Railway Cybersecurity

Utgivare: Europeiska unionens cybersäkerhetsbyrå
Antagen: 2021-11-25
Språk: engelska
Källa: www.enisa.europa.eu

Good practices in cyber risk management NOVEMBER 2021 0 RAILWAY CYBERSECURITY

November 2021

ABOUT ENISA

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu. CONTACT To contact the authors, please use resilience@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu. AUTHORS Theocharidou Marianthi, Stanic Zoran, ENISA De Mauroy Louise, Lebain Loïc, Haddad Jules, Wavestone. ACKNOWLEDGEMENTS We would like to warmly thank all the experts that took part in our workshops and provided comments. Their contributions and inputs were essential for the creation of this report. ENISA would like to thank the European Railway Agency (ERA), the European Railway Information Sharing and Analysis Centre (ER- ISAC) and UNIFE's cybersecurity working group for their support. Andersson Johan A., Tranfikverket Boff Sacha, Banenor Bos Stoffel, Prorail Boss John, Prorail Brouwer Riemer, Prorail Cabral Pereira Mário Jorge, Infraestruturas de Portugal Chatelet Thomas, ERA Ciancabilla Attilio, RFI Cosic Jasmin, DB Netz De Visscher Olivier, ER-ISAC Dyrlie Rune, Banenor Fernandez Gonzalez Lola, Knorr-Bremse Fritz Jérôme, CFL Garcia Marta, UNIFE Garnier Yseult, SNCF Reseau Gomez Nieto Antonio, Adif Hausman Francois, Alstom group Houbion Catherine, Infrabel Korving Evertjan, Prorail Mager Joseph, NS Magnanini Giulio, RFI Meulders Philippe, CFL Meyer, Andreas, Selectron

November 2021

Ooms-Geugies Klaasjan, NS Pizzi Giorgio, Ministero Infrastrutture e Trasporti Paulsen Christian, Siemens Pouet Nicolas, SNCF Reseau Remberg Tom, Banenor Rodrigues Susano Ana Beatriz, Infraestruturas de Portugal Thesse Eddy, Alstom group Van den Bossche Peter, Infrabel Van Zantvliet Dimitri, NS LEGAL NOTICE This publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to the Regulation (EU) No 2019/881. ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must contain ENISA as its source. Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. ENISA maintains its intellectual property rights in relation to this publication. COPYRIGHT NOTICE © European Union Agency for Cybersecurity (ENISA), 2021 Reproduction is authorised provided the source is acknowledged. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders. ISBN 978-92-9204-545-6, DOI 10.2824/92259

RAILWAY CYBERSECURITY

1.2 METHODOLOGY The report was created with cooperation of European IMs and RUs in an iterative process with multiple rounds of validation as follows: Step 1 - Definition of the project scope and identification of experts. The first step consisted of defining the scope of the project and selecting subject matter experts whose input and insights could be considered for the development of the report. The experts chosen are mainly RU and IM stakeholders in charge of cybersecurity, as well as members of national and European agencies. Step 2 - Desk research. During this step, extensive desk research for relevant documents in the context of the project was conducted. The identified sources served as a reference to develop good practices, a list of assets and threats, threat scenarios, and list of measures. Step 3 - Series of workshops with selected subject matter experts. Four workshops were conducted to discuss and validate the key findings of the study, namely the list of assets, list of threats, threats scenarios, and list of measures. Additionally, the workshops were used as an opportunity to collect feedback on the challenges and good practices of risk management in the railway sector. The 20 experts originated from 10 European railway companies from Belgium, Germany, Italy, Luxembourg, Netherlands, Norway, Portugal, Spain, and Sweden. The European Rail Information Sharing and Analysis Centre (ER-ISAC) was also represented in the experts’ pool. Step 4 - Analysis of collected material and report development. The input collected from desk research and the stakeholder workshops were analysed. Based on this analysis, the first draft of this report was developed. Step 5 - Review and validation. The report was then validated by 24 experts (primarily RUs and IMs) from Belgium, France, Germany, Italy, Luxembourg, Netherlands, Norway, Portugal, Spain, and Sweden, the ER-ISAC and the UNIFE cybersecurity working group. The experts reviewed the report and provided comments and suggestions for improvement. These were the basis for the final version of this document. 1.3 STRUCTURE OF THE REPORT The report is organised in 6 chapters:  Chapter 2 describes cyber risk management concepts and the current approaches identified for the railway sector. It can help railway stakeholders to choose a risk management methodology.  Chapter 3 contains a list of railway assets and services (definitions and taxonomy), along with guidelines on how to identify those assets and services. Railway stakeholders can use this information to build their own list of assets and services.  Chapter 4 focuses on cyber threats, with a list of threats, their definitions and a list of risk scenarios applicable to the railway sector. Stakeholders can use those tools to identify the main risks to their assets and evaluate what should be prioritised for protection. The list of threats would be useful to conduct risk assessments, along with the abovementioned list of assets and services.  Chapter 5 examines current cybersecurity measures based on EU guidelines (NIS Directive) and international standards. It can help stakeholders to define a risk management plan.  Chapter 6 offers some concluding remarks.

RAILWAY CYBERSECURITY

November 2021

2. CYBER RISK MANAGEMENT

November 2021

3.1 TAXONOMY To help RUs and IMs choose which assets and services to include in their risk assessment, a comprehensive list has been compiled. It is based on the systems’ list described in the ENISA Report - Railway Cybersecurity of 2020 . It has been constructed from existing literature, validated during interviews with railway stakeholders in 2020, and enriched based on the feedback received during the 2021 workshops. It gives a robust and high-level overview of railway assets, with relevant categories. Other, more detailed taxonomies exist in the sector and have been reviewed in order to complement and align (especially for the names and associated descriptions) this list with approaches on asset taxonomies, such as X2Rail 12 13 Deliverables , RCA-OCORA-Eulynx Security Guideline and TS50701. Indeed, RCA, OCORA, and Eulynx have created comprehensive asset architecture models specific to OT systems (on-board and trackside systems). They present assets at a more detailed level – up to the component level – and can be used for the risk assessment of a particular system, where such detail is required. This list has been broken down to 5 areas; the services that stakeholders provide, the devices (technological systems) that support these services, the physical equipment used to provide these services, the people that maintain or use them, and the data used. Fourteen service categories, together with sub-categories, are defined and depicted in Figure 2. For each service listed on (ENISA, 2020), assets have been identified. These are based on the list of systems by (ENISA, 2020), desk research, CLC/TS50701 and complemented with additions such as supply chain or freight assets. Supply chain assets refer to the assets provided by suppliers; as this present list may not be exhaustive, suppliers’ threats can be additionally covered by defining a list of suppliers and applying specific measures to them. Freight assets are especially relevant as railways amount for a significant amount of EU freight transport. They can be targeted by specific attacks that are more focused on financial gain rather than disruption or passenger safety. In addition, each asset has been characterised according to the kind of resources the asset uses:  IT systems: refers to all components, devices and software used to store and process the information and realise IT operations.  OT systems: refers to all components, devices and software used to conduct physical railway operations.  Network and communications systems: refers to all components and devices used to physically convey information fluxes.  Supply chain: refers to the assets provided by suppliers. Four device categories have been identified, namely:  Telecom  IT & OT infrastructure  Infrastructures and trackside  On-board These categories illustrate the systems to which the assets belong to and it is used to define the operation where the asset will be used: passenger comfort, signalling, corporate operations, etc. (see figure 3) Moreover, physical equipment can be found either on infrastructure and trackside (buildings, tracks, etc.), or on-board (trains, wagon, lighting, etc.) (see Figure 4) Finally, the different categories of people that are using these systems (clients or employees) and the different categories of data used by those systems are listed (see Figure 5). These taxonomies can be used for developing an initial ontology-knowledge representation for the railway domain. For detailed descriptions of these five areas of assets, please consult Annex A.

RAILWAY CYBERSECURITY

November 2021

Figure 2: Railway Service categories

RAILWAY CYBERSECURITY

November 2021

Figure 3: Railway devices

RAILWAY CYBERSECURITY

November 2021

Figure 4: Railway Physical Equipment Figure 5: People and Data

RAILWAY CYBERSECURITY

November 2021

4. CYBER-RELATED THREATS

5. CYBERSECURITY MEASURES

Once risks have been identified and prioritised according to risk evaluation criteria in relation to the incident scenarios that lead to those risks, they should be treated via a risk treatment plan. Four options are usually proposed regarding risk treatment : risk modification, risk retention, risk avoidance and risk sharing.  Risk modification is modifying the level of risk by introducing, removing, or altering controls so that the residual risk can be reassessed as being acceptable.  Risk retention is accepting the risk without further action, if the level of risk meets the risks acceptance criteria.  Risk avoidance is avoiding the activity or condition that increases the particular risk.  Risk sharing is sharing the risk with another party that can most effectively manage the particular risk. As described in the ISO 27005 standard, these options must be selected based on the outcome of the risk assessment, the expected cost for implementing these options and the expected benefits from these options. At the end of the process, no risk exceeding the risk acceptance criteria should be left. In order to reduce the identified risks to acceptable levels, appropriate security measures should be identified and prioritised. Security measures can be defined internally, using best practices and building a remediation plan tailored to the information system. However, a common practice is to use already-defined security measures published in security frameworks. These security frameworks often contain a list of controls or security requirements. NIS Directive cybersecurity measures. The NIS cooperation group issued a list of security measures directed to OESs in a Reference document on security measures for Operators of Essential Services. The purpose of this list is “to provide Member States with a clear and structured picture of Member States’ current and often common approaches to the security measures of OES”. The document examines a high number of domains where cybersecurity measures should be applied. For each domain, it gives a set of broad measures alongside their definitions (Figure 14). These domains and measures could be used as the first basis for the risk treatment plan and complemented with measures from the CLC/TS 50701 regarding the OT cybersecurity and ISO/IEC 27002 security measures for IT cybersecurity. Indeed, during the workshops, it was discovered that RUs and IMs often choose a two-step approach, by selecting a general framework for IT cyber risk treatment and complementing it with a more detailed, industry-driven one for the OT cyber risk treatment. ISA/IEC 62443 and CLC/TS 50701 are among the main references used for OT cybersecurity. For IT risk frameworks, NISD national security requirements, ISO27002 framework and the NIST Cybersecurity framework are among the more commonly used. Other less common frameworks have also been 35 36 cited, such as the SANS Top 20 Critical Security Controls , or the Forrester Information Security Model .

