4 and 1.5. Sub question Underlying rationale Guidelines 1) What is the A comprehensive set of cyber security measures for a signalling system cannot be 1) Cyber security should be directed at system to protect? determined with reference to the signalling system alone. It requires definition of a protecting the business systems. The system SuC that captures all business systems. {2.1.3}. to protect should be the business systems. The environment in which signalling systems are delivered and operate support the To comprehensively address cyber security in focus on business systems: the signalling system, it is first necessary to - Interoperability directive recognises that all operational systems are needed to establish cyber security management across work together to deliver the business {3.1.1}. the business, and then make signalling a part - NIS directive is applicable at the level of “network and information systems of it. {5.1.1}. used in operations” {3.1.3}. - Dutch Railway act refers to whole of infrastructure {3.1.4}. - GDPR does not limit source of attack, only the result thereof {3.1.5}. - NIST SP800-82 addresses cyber security across the business {3.4.1}. - ISO 27001 has an explicit requirement to address the business purpose {3.4.2}. - Standards transcend disciplines to approach cyber security as a pan system problem {3.4.9}. - The railway systems landscape is complex and highly interconnected, single system events cannot be viewed in isolation of the business delivery {3.5.3}. - Government policy requires compliance of the whole railway, not just one subsystem {3.2.1}. The risk assessment shows that there are a number of cyber security risks for the signalling system (as well as cyber security risks for business systems that originate from within the signalling system) that cannot be effectively addressed within the signalling system alone {4.3}. Page 3 of 100 John Boss – Railway Signalling and Cyber Security Sub question Underlying rationale Guidelines 2) Where do - Cyber security needs to be addressed at the business level. The system viewed 2) One person should be responsible for cyber responsibilities by the signalling engineer is not broad enough to address cyber security of the security across the entire business (the CISO). lay? business {2.1.3}. This cannot be the signalling engineer {5.2.1}. - Signalling is limited to “security for safety” (SIL and SL are not the same). Responsibility for the security cannot lay with the signalling engineer {2.2.3}. - Risks need to be calibrated across the business {4.3.1} - The signalling engineer is the system owner of the signalling system, and is 3) The signalling system must remain the responsible for its safe operational performance {2.2}. responsibility of the signalling engineer - EN 51029 requires that the signalling engineer take account of safety related IT {5.2.2}. security threats in the signalling safety case (“security for safety”) {3.4.6}. - The signalling engineer is an expert advisor to the security engineer 4) The interaction between signalling and (identification of vulnerabilities, security architectures etc) within the signalling security disciplines should be based on system {2.2.5}. cooperation but with clearly defined limits of - The signalling engineer is client of the security engineer. The security engineer responsibility. The signalling engineer has proposes cyber security solutions. The signalling engineer may accept or reject three roles: the proposed solution in the signalling system (as system owner) , but then - Client; must also accept the associated cyber risk should the solution be rejected. Risk - Advisor; and associated with that decision should be transparent for the organisation and - System owner. referred to the CISO {2.2.5}. - Balancing the risk of unpatched systems against cost of patching is a Refer Table 6: Responsibilities in regard to management responsibility. Engineering makes the risk and cost transparent to cyber security and signalling. {5.2.3}. facilitate the decision {2.3.4}. - The development lifecycle of a signalling system will need interaction with security engineers to identify system requirements {3.4.5}. - pr TS 50701 is a standard (in development) that maps deliverables between signalling and security system development lifecycles in respect to security for safety {3.4.7}. Page 4 of 100 John Boss – Railway Signalling and Cyber Security Sub question Underlying rationale Guidelines 3) What Safety management remains the responsibility of the signalling engineer {2.2.5}. 5) A risk based cyber security management management The environment in which signalling systems are delivered and work also require system should be implemented. system is security risk management: required, and - NIS directive requires operators to take “appropriate and proportional” The CSMS is the responsibility of the CISO. by whom is it measures to manage risk {3.1.3}. managed? - EIM promotes the use of risk management in cyber security {3.3.1}. This includes production and maintenance of a - NIST Framework recommends the use of a risk based management system consolidated risk register across the whole {3.4.1}. business. - ISO 27001 defines requirements for ongoing risk assessment in information security management systems. ISO 27005 defines requirements for IT risk The Safety Management System remains management system {3.4.2}.