Digital security experts hunt for vulnerabilities on new trains

Ricardo brings knowledge of rail operations, rolling stock design, systems engineering and passenger interaction, while Roke has for many years supported critical national infrastructure and government organisations with its cyber expertise.”

With an in-house Bombardier team, Ricardo and Roke look into possible threats from espionage to remote hacking, and will benchmark against current industry standards and national legislation including the Network and Information Systems Directive (NIS Regulations), as well as defined practices from the US National Institute of Standards and Technology (NIST), CISSP (Certified Information Systems Security Professional), and previous reviews conducted by Roke for the UK Ministry of Defence.

“Transport systems are set to be the next big challenge in cyber security,” said Roke innovation director Dr Andrew Rogoyski. “Connecting trains, vehicles and ships via the internet has the potential to post significant life safety implications. This work is therefore a landmark development, as a major train manufacturer seeks to integrate cyber security assessments into their design and testing processes.”

“Unlike traditional enterprise security assessments, the Ricardo-Roke approach focuses around the unique characteristics and priorities of day-to-day rail operations, such as the importance of maintaining a safe and open environment for passengers whilst ensuring minimum disruption to the network,” according to Ricardo head of digital railway Doug Blanc.

Bombardier with get a risk-based assessment of its Aventra platform, identify vulnerabilities and recommending ways to mitigate risk, incorporated into Bombardier’s existing risk management practices.

“This assessment will provide Bombardier customers with a significant evidence base with which to demonstrate compliance to the NIS cyber assessment framework,” said Bombardier.

Photo:  Bombardier Aventra trains destined for Transport for London’s Elizabeth Line.