Railway Cybersecurity: Protecting Signalling and Rolling Stock OT

01Key takeaways

1. 01

   Railway OT spans signalling, interlockings, train control (ETCS/ERTMS, CBTC), rolling stock and control centres; each has a different exposure profile and a safety case to protect.

2. 02

   The dominant rail risk is not data theft but loss of safe and available operation, so security must align with the safety lifecycle, not compete with it.

3. 03

   TS 50701 adapts IEC 62443 to railways, giving the sector a shared way to define zones, conduits and security levels across signalling and rolling stock.

4. 04

   Under NIS2, many rail operators and infrastructure managers are essential entities with formal risk-management and incident-reporting duties.

5. 05

   One-way transfer and scheduled segmentation reduce inbound reachability into signalling and interlocking zones; they are one control among many, not a replacement for asset inventory, patching, identity and monitoring.

02What railway cybersecurity actually covers

Railway cybersecurity covers the systems that keep trains moving and keep them apart. That includes signalling and interlockings that set routes and protect against conflicting movements, train control systems such as ETCS/ERTMS and urban CBTC, onboard rolling-stock systems like train control and management systems, and the operational control centres and trackside networks that connect them.

It is useful to separate three domains. Safety-critical signalling and train control sit at the core. Operational systems such as traffic management, passenger information and SCADA for power and stations sit alongside. Corporate IT sits outside. The security objective is to keep these domains properly separated and to make sure data crossing between them does not open a path back into the safety-critical core.

Short version: railway cybersecurity protects the OT that controls train movement, where the primary asset to defend is safe, available operation, not just confidential data.

03Why it matters now

Rail is critical infrastructure. A signalling outage can strand thousands of passengers, a manipulated route or speed command can threaten safety, and recovery in a safety-regulated environment is deliberately slow because every change must be justified against the safety case. The consequences scale with the network, which makes rail an attractive target and a high-consequence one.

The exposure has grown as railways modernise. ERTMS replaces fixed lineside signals with digital movement authorities over radio. CBTC puts continuous train control on data networks. Remote diagnostics, predictive maintenance and connected rolling stock add data flows that did not exist a generation ago. Each new connection is operationally valuable and is also a potential way in.

Regulation has caught up. In the EU, the NIS2 Directive classifies transport, including rail, as a highly critical sector, placing formal cybersecurity risk-management and incident-reporting obligations on infrastructure managers and railway undertakings. Boards now own this risk explicitly.

04The rail OT landscape: signalling, train control and rolling stock

To secure rail OT you have to understand what is actually on the network. The estate mixes vendor-specific safety systems, long-lived legacy equipment and newer IP-based platforms, often on the same line.

Interlocking

The vital logic, electronic or relay-based, that prevents conflicting train movements by controlling points and signals; the heart of the signalling safety case.

ETCS / ERTMS

European Train Control System within the European Rail Traffic Management System; the Radio Block Centre issues movement authorities to onboard units, with balises providing position references.

CBTC

Communications-Based Train Control used on metros and urban lines; continuous, high-availability train control over a trackside data and radio network.

GSM-R and FRMCS

The bearer radio for ERTMS communications; GSM-R is being succeeded by the Future Railway Mobile Communication System (FRMCS) over modern mobile technology.

TCMS

The Train Control and Management System onboard rolling stock, linking traction, braking, doors, diagnostics and passenger systems over a train network.

These systems were engineered for safety and availability first. Many predate modern network security, use specialised or proprietary protocols, and cannot be patched on an IT cadence. That reality shapes every control decision that follows.

05The rail threat model and attacker techniques

The realistic concern is rarely a single dramatic exploit of vital signalling logic, which is heavily protected by safety engineering. It is the indirect path: a compromised maintenance laptop, an exposed remote-access route, a flat operational network, or a trusted data flow that turns out to be bidirectional. From there an attacker pivots toward control.

MITRE ATT&CK for ICS describes the techniques that matter in OT terms. In a rail context the relevant ones include exploitation of remote services and engineering workstations for initial access and lateral movement, manipulation of control or denial of control against operational systems, denial of view that blinds controllers, and loss of availability that halts service. Most begin in IT or in a poorly segmented operational zone rather than inside the interlocking itself.

• Remote-access and supplier-maintenance paths into trackside or control-centre networks that were never meant to be standing connections.
• Engineering and diagnostic laptops moved between corporate IT and signalling environments, carrying malware across the boundary.
• Flat or weakly segmented operational networks where traffic management, SCADA and signalling share reachability.
• Data flows for diagnostics, telemetry or passenger information that are bidirectional when only outbound publication is needed.
• Wireless bearers for ERTMS or CBTC where authentication, integrity and key management are the real defence, not the radio itself.

06Reference architecture: zones, conduits and segmentation

The architectural answer in rail is the same one IEC 62443 and TS 50701 promote: think in zones and conduits, not flat networks. Group assets of similar trust and consequence into zones, then define every permitted path between them as a deliberate, controlled conduit with a stated direction and purpose.

