APTA-SS-CC-03-15 [2015], Rail Transit Control, Part IIIa

Digital technologies can improve railway operations, but greater connectivity creates new cybersecurity challenges. Research on smart railways highlights concerns involving system reliability, interoperability, security, privacy, and vulnerabilities to cyberattacks. As rail systems become more dependent on connected technologies, cybersecurity is essential for protecting operations and maintaining reliable service. APTA-SS-CC-03-15 [2015], Securing Control and Communications Systems in Rail Transit Environments, Part IIIa provides recommendations for attack modeling analysis that transit agencies may include in procurement documents for new rail systems or major upgrades.

Importance of Cybersecurity in Rail Transit

Rail transit systems depend on interconnected control and communications technologies—including train control, signaling, communications, and monitoring. As more of these technologies become connected and digitally enabled, robust cyber defenses are required to protect rail operations from disruptions. Incorporating cybersecurity considerations into the planning and procurement of new systems and major upgrades can help transit agencies identify potential risks and establish security requirements before technologies are put into service.

What Is APTA-SS-CC-03-15 [2015]?

APTA-SS-CC-03-15 [2015] is a White Paper that contains recommendations for attack modeling analysis that may be specified in transit agency procurement documents to examine security aspects for new rail systems or major upgrades. By examining potential attack scenarios during the procurement process, transit agencies can better understand security risks and establish cybersecurity considerations before systems become part of the rail network.

This White Paper, part of a series of related documents, covers the APTA attack modeling procedure for transit agencies and their systems integrators and vendors, which may be specified by transit agencies in their procurement documents.

APTA-SS-CC-03-15 [2015] should be used in conjunction with Part I and Part II of this series.

Who Should Use APTA-SS-CC-03-15 [2015]?

APTA recommends the use of APTA-SS-CC-03-15 [2015] by:

• Individuals or organizations that operate rail transit systems
• Individuals or organizations that contract with others for the operation of rail transit systems
• Individuals or organizations that influence how rail transit systems are operated (including but not limited to consultants, designers and contractors)

Cybersecurity Risks in Modern Transportation

Transportation systems are part of critical infrastructure and rely on interconnected digital technologies, automated systems, operational technology (OT), GPS, and real-time data. These technologies can improve efficiency and convenience, but they also can introduce potential vulnerabilities that cyber attackers may exploit. A successful attack could interfere with communications, disrupt operations, compromise sensitive information, or create safety concerns. Identifying these potential risks early is therefore an important part of designing and upgrading secure transportation systems.

APTA-SS-CC-03-15 [2015] addresses these risks by providing recommendations for attack modeling analysis that can help transit agencies identify potential security risks when procuring new rail systems or making major upgrades.

Where to Find APTA-SS-CC-03-15 [2015]

APTA-SS-CC-03-15 [2015], Securing Control and Communications Systems in Rail Transit Environments, Part IIIa is available on the ANSI Webstore, the best place to buy APTA standards.