OTVista
Book a demo

OT cybersecurity for railways and transportation

Railway systems combine safety-critical signalling, traction power, operational communications and passenger systems over hundreds of kilometres. Security must work within established safety assurance processes.

Industry sheet
Sector
Railways and transportation
Representative systems
5
Typical challenges
5
Example
Illustrative

Industry context

Covers:

  • Mainline and freight rail
  • Metro and light rail
  • Traction power
  • Stations and depots

Railway operators manage signalling and train control, traction power SCADA, communications networks, station systems and depot equipment. Each has different owners, suppliers and safety requirements.

Safety-related changes go through formal assurance processes, so security improvements must be planned in a way those processes can accept. Guidance such as CENELEC TS 50701 applies IEC 62443 concepts to the railway domain.

Reference architecture

Site D: Mainline railway

An operations control centre for traffic and traction power, with interlocking and trackside assets. Select a zone to see its role, key risks and recommended controls.

Site D Mainline railwayAn operations control centre for traffic and traction power, with interlocking and trackside assets.
Site D: Mainline railway OT reference architecture (Railways and transportation) L4 L3.5 L3 L2 L0 Corporate WS, Enterprise IT Corporate WS Timetabling, Enterprise IT Timetabling Passenger info, Enterprise IT Passenger info Edge router, Enterprise IT Edge router Data exchange, Operations DMZ Data exchange Remote maint., Operations DMZ Remote maint. Patch / AV, Operations DMZ Patch / AV DMZ switch, Operations DMZ DMZ switch Traffic mgmt, OCC: Traffic management Traffic mgmt Dispatcher WS, OCC: Traffic management Dispatcher WS OCC switch, OCC: Traffic management OCC switch Power SCADA, OCC: Traction power Power SCADA Power controller, OCC: Traction power Power controller SCADA switch, OCC: Traction power SCADA switch Interlocking, Signalling (SIL 4) Interlocking RBC (ETCS), Signalling (SIL 4) RBC (ETCS) GSM-R / FRMCS, Signalling (SIL 4) GSM-R / FRMCS Signal net, Signalling (SIL 4) Signal net Substation RTU, Traction substation Substation RTU Protection IED, Traction substation Protection IED Sub switch, Traction substation Sub switch Signal, Trackside Signal Point machine, Trackside Point machine Axle counter, Trackside Axle counter Balise, Trackside Balise Traction transformer, Trackside Traction transformer Enterprise ITIT Operations DMZSL 2 Firewall: HTTPS, file transferHTTPS, file transfer OCC: Traffic managementSL 3 Firewall: Application gatewayApplication gateway OCC: Traction powerSL 3 Firewall: Application gatewayApplication gateway Signalling (SIL 4)SL 4 Firewall: Signalling protocolSignalling protocol Traction substationSL 3 Firewall: IEC 60870-5-104IEC 60870-5-104 TracksideSL 2 Assessment scope
Enterprise ITDMZOT operationsCritical controlField / safety

Tap a zone for its risks and controls, or a device for its security requirements.

Illustrative reference architectures, simplified for clarity. Security levels shown are example targets. Not live data.

Representative OT systems and dependencies

  • Signalling and train controlInterlockings, train control and wayside equipment.
  • Traction power SCADASupervision and control of substations feeding the line.
  • Operational communicationsRadio, transmission networks and operational telephony.
  • Control centresOperations and traffic management systems.
  • Station and depot systemsBuilding management, passenger information and depot equipment.

Common cybersecurity challenges

  • Distributed sitesEquipment rooms and trackside cabinets along the route.
  • Safety assuranceChanges must fit existing safety cases and approval processes.
  • Multiple suppliersDifferent vendors and maintainers for each subsystem.
  • Engineering accessMaintainers needing local and remote access across the network.
  • AvailabilityVery limited possession windows for work on live infrastructure.

Relevant assessment areas

  • Zone and conduit definition across subsystems
  • Supplier and maintainer access
  • Traction power SCADA security
  • Control centre and communications architecture
  • Asset inventory along the route
  • Security requirements for new projects

Relevant OTVista services

Defining security requirements for a new line section

Illustrative example

Situation

An operator is extending a line and wants security requirements in the contracts rather than adding controls after commissioning.

Result

Suppliers receive clear, testable security requirements and the operator can track compliance during delivery.

Structured approach

  1. Define zones and conduits for the new section with the engineering team.
  2. Assess risk to set target security levels per zone.
  3. Translate targets into supplier requirements and evidence expectations.
  4. Plan how evidence will be reviewed during delivery.

This scenario is a hypothetical example of a common situation in the sector, not a description of OTVista client work.

Questions from railways and transportation teams

Is there a railway-specific OT security standard?

CENELEC TS 50701 provides cybersecurity guidance for railway applications and builds on IEC 62443 concepts. Applicability depends on your jurisdiction and project.

How do security changes fit the safety case?

Security changes affecting safety-related systems should go through your normal assurance process. Planning them early and documenting their safety impact avoids delays.

From the blog

Latest OT security insights

All posts

Discuss OT cybersecurity for your operations

Tell us about your sites, systems and priorities, and we'll suggest a practical starting point.

Request a consultation