RAILWAY CYBERSECURITY

November 2021

Figure 14: Domains of security measures for OESs (NIS Cooperation Group, 2018) The ISO/IEC 27002 standard and Annex A’ of ISO2001 describe requirements for information security management 37 38 and a set of security controls . These controls are organised in 12 categories :  Information security policies  Organisation of information security  Human resource security  Asset management  Access control  Cryptography  Operations security  Communications security  Supplier relationships  Information security incident management  Information security aspects of business continuity management  Compliance Similar to the NIS Directive security measures, ISO 27002 could be used as a basis for the risk treatment plan, and complemented with additional national security requirements, while OT systems could be complemented with CLC/TS 50701. Some measures from the NIST framework could also be used as they can be described in more detail. The NIST Cybersecurity framework is accompanied by an exhaustive list of requirements. They are classified according to five functions (Identify, Protect, Detect, Respond, Recover) and 23 categories. Each of these categories contain a list of precise security requirements (over 900 in total). Those controls are also mapped against the ISA 62443 series and the ISO/IEC 27001:2013. The framework is quite detailed and focuses primarily on IT security. The NIST cybersecurity framework can be used as is and complemented by CLC/TS 50701 for OT railway systems requirements, or it can be used to complete another generic frameworks or standards, such as the ISO 27001 or the NIS Directive security requirements. CLC/TS 50701 is based on or derived from IEC 62443 series standards. The purpose of the TS “is that, when a railway system is compliant to this TS, it can be demonstrated that this system is at the state of the art in terms of cybersecurity, that it fulfils its targeted Security Level and that its security is maintained during its operation and maintenance.” It is best suited for industrial systems and designed specifically for the railway sector, as it applies to the Communications, Signalling and Processing domain, the Rolling Stock domain and to the Fixed Installations domain. It contains a list of security requirements for the OT components and services of the railway sector and thus

RAILWAY CYBERSECURITY

November 2021

should be completed with a more generic approach, such as the ISO 27001, the NIST Cybersecurity Framework or the NIS Directive. 5.1 APPLYING CYBERSECURITY MEASURES To help stakeholders implement the security measures, workshops were conducted with relevant experts and institutions to discuss challenges, priorities, and best practices. The purpose was to gather concrete feedback on the risk treatment plans. Defining the list of measures that will be used was described as the top priority of the attendants of the workshops. To do so, operators draw a list of cybersecurity measures from known references. Assets’ maturity is assessed against those measures, and measures that are not met are included in the list of security measures that must be applied to these assets. This list of security measures can also be used as a common basis for the manufacturers to implement minimum cybersecurity requirements by design or for security requirements to be included in contract specifications. To define the set of measures that will be used, organisations also assess the level of compliance with national cybersecurity requirements (primarily according to the NIS Directive, but also against other requirements stemming from laws on national security, transport security or critical infrastructure protection). During the workshops, stakeholders highlighted the importance of awareness raising and training sessions (especially against top threats, such as ransomware and phishing) or email security to prevent phishing. On the latter, the protection of endpoints and network segregation is also a top priority to reduce the risk of propagation of such attacks. As for OT security, the emphasis is placed mainly on network segregation and access control for critical systems. Adaptation of legacy systems is also a concern and should be considered as a priority, but it is also a big challenge, considering the complexity of updating systems with long lifecycles. Additionally, particular emphasis is placed on incident response. Finally, applied security measures are often challenged by external audits or penetration testing. Some organisations use third parties to conduct such assessments. The systems tested can belong both on the IT and OT domains. In addition to technical audits, governance audits can also be conducted, such as an ISO-compliance audit. Furthermore, business continuity and recovery and incident response plans can also be tested with crisis exercises. A challenge cited by multiple RUs and IMs is the management of relationships with third parties and ensuring that the products and services supplied meet cybersecurity requirements. Often, compliance with NIS Directive security requirements does not apply to third parties. To engage more with the industry and to encourage the implementation of cybersecurity measures, one solution could be to design a baseline at EU level to make the manufacturers and providers align their systems’ compliance. Common baseline requirements should be reflected in tenders to allow for competing solutions achieving similar security capabilities across Europe. However, when considering minimum baseline requirements, there are risks involved, such as the minimum baseline not changing while the threat landscape changes, or that these minimum-security requirements do not meet the risks of the organisation. The use of EU certification schemes for IT or OT cybersecurity (should these become available) could be also a way to assess whether such requirements are met by the industry. Another challenge that was identified is continuity, i.e., ensuring that the security level remains adequate and that the risks are continuously monitored. To do so, regular reviews and compliance assessments are needed. Maintaining an up-to-date threat landscape for the railway sector is equally important. An additional challenge is the separation between IT and OT, as it is often difficult to differentiate what is strictly OT from what is IT. In this case, it is difficult to know which controls to apply. 5.2 CYBERSECURITY MEASURES To help stakeholders define cybersecurity measures, a list of controls from the NIS Directive has been mapped against various references (ISO27001, NIST CSF and CLC/TS50701 ). It is up to the stakeholders to choose whether they will only select some measures from this list, use it as a basis for building their own list, or use it in entirety. Stakeholders should also remember that they may have to comply with national guidelines and specific

RAILWAY CYBERSECURITY

November 2021

national sectorial regulations. They should also verify which references apply to them and, if needed, complete the present list with the missing requirements. The mapping was done in two phases: first, the references were reviewed and the most relevant measures were put in front of the NIS Directive measures, keeping these measures as the starting point of the review. Then, the reverse operation was carried out: the measures from the references that had been removed in the first phase were added to the most relevant NIS Directive measures. This ensures that all NIS Directive measures have been covered; and that all the other referenced measures are integrated into the mapping. An example of a security measure is included below. It includes measures under the NIS Directive domain: Protection and the category of “Identity and Access Management”. The two measures of this category “Authentication and identification”, and “Access rights” are described according to the NIS Directive guidelines. They are then associated with relevant measures that can be found in ISO/IEC 27002, the NIST cybersecurity framework and CLC/TS50701. A detailed list of security measures can be found in Annex C. Table 1: Domain: Protection - Category: Identity and Access Management

RAILWAY CYBERSECURITY

November 2021

Measure Description ISO/IEC 27002 NIST CSF CLC/TS50701

SR 1.1 - Human user identification and

authentication

SR 1.2 - Software process and device

identification and authentication For identification, SR 1.3 - Account management the operator sets SR 1.4 - Identifier management up unique SR 1.5 - Authenticator management accounts for A.9.1 Business SR 1.6 - Wireless access management users or for requirements of SR 1.7 - Strength of password-based automated access control authentication processes that A.9.3 User PR.AC Identity SR 1.8 - Public key infrastructure (PKI) need to access responsibilities Management, NIS - PR.7 certificates resources of its A.9.4 System and Authentication Authentication SR 1.9 - Strength of public key authentication Critical application access and Access and SR 1.10 - Authenticator feedback Information control Control (1, 4, 6, 7) identification SR 1.11 - Unsuccessful login attempts System (CIS). A.9.4.2 Secure PR.DS Data SR 1.12 - System use notification Unused or no- log-on procedures Security (5) SR 1.13 - Access via untrusted networks longer-needed A.9.4.3 Password SR 2.1 - Authorisation enforcement accounts should management SR 2.2 - Wireless use control be deactivated. A system SR 2.3 - Use control for portable and mobile regular review devices process should SR 2.4 - Mobile code be established. SR 2.5 - Session lock

SR 2.6 - Remote session termination

SR 2.7 - Concurrent session control

SR 5.2 - Zone boundary protection

Among the rules

defined in its

systems security SR 1.1 - Human user identification and

policy, the authentication ID.AM Assets operator grants A.9.1 Business SR 1.2 - Software process and device management (5, access rights to requirements of identification and authentication 6) a user or an access control SR 1.3 - Account management PR.AC Identity automated A.9.2 User access SR 1.4 - Identifier management Management, process only management SR 1.5 - Authenticator management NIS - PR.8 Authentication when that access A.9.4.4 Use of SR 1.6 - Wireless access management Access rights and Access is strictly privileged utility SR 1.7 - Strength of password-based Control (1, 4, 6, 7) necessary for the programs authentication PR.DS Data user to carry out A.9.4.5 Access SR 1.8 - Public key infrastructure (PKI) Security (5) their mission or control to program certificates PR.PT Protective for the source code SR 1.9 - Strength of public key authentication Technology (3) automated SR 1.10 - Authenticator feedback

process to carry SR 2.1 - Authorisation enforcement

out its technical

Table 1: Assets per device category Assets Description Attribute Reference

Telecom

Radio network used for all railway processes: communication Network and

Radio transmission

with trains, signalling, safety and security operations, logistics communication ENISA, 2020

network

management, etc. systems

Wired and wireless Network and Wired and wireless systems used for network transmission communication ENISA, 2020 communications in LAN or Internet connection. network systems

Operational Network and Telephone-related devices such as loudspeaker systems, telephone communication ENISA, 2020 walkie-talkies, etc. intercom systems

Network and

Mobile telephone

GSM/GSM-R phone devices. communication ENISA, 2020

devices (GSM)

systems

IT & OT Infrastructure

Computer & Computers and servers used as support goods by all IT & OT IT systems ENISA, 2020 server systems.

