Practical Tips for Secure Networks on Buses and Trains

…Concepts and Levels of Security

IT security in public transport must be understood as a holistic and overarching task. For example, the industry standard IEC 62443 describes the consideration of cyber security concepts from different points of view: General, Policies and Procedures, System, Components. In addition, different areas require different levels of protection. Protection concepts and measures are then geared to the respective security level: An IP camera in a vehicle must be protected differently than the data of a payment system.

Cyber Security Challenges in Public Transport

Like many companies, most fleet operators and transport operators need to focus their resources on their core business. They have little expertise regarding cyber security and often no knowledge of IT standards. However, they need to ensure a network that has an adequate level of protection. In practice, implementing and ensuring protection measures is a challenge for many public transport operators.

>> Read also: Cyber Security in Public Transport Networks: How to protect systems in buses and trains from hacker attacks

Practical Measures

The selection and implementation of methods and measures to protect a system depends on the application and its protection needs. The steps below provide an overview of practical measures to improve cyber security in public transit vehicles:

1. Perform risk assessment: Identify and assess risks in terms of vulnerabilities, threats, attack scenarios and potential impact.
2. Implement basic security measures: Access control, network segmentation, disabling unused interfaces, deploying firewalls, changing passwords.
3. Secure communication and data: Use VPN and appropriate protocols to encrypt communication and data.
4. Implement physical security measures: Block physical access to all components for unauthorized persons; monitor/control physical access.
5. Define an action plan in advance: Define immediate actions, countermeasures, roles and responsibilities, ensure competency.
6. Keep the system up to date at all times: Install software updates to address known vulnerabilities and security gaps.
7. Train employees: on potential threats, protective measures, and preventive measures.
8. Monitor: Monitor IT system regularly to identify deviations or security incidents; implement methods and tools to accomplish monitoring.

>> Read also: The Ethernet Switch & Cybersecurity