Skip to main content

Rail OT Cyber Security

 

Digital Transit Limited offer a one-day workshop, or 6 week modular online course, for engineers, managers and other rail decision makers to learn about the new TS50701 standard. The workshops will help attendees expand their knowledge and make better decisions around the standards and their application in the area of railway cyber security.

This course is based upon the new railway cyber security specific CENELEC standards, TS50701 and best practice from other OT and IT Cyber security standards such as ISO27001, IEC 624423 and the Australian Standard® AS 7770 Rail Cyber Security. 

Our CENELEC training provides a complete overview of the important standards, with well-structured presentations and frequent discussion sessions ensuring that attendees get the most from participating.

Our Expert Course Instructor is Dr Howard Parkinson.

Key Learning Objectives

  • What is Cyber Security? – putting it into the context of railway and transportation.
  • Identify the threats and vulnerabilities (such as cyber security, safety and availability).
  • Develop mitigation actions for threats and vulnerabilities and recovery from potential consequences.
  • Cyber Security – What standards are available for dealing with threats.
  • An understanding of how TS70101 can improve cyber security across the entire railway.

About the Course

The railway sector is facing a new challenge: the Network Information Security (NIS) regulations. According to a 2020 survey by the European Union Agency for Cybersecurity (ENISA), only 33% of rail operators of essential services (OES) have fully implemented defensive measures against cyber-attacks, as recommended by NIS regulations. This places their software under serious threat – not to mention their compliance with regulations. When security breaches occur the ripple effect throughout an organisation can be vast, with implications that are both financial and personal. There may also be implications concerning system safety and resilience.

This course is an introduction to the major themes of cyber security and will start you on a journey to the creation of a secure rail operation. You will be able to communicate effectively, make informed trade-offs, assess risk, improve defences, and reduce vulnerabilities in your systems.

The course content is mapped to:
• Industry standard competencies, skills and evidence requirements relevant to rail safety work (see our website for details)
• Industry regulations
• National and international standards

Information is interspersed with practical exercises. There is a short multiple-choice examination at the end to assess the identified learning outcomes.

Who Should Attend?

This blended course is for railway business leaders, managers, railway inspectors, railway legislators, safety professionals, planners, Information Technology (IT) professionals, resilience specialists and railway engineers tasked with making decisions that could impact the cyber resilience of technical and organisational systems.

Level: Fundamental Recommended Pre-requisites

Participants should have a general understanding of engineering and project management principles and practice.

Module 1 – Introduction to Cyber Security in Railway Systems

  • Setting the Scene
  • Threat Landscape in the Railway Domain
  • Safety and Security
  • Terminology
  • Railway Cyber Security challenges
  • Risk Factors

Module 2 – Cyber Security Incidents including:

  • Lodz Tram Cyber Attack
  • Stuxnet Cyber Attack
  • San Francisco Municipal Transportation Authority Ware Attack
  • Deutsche Bahn Ransom Ware Attack

Module 3 – Cyber Security Standards and Schemes including: 

  • IEC 62443 Series
  • ISO27001

Module 4 – TS50701 and the Railway System

  • Introduction
  • Railway asset model
  • Railway physical architecture model
  • High-level railway zone model

Module 5 – Cyber security within a railway application lifecycle

  • Railway application and product lifecycles
  • Activities, synchronization and deliverables
  • Cyber Security context and cyber security management plan
  • Relationship between cyber security and essential functions
  • Cyber security assurance process

Module 6 – System Definition and Initial Risk Assessment

  • Identification of the system under consideration
  • Initial Risk Assessment
  • Partitioning of the SuC
  • Output and documentation

Module 7 – Detailed Risk Assessment

  • General aspects
  • Establishment of cyber security requirements
  • General guidance on risk assessment including setting Security Levels (SL)

Module 8 – Cyber Security Requirements

  • Objectives
  • System security requirements
  • Apportionment of cyber security requirements

Module 9 – Cyber security assurance and system acceptance for operation

  • Overview
  • Cyber security case
  • Cyber security verification
  • Cyber security validation
  • Cyber security system acceptance

Module 10 – Operational, Maintenance and Disposal Requirements

  • Vulnerability management
  • Security patch management

Module 11 – TS50701 Appendices and Guidance (Informative)

Module 12 – Conclusions and Test

Course Test – Multiple Choice Questions

This training in Rail OT Cyber Security has been given to the following companies; Abellio, Knorr Bremse, Hitachi, Downer Rail and others.

The below video is an introduction to the Rail OT Cyber Security software, it is currently being revamped and it will be available in May in a blended format.

Interested in this service?

Contact Us!