Infrastructures and trackside

Automatic ticket distribution and

Devices and equipment to distribute and control the tickets. IT systems -

verification infrastructures

CCTV (video Devices used for video surveillance of assets and people at OT systems CLC/TS 50701 surveillance) risk.

Fixed

Detectors such as track vacancy detectors, hot box detectors, infrastructure OT systems CLC/TS 50701 avalanche detectors and fire detectors.

detectors

Wayside Source and destination for information about approaching OT systems equipment trains and their crews.

Station signalling Equipment for station signalling regarding interlocking (safe

(automatic train setting of routes for trains by controlling signals, points, and

protection, the track vacancy), automatic train protection (ATP) or radio OT systems CLC/TS 50701

interlocking, radio block centre (controls the movement authorities for the trains block centre) in an ETCS Level 2/3 system).

Fixed

Network and communication Fixed devices to communicate with railway personnel and communication CLC/TS 50701 tools (GSM-R, passengers. systems

MSC/BSC)

Network and

Radio transmission

Relays antenna for radio communication. communication CLC/TS 50701

relays

systems

Wired and wireless

Network and

transmission

Equipment to support network communications. communication CLC/TS 50701

internal network

systems

infrastructures

RAILWAY CYBERSECURITY

November 2021

Assets Description Attribute Reference

Network and

Public Wi-Fi and

Equipment to support public Wi-Fi and internet access. communication CLC/TS 50701

internet accesses

systems

On-Board

Various on-board detectors such as ATP, fire detectors,

On-board

alarms, anti-intrusion tools, diagnostics tools and energy OT systems CLC/TS 50701

detectors

metering.

On-board physical infrastructures related to driver tools: traction, braking driver machine interface, train control management tools. Driver tools Traction is the system responsible for train movement. OT systems CLC/TS 50701 The driver machine interface includes all the technological objects used to manage communications between the train and the driver (e.g., screens, buttons, handles, etc.).

On-board equipment that communicates with the networks Network and

Radio transmission

and allows the train to communicate with corporate IT communication CLC/TS 50701

relays

systems. systems

Wired and wireless

On-board equipment used for wired or Network and

transmission

wireless transmission on internal network (Mobile communication CLC/TS 50701

internal network

Communication Gateway, cab radio). systems

infrastructures

Network and Public Wi-Fi and On-board equipment giving the users access to internet communication CLC/TS 50701 internet accesses (through Wi-Fi, for example). systems

Equipment supporting CCTV on the train (cameras, recording On-board CCTV systems), used for video surveillance of assets and people at IT systems CLC/TS 50701 risk.

Table 2: Assets per service category Assets Description Attribute References

Timetable construction

Systems which allow commercial offers to be created for Commercial offer customers, including timetables for each train line (track usage IT Systems ENISA, 2020 construction for railway undertakers and commercial offers of train tickets for passengers or freight).

Systems which allow the preparation of resource rosters (assets and staff), providing the staff planning for all people Staff planning IT systems ENISA, 2020 working in railway (drivers, controllers, railway worker, station employee, maintenance workers, etc.)

Systems which allow resource booking (locomotive, wagon, Resources booking IT systems ENISA, 2020 etc.)

Sales, distribution, and customers relations

Systems that allow the management of customer relations Marketing IT systems ENISA, 2020 (e.g., claims, loyalty cards, marketing campaigns).

Booking Systems enabling customers to buy tickets or book a train IT systems ENISA, 2020 management seat, including commercial websites and applications.

Automatic fare

Systems enabling the automatic collection of customers' fares. IT systems ENISA, 2020

collection

RAILWAY CYBERSECURITY

November 2021

Assets Description Attribute References

Network allocation systems

Systems enabling RUs to construct and plan operations and

Operation planning

to inform the IMs of any special characteristics of trains or IT systems ENISA, 2020

construction

loads (e.g., dangerous goods, oversize).

Systems enabling IMs to apply costing policies to the RU for Operation billing IT systems ENISA, 2020 the use of the infrastructure.

Systems enabling RUs to book infrastructure (corridors) to Corridors booking IT systems ENISA, 2020 operate their trains on the network

Assets management

Asset inventory Systems enabling RUs and IMs to inventory their assets. IT systems ENISA, 2020

Systems enabling RUs and IMs to manage their asset Logistics IT systems ENISA, 2020 logistics.

Systems enabling RUs and IMs to account for their assets Asset procurement (infrastructure, or trains for example), and to procure new IT systems ENISA, 2020 assets.

Signalling

Systems used to direct railway traffic and oversee the Remote monitoring OT systems ENISA, 2020 monitoring of train locations on tracks.

Systems used to direct railway traffic and secure Key management OT systems ENISA, 2020 communication between trains.

Juridical recorder Systems used to direct railway traffic and record events on OT systems ENISA, 2020 unit trains complying with the ERTMS/ETCS standard.

Systems used to direct railway traffic and reduce the speed of

Temporary speed

rail traffic to ensure safe passage on unsafe sections of OT systems ENISA, 2020

restriction

tracks.

Systems used to direct railway traffic and prevent conflict in signalling movements through an arrangement of tracks. It Interlocking OT systems ENISA, 2020 includes wayside systems that give information on approaching trains and their crews.

Automatic train Systems which activate emergency brakes if train speed is OT systems ENISA, 2020 protection faster than allowed.

Command-Control

Master system to control all train elements (speed, doors, Train control OT systems ENISA, 2020 etc.). Automatic train System responsible for speed control in response to external OT systems ENISA, 2020 control inputs.

Automatic train Systems used to enable movement of trains and manage OT systems ENISA, 2020 supervision traffic loads.

Energy traction System overseeing the supply of the electrified rail network. OT systems ENISA, 2020

Systems and services related to freight docking: loading and Freight docking OT systems unloading of goods, cranes, and platforms management.

Auxiliary

Energy System overseeing the management of power delivery. OT systems ENISA, 2020

Heating, ventilating

and air System overseeing the management of heating, ventilation, OT systems ENISA, 2020 conditioning and air conditioning.

(HVAC)

Lighting System overseeing the management of lighting. OT systems ENISA, 2020

Water System overseeing the management of water. OT systems -

Escalator and System overseeing the management of escalators and OT systems elevator elevators.

RAILWAY CYBERSECURITY

November 2021

Assets Description Attribute References

Development

Bidding

Bidding systems for the RU or IM to answer invitations to management IT systems ENISA, 2020 tender for train operations or infrastructure management.

systems

Research and

engineering Centralise and coordinate research and engineering. IT systems ENISA, 2020

systems

Passenger services

Passenger System overseeing the passenger announcement IT systems ENISA, 2020 announcement management.

Passenger System managing the passenger's general information about IT systems ENISA, 2020 information their trip: track number, time of arrival, delay, etc.

Passenger System overseeing the management of passenger IT systems ENISA, 2020 entertainment entertainment (internet access...).

Telecom

Network and Operational time System which synchronises the clocks of the different IT communication ENISA, 2020 distribution system equipment (servers, workstations, etc.). systems

Security

System allowing the control of physical access within Access control OT systems ENISA, 2020 buildings.

CCTV Video-surveillance systems. OT systems ENISA, 2020

Network Network intrusion detection systems to detect abnormal IT systems ENISA, 2020 monitoring activities.

Devices and software allowing cybersecurity activities:

Cybersecurity surveillance (SOC), firewalls, Endpoint Detection and IT systems ENISA, 2020

Response systems.

Safety

Systems managing fire detection within buildings, stations, or Fire detection OT systems ENISA, 2020 datacentres.

Emergency

System managing operational communication and sending telephony and OT systems ENISA, 2020 alerts in case of emergency.

alerting

Operations safety Systems that keep operations safe and secure. OT systems ENISA, 2020

Maintenance

Systems enabling RUs and IMs to create an inventory of their Asset inventory IT systems ENISA, 2020 assets related to maintenance (parts, equipment, etc.).

System overseeing direct diagnosis or tele-diagnosis with Diagnosis IT systems ENISA, 2020 GSM communication from the train.

Maintenance System scheduling and operating maintenance activities on IT systems ENISA, 2020 scheduling track and trains.

Service

Systems enabling the provision of maintenance equipment. IT systems -

provisioning

Corporate & Support

IT ticketing IT ticketing systems to create and attribute tickets detailing IT IT systems ENISA, 2020 systems users’ technical or help requests.

Resource System overseeing the management of allocation of IT systems ENISA, 2020 allocation systems resources used by RUs and IMs to perform usual business.

RAILWAY CYBERSECURITY

November 2021

Assets Description Attribute References

Documentation

systems / System overseeing the management of documents (shared IT systems ENISA, 2020 Document folders, SharePoint, OneDrive, etc.).

management

Alert escalation

Process and system used in case of crisis, in order to escalate and crisis IT systems ENISA, 2020 and manage the situation.

management

Administrative

Administration of the telephone systems used by employees. IT systems ENISA, 2020

telephone systems

Administrative time Network Time Protocol (NTP) systems that provide time IT systems ENISA, 2020 distribution management for all systems. Finance Manages all financial aspects (accounting, consolidation).. IT systems ENISA, 2020 System for employee management: recruitment, pay, training, HR IT systems ENISA, 2020 evaluation, etc.

