The Cybersecurity Report Threat To Railways

The European Union Agency for Cybersecurity (ENISA) has recently published its first cyber threat landscape report on the transport sector, covering the period from January 2021 to October 2022. Ransomware attacks have become an increasingly significant cyber threat facing the transport sector in the European Union, according to a new analysis published on March 21st.

The report identifies prime threats and examines cyber security breaches during this period. It also includes an assessment of threat actors, considers their motivation for launching cyber attacks and identifiers major trends by mode.

It warns that while the majority of ransomware attacks to-date have targeted information technology (IT) systems such as databases, ransomware groups “will likely target and disrupt” operational technology (OT) systems “in the foreseeable future,” potentially causing even more significant effects for victims.

Overall, ENISA says that ransomware is the main threat to the rail sector, accounting for 45% of cyber attacks.

  • Data-related threats accounted for 25%, as did denial of service (DoS), distributed denial of service (DDoS) and ransom denial of service (RDoS) attacks.
  • Hacks that exploited known IT vulnerabilities accounted for 15%, while fraud, impersonation and counterfeit, malware and supply chain attacks each accounted for 5%.

The majority of cyber attacks targeted railway IT systems, including those behind passenger operations ticket systems, mobile phone apps and passenger information systems, causing disruption by making these services unavailable. Examples included ransomware attacks targeting Swedish public transport authority Skånetrafiken in August 2021 and the Italian State Railways in March 2022 when customers were unable to purchase tickets due to infected IT systems.

Enisa says the only cases affecting operational technology (OT) systems involved entire networks, or where safety-critical IT systems were unavailable.

Notable data thefts included cases at Norfolk Southern (NS), shortline operator OmniTrax and the New York Metropolitan Transportation Authority (MTA) in the United States, as well as at passenger operators Merseyrail in Britain and Lokaltog in Denmark. Personnel and medical records were stolen, and Enisa says that OmniTrax is the first publicly-known case of a double-extortion ransomware attack against a US freight rail operator.

The report also highlights the extensive disruption to Danish State Railways (DSB) services in October 2022. DSB ICT service provider Supeo was itself the victim of a cyber attack, with the result that DSB drivers could not access a key safety-critical IT system, disrupting DSB operations for several hours.

ENISA noted a ransomware attack on the Belarusian state-run train company in January 2022 “in a bid to disrupt Russian troop movements” when the attackers “deployed modified ransomware to bring down the railway system and encrypted servers, databases and workstations belonging to the Belarusian railway service.” The report says that the increasing proportion of DDoS attacks in the rail sector is due to the increased hacktivist activity which followed the invasion of Ukraine, undertaken by pro-Russian or anti-Nato groups.

Pro-Russian hacker groups have claimed responsibility for attacks in 2022 on Romanian national operator CFR Calatori in April, on Lithuanian Railways and Latvian operator SJSC in June, and against Estonian Railways in August.

Considering the issue of cyber attacks exploiting known vulnerabilities to IT systems, ENISA says that two cases stand out.

  • In December 2021 Toronto public transport agency Metrolinx temporarily took down its website as a precautionary measure, after being informed by the Canadian government that it was vulnerable to cyber attack.
  • A system vulnerability potentially allowing access to customers’ personal data held by Swiss Federal Railways (SBB) was reported by an anonymous hacker in January 2022.

Breaking down the attacks by target, the report says that 21, or 72%, were aimed at infrastructure managers and operators, seven (3%) at transport authorities and other public bodies, and only one (3%) at an IT service provider.

“Transport is a key sector of our economy that we depend on in both our personal and professional lives,” says ENISA Executive Director, Juhan Lepassaar“Understanding the distribution of cyber threats, motivation, trends and patterns, as well as their potential impact, is crucial if we want to improve the cyber security of the critical infrastructure involved.” Lepassaar added.

ENISA:   ENISA:   ENISA:  Rail Journal:   The Record:       Railway-Cybersecurity:     Railpage

You Might Also Read: 

UK Rail Signals Can Be Hacked To Cause Crashes:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

« The Inevitable Rise Of Artificial Intelligence
Imminent: Cybersecurity Regulations For US Financial Services »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Infoblox

Infoblox

Infoblox solutions help businesses automate complex network control functions to reduce costs, increase security and maximize uptime.

Illusive Networks

Illusive Networks

Illusive Networks is a cybersecurity company at the forefront of deception technology, the most effective protection against Advanced Attacks.

MerlinCryption

MerlinCryption

MerlinCryption develops infrastructure security software, delivering advanced encryption, authentication, and random data generators, for Cloud, VoIP, eCommerce, M2M, and USB hardware.

Hallam-ICS

Hallam-ICS

Hallam-ICS designs MEP systems for facilities and plants, control and automation solutions, and ensures safety and regulatory compliance.

Eclypsium

Eclypsium

Eclypsium protects organizations from the foundation of their computing infrastructure upward, controlling the risk and stopping threats inside firmware of laptops, servers, and networks.

CI Security

CI Security

CI Security provide Managed Detection and Response, Vulnerability Detection, and Cybersecurity Consulting Services to help you secure your mission-critical systems.

RapidScale

RapidScale

RapidScale’s managed cloud solutions provide reliable, innovative, and secure services, all complete with white-glove service and full management options.

Take Five

Take Five

Take Five is a national campaign offering straight-forward, impartial advice that helps prevent email, phone-based and online fraud – particularly where criminals impersonate trusted organisations.

ScienceSoft

ScienceSoft

ScienceSoft is a provider of software development and IT consulting services including Information Security.

SecureWorx

SecureWorx

SecureWorx are a secure multi-cloud MSP, a provider of advanced IT security services and an independent cyber security advisory.

Infopercept Consulting

Infopercept Consulting

Infopercept is a leading cybersecurity company in India, providing a critical layer of security to protect business information, infrastructure & assets across the organization.

Boxphish

Boxphish

Boxphish provides a proven solution to reduce Human Error and Cyber Human Risk via automated learning journeys and intelligent phishing simulations.

Fifosys

Fifosys

Fifosys is a professional technology infrastructure specialist, delivering a broad portfolio of high quality technical and strategic managed services.

North West Cyber Resilience Centre (NWCRC)

North West Cyber Resilience Centre (NWCRC)

The North West Cyber Resilience Centre is a trusted, not-for-profit venture between Greater Manchester Police and Manchester Digital.

KATIM

KATIM

KATIM is a leader in the development of innovative secure communication products and solutions for governments and businesses.

Carahsoft Technology Corp

Carahsoft Technology Corp

Carahsoft Technology is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets.