How rail operators can protect themselves from cyber threats

Rail is a critical part of the UK’s infrastructure. It is key to ensuring that goods and supplies can get across the country, as well as for the thousands of people who rely on train services for work, education and more. 

All this means that rail services need to be protected from potential threats at all costs. And while operators can handle most challenges, one area which will be of concern to them is the growing risk of cyber attacks. 

Cyber security has become an important consideration for rail providers. Many of their trains and operations rely on digital solutions to run effectively. This means that, should a cyber threat rear its head, it could lead to service disruption or valuable data being taken by attackers. These potential threats came to light this year in Poland, where hackers attacked railway frequencies and disrupted traffic in the north-west of the country.

At the same time, regulations like The Data Protection Act (2018) means operators must adequately protect their digital platforms. If they are attacked and haven't done so, they may face heavy financial penalties and severe reputational damage. 

Cyber threats are constantly evolving, and there is no catch all approach to beating them. But there are practical steps that can be taken to improve resilience against attacks and protect our critical rail services. 

Moving away from legacy systems

One of the biggest issues rail operators face is their reliance on outdated systems and platforms. In our experience, many continue to use legacy software and tools they installed over 10 years ago. While these solutions may provide stability as everyone understands how to use them, they also pose security risks. This is because software providers are unlikely to be doing patchwork or upgrades to keep them secure. At the same time, hackers may know where vulnerabilities lie in these systems because they’ve been breaching them for such a long time.

To reduce these threats, operators must move away from outdated solutions. They should work with digital partners who can help them understand which systems are at risk and what replacements or actions they need to take to stay protected. These changes will not only improve their cyber resilience, but also services. This is because they can bring in new platforms which will streamline and automate a lot of their current security processes.

Assessments and accreditation

Next, operators need to ensure they comply with regulations. This is where cyber security benchmarks and assessments can prove invaluable. 

Benchmarking solutions, like Microsoft Secure Score, allow organisations to test and measure their cyber security capabilities. They then offer a numerical score and recommend specific actions to strengthen cybersecurity. These tools can ensure risks which may have been missed internally are spotted and addressed at the earliest opportunity. At the same time, undertaking security accreditation processes, such as the government’s Cyber Essentials Programme, means operators can guarantee they are meeting regulatory standards. This will reduce the risk of them receiving heavy fines or repetitional damage should the worst happen.

Benchmarking and accreditations are important steps, but you shouldn't stop there. Simply getting an evaluation and implementing recommendations isn't enough. Cyber threats are always changing. Operators must also work with digital partners to review their systems, find vulnerabilities, and improve their cybersecurity measures on a regular basis.

Staff training and upskilling

Finally, it’s not only hardware and software that rail providers need to engage with to tackle cyber threats, but also their people. A recent study found that 70% of corporate breaches are a direct result of employee error or malicious intent.  22% of security decision makers also said employees unintentionally putting data at risk had been the main cause of a data breach at their organisation.

This highlights the threat that human error can pose to rail operators data and security. To address this, staff need knowledge and skills to understand and address threats like phishing emails or using unprotected devices to access sensitive information. Rail operators can minimise the risk of human error by developing clear security policies and processes, while also providing regular cyber security training, and sharing knowledge. This will ensure that employees have the tools they need to promptly address cyber threats.

The UK's rail network is vital and, as such, its security is of the utmost importance. As such, operators must ensure they have the tools and knowledge necessary to address any and all threats, including cyber attacks. By moving away from legacy solutions, as well as regular accreditation, assessments and staff training, rail providers can guarantee they are taking all the steps necessary to be as secure as possible.