IT-related (equipment,

Vendor systems for IT services and equipment. Supply chain -

services) system supply

Table 3: Assets per physical equipment category (description) Assets Description Reference

On-Board

Doors Sub-system that controls the train doors. CLC/TS 50701

On-board physical infrastructures related to lighting. Includes the electronics On-board lighting dedicated to ensuring correct illumination of railway cars both internally and CLC/TS 50701 externally; special case of external lighting are headlights.

Heating, ventilating

and air On-board physical infrastructures related to heating, ventilating and air conditioning. CLC/TS 50701 conditioning This system provides crew and passengers with ambient comfort conditions.

(HVAC)

Train Physical equipment of trains including embedded devices and their software. -

Freight

On-board physical infrastructures related to freight locomotives. -

locomotives

Special wagons (Container

transport, oil On-board physical infrastructures related to special wagons. -

transport, refrigerated)

On-board system

On-board physical infrastructures related to the system supply. -

supply

Infrastructure and trackside

Energy systems

Infrastructures that support providing energy to all facilities. -

supply

Tracks All physical equipment and infrastructures related to tracks. -

Catenary Supply of electric energy to trains. -

RAILWAY CYBERSECURITY

November 2021

Assets Description Reference

Train assembly

Facilities where trains are assembled. -

facility

Stations -

All buildings used for train stations. CLC/TS 50701

buildings

Other buildings

(Administrative, All building used for corporate, IT or OT purposes. -

facilities, …)

Electrical

Physical infrastructures that support electrical substations. CLC/TS 50701

substations

Physical infrastructures supporting level crossings. Protects the crossing area of rail Level crossing CLC/TS 50701 and road traffic. Physical infrastructures related to bridges or tunnels. "Tunnels" includes the electronics installed in railway tunnels to support tunnel Tunnels and specific infrastructure functions (e.g., ventilation, alarm systems, fire and smoke bridges detectors, fire extinguisher, etc.) "Bridges" includes the electronics installed in railway bridges to support bridge specific infrastructure functions (e.g., monitoring systems, lift control, etc.)." Escalators and Physical infrastructures related to escalators or elevators that allow passengers and ENISA, 2020 elevators employees' to move in buildings and infrastructures.

Lighting Physical infrastructures related to lighting. ENISA, 2020

Water control Physical infrastructures related to water control (wells, etc.). -

Fire management Physical infrastructures related to fire management (fire extinguisher, etc.) -

Freight docking Physical infrastructures related to freight docking platforms, allowing loading and platform unloading of goods.

Goods storage

Physical infrastructures related to goods storage (such as containers). -

facilities

Heating, ventilating

and air Heating and ventilating equipment, providing crew and passengers with ambient CLC/TS 50701 conditioning comfort conditions.

(HVAC)

RAILWAY CYBERSECURITY

November 2021

Table 4: People and data (description) Assets Description

Data, Information and Knowledge

Email Data used by email systems. Telephone Data used by telephone systems. Clients’ personal information Name, address, credit card information, usage, etc. Employee personal information Name, address, salary, etc. Asset inventory data Asset-related data. Support tickets Tickets sent to support to detail users requests. Data related to the commercial, financial or administrative information and

Commercial, financial, administration data

activities. CCTV data Video tapes, recording, etc. IT infrastructure data Architecture figures, flow matrix, etc. Research and engineering data Data related to research and engineering activities. Maintenance data Train status, maintenance operations, etc. Train or traffic data Train location, train course, etc. Audit (audit trail, logs) Audits reports, audit trail, logs. Systems maintenance data Backups, configurations, audit, log, install images, licenses, certificates, etc.

Supply chain data/knowledge (providers,

Providers, data, contracts, service met records.

contracts, service management records)

IT systems data (for critical systems not

Data used in IT systems: IP mapping tables, credentials, etc.

mentioned)

Data used for control of the systems (e.g., signalling systems data to and

OT systems data

from train, to and from trackside elements). Freight information Asset-related data.

People

Passengers People using train services. Drivers Employees driving trains. Controllers Employees in charge of controlling passengers’ tickets. Railway workers Employees in charge of the railway. Station employees Employees in charge of managing the stations. Maintenance workers Employees in charge of the maintenance (train or tracks). HR Employees in charge of HR. Executives Company’s executive staff. Marketing, communication, finance teams Employees in charge of marketing, communication, or finance. Administrator teams Employees in charge of administrating the systems. IT teams Employees in charge of IT.

RAILWAY CYBERSECURITY

November 2021

B ANNEX: THREATS DESCRIPTION

Table 5: Threat categories and descriptions

Threats Description

Disaster (natural, environmental)

Natural earthquakes, floods, landslides, tsunamis, heavy rains, heavy snowfalls, heavy winds, solar eruptions, thunder

Disastrous events caused by natural or environmental elements.

stroke, pollution, dust, corrosion, water, explosion, animal damages (rats, squirrels, etc.)

Unintentional damage / loss of information or systems

Information leakage/sharing due to Confidential data shared involuntarily by a member of the organisation via the human error information system (emails, social network...). Erroneous use or administration of Error in the use or administration of the organisation’s assets leading to information devices and systems leakage, damage to such assets or physical harm. Using information from an unreliable Using information in the organisation’s processes and systems from a non-verified, source non-official source, or an official but corrupted source.

Unintentional change of data in an

Harmful modification of data, mistakenly done by a member of the organisation.

information system

Inadequate design and planning or Error in the design of a system or its planning or delivery, leading to system improper adaptation unavailability.

Damage caused by a third

Unintentional damage caused by a supplier or a partner.

party (supplier or partner)

Damages resulting from penetration Unintentional damage caused by an IT team during a penetration test of an testing information system. Loss of (integrity of) sensitive Loss of sensitive information, or unwanted modification of sensitive information, information leading to the unavailability of the necessary data. Loss of recorded information in IT systems (back up) or OT systems (train system

Destruction of records

records or similar).

Physical attack (deliberate/ intentional)

Every type of fraud committed by a passenger, aiming at diverting the

Fraud by passengers

organisation’s resources, particularly fraud regarding tickets or subscription. All type of acts aiming at physically destroying or harming the organisation’s

Sabotage / Vandalism

properties.

Theft (devices, storage media and

Theft of physically available resources.

documents)

Information publicly and physically leaked or shared by a member of the

Information leakage / sharing from

organisation, whether voluntarily or not (via the passenger announcement system,

document / equipment

for instance).

Unauthorised physical access /

Access to the organisation premises by a non-authorised person.

Unauthorised entry to premises

All type of pressure directed toward members or the organisation or stakeholders

Coercion, extortion, or corruption

to gain an advantage over the organisation.

Damage from the warfare / Terrorist All damages originating from a large organisation (country, terrorist group or other attack / Activist attack similar organisation) or damages that are ideologically motivated.

RAILWAY CYBERSECURITY

November 2021

Threats Description

Failures / Malfunction

Failure / malfunction of devices or Natural dysfunction or dysfunction stemming from a misconfiguration on a device systems or a system. Failure / malfunction / disruption of Natural dysfunction or dysfunction stemming from a misconfiguration, on the communication links communication networks. Failure / malfunction / disruption of Natural dysfunction or dysfunction stemming from a misconfiguration on the service providers (supply chain) services provided by the suppliers.

Outages

Loss of resources Unavailability of provided resources (maintenance parts, etc.). Loss of electricity Unavailability of electricity. Loss of cooling Unavailability of cooling.

Loss of oil or gas Unavailability of oil or gas.

Absence of personnel (strike,

Absence of key personnel (strike, pandemic, etc.).

pandemic, etc.)

Low competency or maturity of Personnel lacking competency to correctly and efficiently complete tasks causing personnel unavailability of assets or services. Internet outage Unavailability of the services provided by the global internet suppliers. Mobile communication outage Unavailability of mobile (GSM) communication services. Unavailability of the organisation’s network communication due to network

Network outage

dysfunction (natural or not).

Malicious Activity / Abuse

Theft of a systems’ legitimate user's identity: account theft, authentication means’

Identity theft (Identity fraud/ Account)

theft (login, password, email, etc.). Phishing or spear-phishing email to retrieve a stakeholders’ credentials, or e-mail

Unsolicited E-Mail

designed to retrieve sensitive information via social engineering. Cyber-attack that aims at making a machine or network resource unavailable to its Denial of service intended users by temporarily or indefinitely disrupting services of a host connected to the Internet. Piece of code or software that infects a host (computers, servers, etc.) to harm an Malicious code/ software/ activity information system in various ways. This includes ransomwares, trojan horses, viruses, worms., etc. Psychological manipulation of people into performing actions on the information

Social engineering

systems or divulging confidential information. Generation and use of rogue Legitimate certificates that have been compromised or forged to trick a system in certificates thinking the certificate’s user is legitimate and can access the protected resources. Malicious changes in hardware or software configuration or code to cause harm to

Manipulation of hardware and software

the information system. Manipulation of information Malicious breach of data integrity or transmission of false information. Every type of fraud committed by authorised personnel aiming at diverting the

Fraud by authorised personnel

organisation’ resources. Unauthorised use or administration of Unauthorised use or administration of the organisation’s assets leading to devices and systems information leakage, damage to such assets or physical harm. Unauthorised use of a legitimate software leading to information leakage, damage

Unauthorised use of software

to such assets or physical harm.

RAILWAY CYBERSECURITY

November 2021

Threats Description

Network Intrusion Unauthorised access to a network, giving access to network resources.

Installation of a software not allowed on a computer or server. This can create

Unauthorised installation of software

vulnerabilities that are not under control of the company.

