“Cyber threats could be very serious for the rail sector in the future,” says Karl King, Senior Consultant at Frazer-Nash Consultancy. On the follow-up question ‘why?’, he brings attention to several important facts in implementing the ATO [Automatic Train Operation]. The first one is the technical specifications of the systems used by the railway operators and infrastructure managers. “Historically, railway systems have been purchased with lifespans of 15 to 20 years. The rate of technological advancement these days means this will inevitably lead to a lot of outdated equipment, which could be more easily compromised,” explains Mr King.
Another factor that could have a great impact on the ATO is the dependency of the rail sector from the politicians and political decisions. In some way, this relation results in positive consequences, for example, in terms of state support, subsidies, etc. But from another point of view, the correlation between railways and politics may cause the opposite effect. “No other transport mode has such an intrinsic link between the vehicles and the infrastructure than rail. As the infrastructure is often government-owned, this tends to make railways ‘more political’ and hence more risk-averse than other modes of transport,” explains Karl King.
The next factor is the costs. “The main barrier to implementing ATO is the cost of doing so,” says the Senior Consultant from Frazer-Nash Consultancy. Of course, every innovation requires a lot of activities and costs to develop, test, upgrade and eventually introduce it for the regular service. All these moves make an innovation too expensive at the initial stage of the development. ATO is not the exclusion.
TL;DR? Key points:
* ATO has similar technical security problems that other SCADA (Supervisory control and data acquisition) systems have, and have been struggling to address for some time.
* Mitigating the threats adds to cost of implementing ATO
* ATO (like other railway SCADA/signalling systems) have greater risk of being breached, because of the widely deployed nature of hardware in the public or near public realm (limiting potential physical mitigations for threats)
* Article does not propose any way forward; whole article feels like a teaser for a talk where the authors might say more.
There–that’s 3 minutes of your life back. You are welcome.
@MilesT
To paraphrase Pedantic, one of the joys of selecting the Friday Reads and Industry links is how much I learn from the responses. Thank you.