In practice that means separating the vital signalling and interlocking zone from operational traffic management, separating both from corporate IT, and treating control-centre-to-trackside and train-to-ground links as defined conduits rather than open networks. Each conduit should answer one question plainly: which way does data legitimately need to flow, and does anything need to come back?

A good rail design makes the safety-critical zone the hardest to reach inbound. Signalling can publish status, logs and telemetry outward, but operational and corporate systems should not have a standing path back into the interlocking zone.

07Practical controls and where to start

Security in rail has to be additive to the safety case. The strongest early wins reduce reachability and improve visibility without touching vital logic, so they can be justified and tested without reopening the safety argument.

• Build an accurate asset inventory across signalling, control-centre, trackside and rolling-stock networks, including legacy and supplier-managed devices.
• Segment operational networks into IEC 62443 / TS 50701 zones with explicitly defined, minimal conduits between them.
• Eliminate standing remote access; replace it with brokered, time-limited, monitored sessions for maintenance and suppliers.
• Control engineering and diagnostic laptops with strict media, application and connection policies to stop cross-domain contamination.
• Make outbound-only data flows genuinely one-way where the destination never needs to initiate traffic back into signalling.
• Deploy passive OT monitoring that understands rail and ICS protocols, so detection does not depend on touching vital systems.
• Plan recovery for signalling and control-centre systems explicitly, including offline-protected backups and tested restoration.

Sequence matters. Inventory and segmentation come before detection, and detection comes before any intrusive control, because you cannot defend or monitor what you have not mapped.

08Standards and compliance mapping

Rail has its own bridge between safety standards and OT security. CLC/TS 50701 adapts the IEC 62443 framework to railway applications, giving signalling, rolling-stock and operational engineers a shared vocabulary of zones, conduits and security levels that fits the rail safety lifecycle.

CLC/TS 50701

The CENELEC technical specification for cybersecurity in railway applications; aligns IEC 62443 concepts with railway safety and RAMS practice.

IEC 62443

The horizontal IACS security standard providing the zone-and-conduit model, security levels and requirements that TS 50701 tailors for rail.

NIS2 Directive

EU law making rail infrastructure managers and railway undertakings essential entities, with risk-management measures and incident-reporting duties.

NIST SP 800-82

US guidance for securing operational technology; a practical, widely used reference for OT risk management that complements the European rail standards.

CSM-RA

The EU Common Safety Method for risk evaluation; the safety-assessment process that any security change must remain compatible with.

The mapping discipline is to treat security requirements as inputs to the existing safety and assurance process, not a parallel paperwork stream. TS 50701 exists precisely so that a security zone definition and a safety argument can be reasoned about together.

09Common pitfalls in rail OT security

Most rail programmes fail in predictable ways. Knowing them in advance saves time and avoids controls that look strong on a diagram but leak in operation.

• Treating signalling as untouchable and therefore leaving everything around it flat and over-connected.
• Assuming a firewall rule makes a link one-way when the path is still technically bidirectional and reversible by configuration.
• Letting emergency or supplier remote-access exceptions become permanent standing connections.
• Forgetting the management plane, so a separate admin channel quietly reintroduces the inbound path segmentation was meant to remove.
• Adding monitoring or agents that touch vital systems and invalidate the safety case instead of using passive, out-of-band visibility.
• Securing the fixed network while ignoring rolling stock, where connected TCMS and onboard Wi-Fi create new boundaries.

The common thread is reachability that was never intended but was never removed. Every unjustified path between zones is a future incident waiting for a trigger.

10Where one-way transfer and exposure reduction fit

A lot of rail data legitimately needs to leave the safety-critical core and almost none of it needs to come back. Signalling status, interlocking event logs, condition-monitoring data, train diagnostics and energy telemetry are published outward to control centres, maintenance platforms and analytics. Those are publication flows, not conversations.

That is exactly where a data diode or unidirectional gateway earns its place. It lets the signalling or operational zone export data while removing the inbound network path through that conduit, so a compromise in corporate IT or an analytics platform cannot ride the same link back toward control. For zones that only need to be connected during defined windows, scheduled physical disconnection can reduce standing exposure further. The honest framing is that this is one control among many: it removes bidirectional reachability on specific conduits, and it sits alongside segmentation, identity, patching and monitoring rather than replacing them.

Use one-way transfer where the requirement is genuinely publish outward, never receive back. Where signalling needs a real two-way exchange, that conduit needs a governed, inspected path instead, not a diode forced into a conversation.

11A practical roadmap and closing thought

A workable rail security roadmap moves from knowledge to structure to assurance. First, inventory and map data flows across signalling, operations and rolling stock. Second, segment into TS 50701 zones and reduce every conduit to its minimum, making genuinely outbound flows one-way. Third, remove standing remote access and control cross-domain laptops. Fourth, add passive OT monitoring and tested recovery. Throughout, keep every change tied to the safety case and the relevant standards.

The goal is not a perfectly locked-down railway, which would not run. The goal is a railway where the safety-critical core is the hardest place to reach, where every connection has a reason and a direction, and where an incident in the connected, modern parts of the system cannot become an incident on the track. Start with the simplest question on each boundary: which systems must publish data, and which systems should never be able to reach back?

FAQFrequently asked questions

SRCSources of record