Security for Railway Infrastructure
Nunes, João Paulo Brás
MSc Thesis · 2025 · University of Coimbra
Supervisors: Paulo Alexandre Ferreira Simões, Tiago José dos Santos Martins da Cruz
Abstract
The Railway industry is currently undertaking a big step towards digitization.Railway systems are a critical infrastructure of a region or country, moving goodsand passengers. Nowadays railway systems being increasingly digital, and completelyinterconnected.Railway infrastructure is a critical Operational Technology (OT) system, withsome characteristics, such as being expected to work 24x7, 365 days a year. Ifsomething does not work as planned, and the OT system is compromised, itcan cause a train accident, or interrupt traffic, the losses can be very high, in thestandpoint of business and as well as for the safety of passengers, staff and ultimatelyto human life. So, it becomes a critical target for cyber-warfare from terrorgroups and foe nations. Even minor disruptions in critical rail systems can resultin temporary product shortages that can cause significant harm to national security.Prolonged disruptions in the flow of commodities could lead to widespreadsupply chain disruptions, with ripple effects across the economy. Disruptionsand delays can affect industries that depend on the commodities transported bythe railroads, which becomes a matter of national defence.Due to cyber-threats to railway systems, the industry, suppliers, integrators, operatorsand governing agencies had the need to develop standards, technical specificationsand guidelines, to help to protect these systems. It is also intended toreach a level of harmonization of the implemented measures and controls acrossthe same geographical space. In this dissertation, it will be depicted what normsand standards have been, or are being developed, and implement across the EuropeanUnion member states and the United States of America, that are specificallyapplicable to the railway ecosystem. There is also a succinct description ofwhich cyber-related European legislation applied to railway operators as suppliersof essential services. It also covers in detail what are the necessary steps toapply CENELEC Technical Specification CLC/TS 50701 - Railway applications -Cybersecurity (TS50701).The latter portion of this dissertation details the development of a software applicationdesigned for anomaly detection within critical communication messageson the train’s internal bus, specifically those exchanged between the control systemand its peripherals. Identified anomalies may represent sensor or actuatorfailures or malicious control system tampering.