Compromising confidential information

Intentional confidential data leakage from authorised or unauthorised access.

(data breaches)

An attacker gains unauthorised access to a computer network and resources,

Targeted attacks (APTs etc.)

remaining undetected for an extended period.

Access to a protected resource using crafted passwords or passphrases with many

Brute force

trials to find the associated access credentials.

Abuse of authorisations Legitimate users who use their authorisations for fraud or stealing sensitive data.

Interception of information Physical interception of information (eavesdropping).

Network reconnaissance, network

Interception and identification of information about networks to identify security

traffic manipulation and information

weaknesses.

gathering

Interception of information between two endpoints in information systems

Man in the middle / Session hijacking

(computers, servers, etc.)

RAILWAY CYBERSECURITY

November 2021

C ANNEX: SECURITY MEASURES

Table 6: Governance Security ID Description ISO/IEC 27002 measures NIST CSF measures CLC/TS50701 measures Measures

Information System Security Governance & Risk Management

ID.GV Governance (4)

ID.RA Risk Assessment (1, 3, 4, 5,

ID.RM Risk Management Strategy 6.1 Actions to address risks and opportunities (1, 2, 3) The operator conducts and regularly 8 Operation RS.IM Improvements (1, 2) SR 7.8 - Control system component updates a risk analysis, identifying 9.3 Management review ID.SC Supply Chain Risk inventory its Critical Information Systems (CIS) 10 Improvement Security risk Management (1) NIS - GV.1 underpinning the provision of the A.8.1 Responsibility for assets analysis PR.IP Information Protection essential services of OESs and A.12.6.1 Management of technical See sections 6 and 7 of CLC/TS50701 Processes and Procedures (12) identifies the main risks to these vulnerabilities and IEC 62443-2-1 (section 4.2) ID.AM Assets management (1, 2, CIS. A.18.2.1 Independent review of information 4, 5) security DE.CM Security Continuous

Monitoring (8)

RS.MI Mitigation (3)

RS.AN Analysis (5)

4.3 Determining the scope of the information

security management system

4.4 Information security management system

5.1 Leadership and commitment

5.2 Policy

5.3 Organisational roles, responsibilities and

authorities ID.BE Business Environment The operator establishes, maintains 6.2 Information security objectives and (1,2,3,4) and implements an information planning to achieve them ID.GV Governance (1,2,3,4) Security system security policy (ISSP) NIS - GV.2 9.3 Management review PR.AT Awareness & Trainings See IEC 62443-2-1 (section 4.3.2) policy approved by senior management, A.5.1 Management direction for information (2,3 4,5) guaranteeing high-level security DE.DP Detection Processes (1) endorsement of the policy. A.6.1 Internal organisation ID.AM Assets Management (6)

A.7.2.1 Management responsibilities

A.18.1.1 Identification of applicable legislation

and contractual requirements

A.18.1.2 Intellectual property rights

A.18.2.2 Compliance with security policies and

standards

RAILWAY CYBERSECURITY

November 2021

ID.RA Risk Assessment (1,3,4,6)

ID.RM Risk Management Strategy

(1, 2, 3) Building on the risk analysis and RS.IM Improvements (1, 2) according to an accreditation 6.1 Actions to address risks and opportunities ID.SC Supply Chain Risk SR 2.8 - Auditable evens process referred to in the ISSP, the 8 Operation Management (1) SR 2.9 - Audit storage capacity operator accredits the CIS identified Security 9.2 Internal audit PR.IP Information Protection SR 2.10 - Response to audit processing NIS - GV.3 in its information system risk accreditation 10.1 Nonconformity and corrective action Processes and Procedures (7, 12) failure analysis, including, inter alia, the A.12.1.1 Documented operating procedures PR.PT Protective Technology (1) SR 2.11 - Timestamps inventory and architecture of the A.12.7.1 Information systems audit controls ID.AM Assets management (1, 2, SR 2.12 - Non-repudiation administration components of the 4, 5) CIS. DE.CM Security Continuous

Monitoring (8)

RS.MI Mitigation (3)

For each CIS and according to a

number of indicators and

assessment methods, the operator ID.AM Assets Management (5) 6.2 Information security objectives and evaluates its compliance with its ID.RM Risk Management Strategy planning to achieve them ISSP. Indicators may relate to the (2, 3) SR 3.4 - Software and information Security 7.1 Resources NIS - GV.4 risk management organisation’s PR.IP Information Protection integrity indicators 7.2 Competence performance, the maintaining of Processes and Procedures (7, 8) SR 4.1 - Information confidentiality 9 Performance evaluation resources in secure conditions, PR.DS Data Security (4) A.12.1.3 Capacity Management users’ access rights, authenticating ID.BE Business Environment (5)

access to resources, and resource

administration.

ID.GV Governance (3, 4)

ID.RA Risk Assessment (1, 3, 4, 5,

6) 6 Planning ID.RM Risk Management Strategy 8 Operation (2, 3) 9.2 Internal audit The operator establishes and DE.CM Security Continuous 9.3 Management review SR 2.8 - Auditable evens updates a policy and procedures for Monitoring (8) 10 Improvement SR 2.9 - Audit storage capacity performing information system DE.DP Detection Processes (5) Security A.5.1 Management direction for information SR 2.10 - Response to audit processing NIS - GV.5 security assessments and audits of ID.SC Supply Chain Risk (4) audit security failure critical assets and CIS, taking into PR.AC Identity Management, A.12.1 Operational procedures and SR 2.11 - Timestamps account the regularly updated risk Authentication and Access Control responsibilities SR 2.12 - Non-repudiation analysis. (1) A.12.7 Information systems audit PR.PT Protective Technology (1) considerations PR.IP Information Protection A.18.2 Information security reviews Processes and Procedures (7, 12)

RS.IM Improvements (1, 2)

RC.IM Improvements (1, 2)

4.1 Understanding the organisation and its ID.AM Assets Management (6) SR 1.1 - Human user identification and context ID.GV Governance (2, 3) The established information system authentication 4.2 Understanding the needs and expectations RS.CO Communications (1) security policy has a CIS security SR 1.2 - Software process and device Human of interested parties PR.IP Information Protection awareness raising program for all identification and authentication NIS - GV.6 resource 5.3 Organisational roles, responsibilities, and Processes and Procedures (7, 11, staff and a security training SR 1.4 - Identifier management security authorities 12) programme for employees with CIS- SR 1.5 - Authenticator management 6.2 Information security objectives and DE.DP Detection Processes (1) related responsibilities. SR 1.9 - Strength of public key planning to achieve them PR.AT Awareness & Trainings (1, authentication 7 Support 2, 3 4, 5)

RAILWAY CYBERSECURITY

November 2021

9.1 Monitoring, measurement, analysis and SR 2.1 - Authorisation enforcement

evaluation SR 5.2 - Zone boundary protection

A.6.1.1 Information security roles and

responsibilities

A.6.1.2 Segregation of duties

A.7.2 During employment

A.7.1 Prior to employment (screening and

terms & conditions)

A.7.3 Termination and change of employment

A.9.3 User responsibilities

Ecosystem Management

4.1 Understanding the organisation and its

context

4.2 Understanding the needs and expectations

of interested parties The operator establishes a mapping 4.3 Determining the scope of the information ID.AM Assets Management (3, 4, of its ecosystem, including internal security management system 6) Ecosystem and external stakeholders. This SR 5.3 – General purpose person-to- NIS - GV.7 5.2 Policy ID.BE Business Environment mapping mapping may include suppliers, in person communication restrictions 5.3 Organisational roles, responsibilities and (1,2,4) particular those with access to or authorities ID.AM Assets Management (6) managing operator’s critical assets. 8.1 Operational planning and control

A.8 Asset management

A.8.2 Information classification

A.15 Supplier relationships

SR 1.13 - Access via untrusted networks 4.2 Understanding the needs and expectations SR 2.6 - Remote session termination of interested parties SR 2.8 - Auditable evens 5.2 Policy SR 2.9 - Audit storage capacity 7.4 Communication SR 2.10 - Response to audit processing 7.5 Documented information failure 8.1 Operational planning and control SR 2.11 - Timestamps 9.3 Management review RS.CO Communications (4, 5) SR 2.12 - Non-repudiation The operator establishes a policy for A.5.1 Management direction for information ID.RM Risk Management Strategy SR 3.1 - Communication integrity its relations with its ecosystem in security (1) SR 3.5 - Input validation Ecosystem order to mitigate the potential risks A.7.1 Prior to employment NIS - GV.8 ID.GV Governance (2) SR 3.8 - Session integrity relations identified. This includes but is not A.7.2 During employment ID.SC Supply Chain Risk (1, 2, 3, SR 4 - Data confidentiality limited to interfaces shared between A.7.3 Termination and change of employment 4, 5) SR 5.1 - Network segmentation the CIS and third parties. A.12.7 Information systems audit RC.CO Communications (3) SR 5.2 - Zone boundary protection considerations SR 5.3 - General purpose person-to- A.13.2 Information transfer person communication restrictions A.14.2 Security in development and support SR 6.1 - Audit log accessibility processes SR 6.2 - Continuous monitoring A.15 Supplier relationships SR 7.1 - Denial of service protection A.18.1 Compliance with legal and contractual SR 7.6 - Network and security requirements configuration setting

RAILWAY CYBERSECURITY

November 2021

Table 7: Protection Security ID Description ISO/IEC 27002 measures NIST CSF measures CLC/TS50701 measures Measures IT Security Architecture

