Securing India’s Railway Networks from Cyber Threats


System vulnerabilities combined with the potential to cause economic damage make India’s railway networks an attractive target for cybercriminals. A cyber threat or disruption of service can have an adverse economic impact on India’s transportation lifeline.

Dick Bussiere, Technical Director APAC, Tenable
Dick Bussiere, Technical Director APAC, Tenable

India has one of the largest railway networks in the world with routes dispersed across 123,236km carrying 23 million travellers and 3 million tonnes of freight daily. Operating for over 170 years, the country’s railway networks provide an intricate matrix of connectivity across a huge and widely populated country.

Shifting gears in a time of crisis
The recent health crisis has prompted India’s railway operator to shift gears to supply essential items such as food, water and medical supplies around the clock to cities and rural areas.

Often dubbed as the nation’s transportation lifeline, recent events not only demonstrate how versatile India’s railway networks can be as a transportation service but how heavily the country depends on it. With such reliance on railway networks, it presents an attractive target for cybercriminals intent on disrupting this critical national resource.

The rail industry has been on a journey to implement smart technology such as signaling system modernisation, logistics control, signage, on-board monitoring and communications. While the benefits of interconnecting digital and physical systems (what the industry refers to as operational technology) are increasingly visible they also expose rail systems to increased potential risks.

It goes without saying that unmitigated risks to India’s critical railway infrastructure can result in incidents that have a significant safety or economic impact; the ripples of which would be felt throughout the country. In saying that, the solution doesn’t lie in shunning away from technology progression but understanding where the risks lie and proactively managing it.

Navigating the risks of interconnected railway systems
Let’s explore the various conditions that make railway operations vulnerable:

1. With more integration between driver communication, dynamic train location data and automated control systems such as warning signs and signal lights, a disturbance in one system can quickly cascade into other systems. For example, an attack that misrepresents the physical location of a train could result in signaling lights being green when they should be red. The result of such a cascading disturbance is obvious.

2. Heavily automated ticketing systems manage the load factor on passenger trains. Disturbances of such systems could result in either empty or overloaded trains. The result would be severe inconvenience to customers and negative revenue implications for the operator.
3. Tightly integrated station building management systems, connected to the Internet, that display train timetables can be maliciously manipulated via physical access systems or vice versa to disrupt train services.

4. Many railway components are manufactured by third-party manufacturers. An example of this might be IP cameras. Vulnerabilities that exist on third-party systems can permeate the railway network or vice versa, and the true source of these components can be difficult to track.

Mitigate railway risks through full IT and OT visibility, security and control

Full visibility
To mitigate risks, railway operators require full visibility into all assets that govern smooth railway operations. Deep knowledge of all types of devices, both traditional computing platforms as well as the behind-the-scenes OT devices that control the physical machines is required. This visibility would include configuration, vulnerability and threat information, the combination of which gives the operator a thorough understanding of their cyber exposure. This visibility can be achieved using on-premises or cloud-based solutions. In fact, cloud solutions are ideal for railroads since by their very nature they are geographically dispersed.

Vulnerability prioritisation and control

The process of identifying risks, vulnerabilities and threats must be continuous – not just a periodic exercise. This allows for early detection of possibly exploitable risks before these can be used in an attack. Risks must be eliminated as soon as possible, ideally through patching or through the correction of misconfigurations.

That said, the operation of a railway must continue unimpeded. That means that it’s not always possible to eliminate risks with patching since this requires downtime. Suitable infrastructure must be deployed (e.g. advanced firewalls, threat-based anomaly detection) so that compensating controls can be employed to mitigate risks when patching is not possible.

Effective security and threat detection

When it comes to threat detection, the most effective process combines multiple detection engines:

  • Traffic mapping and traffic visualisation: Identifies normal communications for a particular network and alerts users of any deviations.
  • Anomaly detection: Pinpoints traffic that is malicious from its frequency, randomness or volume.
  • Signature-based detection: Identifies published threats and leverages crowd-sourced alerts of previously unidentified threats.

Securing the nation’s transportation lifeline
With railways playing a pivotal role both in the day-to-day lives of Indians and also serving as the backbone of logistics, railway operators have a responsibility to take stock of their cyber risk across IT and OT. While adopting new technologies has the benefit of improved safety, economy of operation and improved customer experience, the convergence of digital and physical systems exposes railways to cyber threats. To be prepared for these increasing risks, progressive organisations must have a sound cyber security plan that provides full visibility, security and control. In a rapidly changing digital world, organisations must embrace both the technologies that improve their business performance as well as protect their business from threats. Failure to do so  could cause an organisation to become an easy target for cyber threats.