SR 1.13 - Access via untrusted networks

SR 2.2 - Wireless use control

SR 2.3 - Use control for portable and

mobile devices

SR 2.4 - Mobile code 4.3 Determining the scope of the SR 2.6 - Remote session termination information security management SR 3.1 - Communication integrity system SR 3.3 - Security functionality verification A.6.2 Mobile devices and teleworking SR 3.4 - Software and information integrity A.8.1 Responsibility for assets SR 3.5 - Input validation A.8.3 Media handling SR 3.8 - Session integrity The operator only installs services and A.12.1 Operational procedures and PR.IP Information Protection SR 4.1 - Information confidentiality Systems functionalities or connects equipment responsibilities Processes and Procedures (1, 2, 3) NIS - PR.1 SR 4.2 - Information persistence configuration which are essential for the functioning and A.12.5 Control of operational software DE.AE Anomalies and Events (1) SR 4.3 - Use of cryptography the security of its CIS. A.12.6 Technical vulnerability PR.PT Protective Technology (3) SR 5.1 - Network segmentation management SR 5.2 - Zone boundary protection A.13.1 Network security management SR 5.3 - General purpose person-to- A.14.1 Security requirements of person communication restrictions information systems SR 7.1 - Denial of service protection A.14.2 Security in development and SR 7.2 - Resource management support processes SR 7.6 - Network and security

configuration settings

SR 7.7 - Least functionality

SR 7.8 - Control system component

inventory

SR 1.13 - Access via untrusted networks

SR 2.6 - Remote session termination

SR 3.1 - Communication integrity

SR 3.5 - Input validation

SR 3.8 - Session integrity

SR 4.1 - Information confidentiality PR.DS Data Security (5, 7) SR 4.2 - Information persistence The operator segregates its systems in A.12.1 Operational procedures and PR.PT Protective Technology (3, 4) System SR 4.3 - Use of cryptography NIS - PR.2 order to limit the propagation of IT security responsibilities PR.AC Identity Management, segregation SR 5.1 - Network segmentation incidents within its systems or subsystems. A.13.1 Network security management Authentication and Access Control SR 5.2 - Zone boundary protection (5, 6) SR 5.3 - General purpose person-to-

person communication restrictions

SR 5.4 - Application partitioning

SR 7.1 - Denial of service protection

SR 7.6 - Network and security

configuration settings

RAILWAY CYBERSECURITY

November 2021

Security ID Description ISO/IEC 27002 measures NIST CSF measures CLC/TS50701 measures Measures

SR 1.13 - Access via untrusted networks SR 2.6 - Remote session termination SR 3.1 - Communication integrity SR 3.5 - Input validation SR 3.8 - Session integrity PR.DS Data Security (2) SR 4.1 - Information confidentiality The operator filters traffic flows circulating PR.PT Protective Technology (4) SR 4.2 - Information persistence in its CIS. The operator therefore forbids 8.1 Operational planning and control PR.AC Identity Management, Traffic SR 4.3 - Use of cryptography NIS - PR.3 traffic flows that are not needed for the A.13.1 Network security management Authentication and Access Control filtering SR 5.1 - Network segmentation functioning of its systems and that are A.13.2 Information transfer (3, 5) SR 5.2 - Zone boundary protection likely to facilitate an attack. DE.CM Security Continuous SR 5.3 - General purpose person-to- Monitoring (6, 7) person communication restrictions SR 7.1 - Denial of service protection SR 7.6 - Network and security configuration settings In its ISSP, the operator establishes and implements a policy and procedures related to cryptography, in view of A.10.1 Cryptographic controls ID.GV Governance (3) Cryptograph SR 4.3 - Use of Cryptography NIS - PR.4 ensuring adequate and effective use of A.18.1 Compliance with legal and PR.DS Data Security (1, 2, 5, 6, 8) y SR 5.2 - Zone boundary protection cryptography to protect the confidentiality, contractual requirements PR.PT Protective Technology (4) authenticity and/or integrity of information in its CIS.

IT Security Administration

SR 1.1 - Human user identification and authentication SR 1.2 - Software process and device identification and authentication The operator sets up specific accounts for SR 1.3 - Account management the administration, to be used only for SR 1.4 - Identifier management PR.AC Identity Management, employees that are carrying out A.9.2 User access management SR 1.5 - Authenticator management Administrati Authentication and Access Control NIS - PR.5 administrative operations (installation, A.12.4.3 Administrator and operator SR 1.6 - Wireless access management on accounts (1, 4, 7) configuration, management, maintenance, logs SR 1.7 - Strength of password-based PR.AT Awareness & Trainings (2, 4) etc.) on its CIS. These accounts are kept authentication on an up-to-date list. SR 1.8 - Public key infrastructure (PKI) certificates SR 1.9 - Strength of public key authentication SR 2.1 - Authorisation enforcement

RAILWAY CYBERSECURITY

November 2021

Security ID Description ISO/IEC 27002 measures NIST CSF measures CLC/TS50701 measures Measures

SR 1.1 - Human user identification and

authentication

SR 1.2 - Software process and device

identification and authentication

SR 1.3 - Account management

SR 1.4 - Identifier management A.9.3.1 Use of secret authentication PR.AC Identity Management, SR 1.5 - Authenticator management Hardware and software resources used for information Authentication and Access Control SR 1.6 - Wireless access management Administrati administration purposes are managed and A.9.4 System and application access (1, 3, 4, 6, 7) SR 1.7 - Strength of password-based on configured by the operator, or, where control NIS - PR.6 PR.DS Data Security (5, 6, 7) authentication information appropriate, by the service provider that A.12.1.4 Separation of development, PR.AT Awareness & Trainings (2, 3, SR 1.8 - Public key infrastructure (PKI) systems the operator has authorised to carry out testing and operational environments 4) certificates administration operations. A.12.4.3 Administrator and operator PR.PT Protective Technology (4) SR 1.9 - Strength of public key logs authentication

SR 1.10 - Authenticator feedback

SR 2.1 - Authorisation enforcement

SR 5.2 - Deny by default, allow by

exception

SR 6.1 - Audit log accessibility

Identity and access management

SR 1.1 - Human user identification and

authentication

SR 1.2 - Software process and device

identification and authentication

SR 1.3 - Account management

SR 1.4 - Identifier management

SR 1.5 - Authenticator management

SR 1.6 - Wireless access management

SR 1.7 - Strength of password-based A.9.1 Business requirements of For identification, the operator sets up authentication access control unique accounts for users or for SR 1.8 - Public key infrastructure (PKI) A.9.3 User responsibilities PR.AC Identity Management, Authenticati automated processes that need to access certificates A.9.4 System and application access Authentication and Access Control NIS - PR.7 on and CIS resources. Unused or no longer SR 1.9 - Strength of public key control (1, 4, 6, 7) identification needed accounts are to be deactivated. A authentication A.9.4.2 Secure log-on procedures PR.DS Data Security (5) regular review process should be SR 1.10 - Authenticator feedback A.9.4.3 Password management established. SR 1.11 - Unsuccessful login attempts system SR 1.12 - System use notification

SR 1.13 - Access via untrusted networks

SR 2.1 - Authorisation enforcement

SR 2.2 - Wireless use control

SR 2.3 - Use control for portable and

mobile devices

SR 2.4 - Mobile code

SR 2.5 - Session lock

SR 2.6 - Remote session termination

RAILWAY CYBERSECURITY

November 2021

Security ID Description ISO/IEC 27002 measures NIST CSF measures CLC/TS50701 measures Measures

SR 2.7 - Concurrent session control

SR 5.2 - Zone boundary protection

SR 1.1 - Human user identification and

authentication

SR 1.2 - Software process and device

identification and authentication

SR 1.3 - Account management Among the rules defined in its ISSP, the A.9.1 Business requirements of ID.AM Assets management (5, 6) SR 1.4 - Identifier management operator grants access rights to a user or access control PR.AC Identity Management, SR 1.5 - Authenticator management an automated process only when that A.9.2 User access management Access Authentication and Access Control SR 1.6 - Wireless access management NIS - PR.8 access is strictly necessary for the user to A.9.4.4 Use of privileged utility rights (1, 4, 6, 7) SR 1.7 - Strength of password-based carry out their mission or for the programs PR.DS Data Security (5) authentication automated process to carry out its A.9.4.5 Access control to program PR.PT Protective Technology (3) SR 1.8 - Public key infrastructure (PKI) technical operations. source code certificates

SR 1.9 - Strength of public key

authentication

SR 1.10 - Authenticator feedback

SR 2.1 - Authorisation enforcement

IT Security Maintenance

6.2 Information security objectives and

planning to achieve them

7.5.3 Control of documented

information

8.1 Operational planning and control

10.1 Nonconformity and corrective

action SR 3.1 - Communication integrity The operator develops and implements a A.8.2 Information classification PR.MA Maintenance (1,2) SR 3.3 - Security functionality verification procedure for security maintenance in A.11.2 Equipment PR.IP Information Protection IT security SR 3.4 - Software and information integrity accordance with its ISSP. To this end, the A.12.1.2 Change management Processes and Procedures (1, 2, 3, NIS - PR.9 maintenance SR 3.8 - Session integrity procedure defines the conditions enabling A.12.6.1 Management of technical 4, 7) procedure SR 6.1 - Audit log accessibility the minimum security level to be vulnerabilities PR.DS Data Security (3, 4) SR 7.6 - Network and security maintained for CIS resources. A.13.1 Network security management ID.SC Supply Chain Risk (4) configuration settings A.14.1 Security requirements of

information systems

A 14.2 Security in development and

support processes

A.14.3 Test data

A.15.2 Supplier service delivery

management

RAILWAY CYBERSECURITY

November 2021

Security ID Description ISO/IEC 27002 measures NIST CSF measures CLC/TS50701 measures Measures Physical and environmental security

SR 1.13 - Access via untrusted networks SR 2.6 - Remote session termination ID.AM Assets management (1, 4) SR 2.8 - Auditable events DE.CM Security Continuous SR 2.9 - Audit storage capacity Monitoring (2, 3, 6) SR 2.10 - Response to audit processing The operator prevents unauthorised A.6.2 Mobile devices and teleworking PR.IP Information Protection failures Physical and physical access and damage to, and A.8.1 Responsibility for assets Processes and Procedures (5, 6) SR 2.1 - Timestamps NIS - PR.10 environment interference with the organisation’s A.11 Physical and environmental PR.AC Identity Management, SR 2.12 - Non-repudiation al security information and information processing security Authentication and Access Control SR 4.2 - Information persistence facilities. (2, 3) SR 5.1 - Network segmentation PR.DS Data Security (3) SR 5.2 - Zone boundary protection PR.PT Protective Technology (2, 5) SR 7.5 - Emergency power SR 7.8 - Control system component inventory

RAILWAY CYBERSECURITY

November 2021

Table 8: Defence Security ID Description ISO/IEC 27002 measures NIST CSF measures CLC/TS50701 measures Measures Detection

SR 2.8 - Auditable evens

SR 2.9 - Audit storage capacity

SR 2.10 - Response to audit

processing failure

SR 2.11 - Timestamps

9.1 Monitoring, measurement, analysis SR 2.12 - Non-repudiation The operator sets up a security incident and evaluation PR.DS Data Security (6, 8) SR 3.1 - Communication integrity detection system of the “analysis probe for A.12.2 Protection from malware DE.AE Anomalies and Events (1, 5) SR 3.2 – Malicious code protection files and protocols” type. The analysis A.12.4 Logging and monitoring DE.CM Security Continuous SR 3.3 - Security functionality NIS - DF.1 Detection probes for files and protocols analyses the A.12.6.1 Management of technical Monitoring (1, 2, 3, 4, 5, 6, 7) verification data flows transiting through those probes vulnerabilities DE.DP Detection Processes (1, 2, 3) SR 3.4 - Software and information to seek out events likely to affect the A.15.2.1 Monitoring and review of PR.PT Protective Technology (1) integrity security of the CIS. supplier services SR 3.8 - Session integrity

SR 3.9 - Protection of audit information

SR 5.1 - Network segmentation

SR 5.2 - Zone boundary protection

SR 5.4 - Application partitioning

SR 6 - Timely response to events

SR 1.12 - System use notification

SR 2.8 - Auditable evens ID.RA Risk Assessment (1) 9.1 Monitoring, measurement, analysis SR 2.9 - Audit storage capacity ID.SC Supply Chain Risk The operator sets up a logging system on and evaluation SR 2.10 - Response to audit Management (1) each CIS to record events relating, at A.12.4 Logging and monitoring processing failure PR.MA Maintenance (1,2) least, to user authentication, management A.14.1.2 Securing application services SR 2.11 - Timestamps NIS - DF.2 Logging DE.CM Security Continuous of accounts and access rights, on public networks SR 2.12 - Non-repudiation Monitoring (1, 2, 3, 6, 7) modifications to security rules, and the A.15.2.1 Monitoring and review of SR 3.9 - Protection of audit information DE.AE Anomalies and Events (3) functioning of the CIS. supplier services SR 6 - Timely response to events RS.MI Mitigation (3) A.18.1.3 Protection of records SR 6.2 – Continuous monitoring PR.PT Protective Technology (1) SR 7.8 – Control system component

inventory

ID.RA Risk Assessment (4, 5) SR 2.8 - Auditable evens

9.1 Monitoring, measurement, analysis PR.PT Protective Technology (1) SR 2.9 - Audit storage capacity The operator creates a log correlation and and evaluation DE.AE Anomalies and Events (2, 3, SR 2.10 - Response to audit Log analysis system that mines the events 9.3 Management review 4) processing failure NIS - DF.3 correlation recorded by the logging system installed A.16.1.4 Assessment of and decision DE.DP Detection Processes (3, 4, 5) SR 2.11 - Timestamps and analysis on each of the CIS to detect events that on information security events PR.IP Information Protection SR 2.12 - Non-repudiation affect CIS security. A.16.1.7 Collection of evidence Processes and Procedures (7) SR 3.9 - Protection of audit information

RS.AN Analysis (1, 5) SR 6 - Timely response to events

RAILWAY CYBERSECURITY

November 2021

Computer Security Incident Management

ID.RA Risk Assessment (3, 4, 5, 6) SR 2.8 - Auditable evens ID.SC Supply Chain Risk SR 2.9 - Audit storage capacity Management (5) SR 2.10 - Response to audit PR.IP Information Protection Information The operator creates, keeps up-to-date processing failure Processes and Procedures (9, 10) system and implements a procedure for handling, A.16.1 Management of information SR 2.11 - Timestamps RS.AN Analysis (1, 2, 3, 4, 5) NIS - DF.4 security responding to and analysing incidents that security incidents and improvements SR 2.12 - Non-repudiation RS.MI Mitigation (1, 2, 3) incident affect the functioning or the security of its A.16.1.7 Collection of evidence SR 3.9 - Protection of audit information RS.IM Improvements (1, 2) response CIS, in accordance with its ISSP. SR 5.1 - Network segmentation RS.CO Communications (1, 3, 4, 5) SR 5.2 - Zone boundary protection RS.RP Response Planning (1) SR 5.4 - Application partitioning RC.RP Recovery Planning (1) SR 6 - Timely response to events RC.CO Communications (2)

SR 2.8 - Auditable evens

SR 2.9 - Audit storage capacity 7.5 Documented information SR 2.10 - Response to audit The operator creates, keeps up-to-date A.12.1 Operational procedures and Incident RS.CO Communications (2, 3, 4, 5) processing failure NIS - DF.5 and implements procedures for incidents responsibilities reporting DE.DP Detection Processes (4) SR 2.11 - Timestamps reporting. A.16.1 Management of information SR 2.12 - Non-repudiation security incidents and improvements SR 3.9 - Protection of audit information

SR 6 - Timely response to events

The operator implements a service that SR 2.8 - Auditable evens

enables it to take note, without delay, of SR 2.9 - Audit storage capacity Communicat information sent out by its national 7.4 Communication SR 2.10 - Response to audit ion with RS.CO Communications (2, 3, 4, 5) competent authority concerning incidents, 7.5 Documented information processing failure NIS - DF.6 competent DE.DP Detection Processes (4) vulnerabilities, threats and relevant A.6.1 Internal organisation SR 2.11 - Timestamps authorities ID.RA Risk Assessment (2) mappings (up-to-date inventory of CIS, A.8.2.2 Labelling of information SR 2.12 - Non-repudiation and CSIRTs interconnections of CIS with third-party SR 3.9 - Protection of audit information

networks, etc.). SR 6 - Timely response to events

RAILWAY CYBERSECURITY

November 2021

Table 8: Resilience Security ID Description ISO/IEC 27002 measures NIST CSF measures CLC/TS50701 measures Measures

Continuity of operations

SR 2.8 - Auditable evens SR 3.1 – Communication integrity

SR 3.3 - Security functionality verification ID.RM Risk Management Strategy SR 3.6 - Deterministic output (1, 2, 3) 9.3 Management review SR 3.7 - Error handling PR.IP Information Protection In accordance with its ISSP, the operator 10.2 Continual improvement SR 4.1 – Information confidentiality Processes and Procedures (4, 7, 9, Business defines objectives and strategic A.5.1.2 Review of the policies for SR 4.2 – Information persistence 10) NIS - RS.1 continuity guidelines regarding business continuity information security SR 5.2 - Zone boundary protection RS.IM Improvements (2) management management, in case of an IT security A.11.2.4 Equipment maintenance SR 6.1 - Audit log accessibility RC.IM Improvements (1, 2) incident. A.17.1 Information security continuity SR 7.1 - Denial of service protection RC.RP Recovery Planning (1) A.17.2 Redundancies SR 7.2 - Resource management RC.CO Communications (1, 2, 3) SR 7.3 - Control system backup PR.PT Protective Technology (5) SR 7.4 - Control system recovery and

reconstitution SR 7.5 – Emergency power

ID.BE Business Environment (5) SR 5.2 - Zone boundary protection

In accordance with its ISSP, the operator PR.PT Protective Technology (5) SR 7.1 - Denial of service protection

Disaster defines objectives and strategic PR.IP Information Protection SR 7.2 - Resource management

NIS - RS.2 recovery guidelines regarding disaster recovery A.17.2 Redundancies Processes and Procedures (9, 10) SR 7.3 - Control system backup

management management, in case of a severe IT PR.DS Data Security (4) SR 7.4 - Control system recovery and

security incident. RC.IM Improvements (1, 2) reconstitution RC.RP Recovery Planning (1) SR 7.5 – Emergency power

Crisis management

5.3 Organisational roles, SR 3.3 - Security functionality verification

The operator defines the organisation for responsibilities and authorities ID.BE Business Environment (5) SR 7.1 - Denial of service protection Crisis crisis management in its ISSP in case of A.6.1.1 Information security roles and PR.DS Data Security (4) SR 7.2 - Resource management NIS - RS.3 management IT security incidents and to ensure the responsibilities PR.IP Information Protection SR 7.3 - Control system backup organisation continuity of the organisation’s activities. A.11.2.4 Equipment maintenance Processes and Procedures (10) SR 7.4 - Control system recovery and

A.17.1 Information security continuity reconstitution

7.4 Communication RC.CO Communications (1, 2, 3) SR 2.8 - Auditable evens

The operator defines the processes for 9.3 Management review RC.RP Recovery Planning (1) SR 3.3 - Security functionality verification

crisis management in its ISSP which the 10.2 Continual improvement RS.IM Improvements (1, 2) SR 6.1 - Audit log accessibility Crisis crisis management organisation will A.5.1.2 Review of the policies for ID.SC Supply Chain Risk SR 7.1 - Denial of service protection NIS - RS.4 management implement in case of IT security incidents information security Management (5) SR 7.2 - Resource management process and to ensure the continuity of an A.6.1.3 Contact with authorities PR.IP Information Protection SR 7.3 - Control system backup organisation’s activities. A.11.2.4 Equipment maintenance Processes and Procedures (4, 9, 10) SR 7.4 - Control system recovery and

A.17.1 Information security continuity PR.PT Protective Technology (5) reconstitution

-N -EN -425 -21 -01 TP ABOUT ENIS A The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu. ISBN 978-92-9204-545-6 doi: 10.2824/92259

Fotnoter

1 The method Afhankelijkheids- en Kwetsbaarheidsanalyse (A&K analysis) was developed in draft form by the Dutch public company RCC. The Dutch Ministry of Internal Affairs completed its development in 1996 and published a handbook describing the method. The method has not been updated since that time. The A&K analysis is the unique and preferred method for risk analysis by Dutch government bodies since 1994. In addition to the Dutch government, Dutch companies often use A&K analysis. https://www.enisa.europa.eu/topics/threat-risk-management/risk-management/current-risk/risk-management-inventory/rm-ramethods/m_dutch_ak_analysis.html 2 With the BSI Standard 200-3, the BSI provides an easy-to-apply and recognised procedure which allows organisations adequate and targeted control of their information security risks. The procedure is based on the elementary threats described in the IT-Grundschutz Compendium on the basis of which the IT-Grundschutz-modules were drawn up. https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi-standard- 2003_en_pdf.html;jsessionid=A26D9630FC3E530CDEECEACC00297837.internet461?nn=128620 3 EBIOS Risk Manager (EBIOS RM) is the method for assessing and treating digital risks, published by National Cybersecurity Agency of France (ANSSI) with the support of Club EBIOS. It provides a toolbox that can be adapted, the use of which varies according to the objective of the project. EBIOS Risk Manager is compatible with the reference standards in effect, in terms of risk management as well as in terms of cybersecurity. https://www.ssi.gouv.fr/en/guide/ebios-risk-manager-the-method/ 4 The NIS Cooperation Group is composed of representatives of Member States, the Commission, and ENISA, has been established under the NIS Directive. It facilitates strategic cooperation between the Member States regarding the security of network and information systems. https://digital-strategy.ec.europa.eu/en/policies/nis-cooperation-group
5 The STRIDE model is a model of threats developed by Microsoft to identify computers security threats, as the first step in a proactive security analysis process. The next steps in the process are identifying the vulnerabilities in the implementation and then taking measures to close security gaps. STRIDE model defines a threat as any potential occurrence, malicious or otherwise, that can have an undesirable effect on the system resources. STRIDE stands for 6 main threats: Spoofing of user identity, Tampering with data, Repudiability, Information disclosure (privacy breach), Denial of Service (DoS) and Elevation of privilege. Vulnerability is an unfortunate characteristic that makes it possible for a threat to occur. An attack is an action taken by a malicious intruder to exploit certain vulnerabilities to enact the threat. It was created to be applied to a specific system or during the development of a product; therefore, it is less relevant at a company level, as it does not encompass the whole risk management process. Nevertheless, it can be used with a more global methodology when defining the threats. https://docs.microsoft.com/en-us/archive/msdn-magazine/2006/november/uncover-security-design-flaws-using-the-stride-approach 6 According to IEC62443, security capabilities are organised according to seven Foundational requirements (FR1 Identification and Authentication Control, FR2 – Use Control, FR3 - System Integrity, FR4 – Data Confidentiality, FR5 – Restricted Data Flow, FR6 – Timely Response to Events, and FR7 – Resource Availability. 7 https://cyrail.eu/about-cyrail-project-1
8 https://www.eulynx.eu/index.php/documents/published-documents/open-availability/baseline-set-3/257-20200623-eulynx-documentation-plan-eu-doc- 11-v3-4-0-a/file 9 https://github.com/OCORA-Public 10 Deutsche Bahn (DB), Société nationale des chemins de fer français (SNCF), Nederlandse Spoorwegen (NS), Österreichische Bundesbahnen (ÖBB) and Schweizerische Bundesbahnen (SBB
11 See https://www.enisa.europa.eu/publications/railway-cybersecurity 12 See X2R3-T8_3-D-SMD-004-06_-_Deliverable_D8.2-3c_Protection_profile___On-board_components and X2R3-T8_3-D-SMD-009-06_- _Deliverable_D8.2-3b_Protection_Profile_-_Trackside 13 See RCA Gamma published (eulynx.eu)
14 See X2Rail-3 Deliverable D8.1 Guidelines for railway cybersecurity 15 See ISO 27005, annex E, E.2 Detailed information security risk assessment 16 See ISO 27005, annex E, E.2 Detailed information security risk assessment 17 https://www.enisa.europa.eu/topics/threat-risk-management/threats-and-trends/enisa-threat-landscape/threat-taxonomy/view
18 See https://www.enisa.europa.eu/topics/threat-risk-management/threats-and-trends/enisa-threat-landscape/threat-taxonomy/view 19 https://www.enisa.europa.eu/topics/threat-risk-management/threats-and-trends 20 https://attack.mitre.org/ https://capec.mitre.org/
22 See https://www.railtech.com/digitalisation/2017/12/11/wannacry-virus-was-wake-up-call-for-railway-industry/
23 See https://d3security.com/blog/data-breach-of-the-month-rail-europe-north-america/ 24 See https://cyware.com/news/cyber-incidents-affecting-railways-a-threat-to-customer-data-a8d25ccc
25 Wi-Fi for transport service provider See https://www.bbc.com/news/technology-51682280
27 French Hosting and Cloud company See https://www.reuters.com/article/us-france-ovh-fire-idUSKBN2B20NU
See for instance ISO 27005, chapter 9 Information security risk treatment 30 See ISO 27005, chapter 9.2 Risk modification 31 See ISO 27005, chapter 9.3 Risk retention 32 See ISO 27005, chapter 9.5 Risk avoidance 33 See ISO 27005, chapter 9.5 Risk sharing 34 Reference document on security measures for Operators of Essential Services, p.5 35 A list of 20 actions for cyber defence, that are close to the NIST 23 categories, and published by the SANS Institute, an organisation that provides information, resources, and training regarding cybersecurity. 36 A security model declined in 123 security components (controls) divided into 25 functions and 4 domains has been cited. It is published by the market research company Forrester.
37 https://www.enisa.europa.eu/topics/threat-risk-management/risk-management/current-risk/risk-management-inventory/rm-ramethods/m_iso27001.html 38 ISO/IEC 27001 Standard - Information technology - Security techniques - Information security management systems – Requirements, p9
39 The security measures of CLC/CS 50701 are matching the measures described in IEC 62443-3-3:2013.
When a reference to a document is not given, the element was added based on the consultation with experts (workshops).
When a reference to a document is not given, the element was added based on the consultation with experts (workshops).
When a reference to a document is not given, the element was added based on the consultation with experts (workshops).

Good practices in cyber risk management NOVEMBER 2021 0 RAILWAY CYBERSECURITY

ABOUT ENISA

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

TABLE OF CONTENTS

RAILWAY CYBERSECURITY

EXECUTIVE SUMMARY

RAILWAY CYBERSECURITY

ABBREVIATIONS

RAILWAY CYBERSECURITY

1. INTRODUCTION

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

2. CYBER RISK MANAGEMENT

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

3. RAILWAY ASSETS AND SERVICES

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

Figure 2: Railway Service categories

RAILWAY CYBERSECURITY

Figure 3: Railway devices

RAILWAY CYBERSECURITY

Figure 4: Railway Physical Equipment Figure 5: People and Data

RAILWAY CYBERSECURITY

4. CYBER-RELATED THREATS

RAILWAY CYBERSECURITY

Figure 6: Threat taxonomy

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

5. CYBERSECURITY MEASURES

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

Measure Description ISO/IEC 27002 NIST CSF CLC/TS50701

RAILWAY CYBERSECURITY

6. CONCLUSIONS

RAILWAY CYBERSECURITY

7. BIBLIOGRAPHY

RAILWAY CYBERSECURITY

A ANNEX: ASSET DESCRIPTIONS

Table 1: Assets per device category Assets Description Attribute Reference

RAILWAY CYBERSECURITY

Assets Description Attribute Reference

Table 2: Assets per service category Assets Description Attribute References

RAILWAY CYBERSECURITY

Assets Description Attribute References

RAILWAY CYBERSECURITY

Assets Description Attribute References

RAILWAY CYBERSECURITY

Assets Description Attribute References

Table 3: Assets per physical equipment category (description) Assets Description Reference

RAILWAY CYBERSECURITY

Assets Description Reference

RAILWAY CYBERSECURITY

Table 4: People and data (description) Assets Description

RAILWAY CYBERSECURITY

B ANNEX: THREATS DESCRIPTION

Table 5: Threat categories and descriptions

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

C ANNEX: SECURITY MEASURES

Table 6: Governance Security ID Description ISO/IEC 27002 measures NIST CSF measures CLC/TS50701 measures Measures

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

RAILWAY CYBERSECURITY

Table 7: Protection Security ID Description ISO/IEC 27002 measures NIST CSF measures CLC/TS50701 measures Measures IT Security Architecture

RAILWAY CYBERSECURITY