Taxonomy of Emerging Security Risks in Digital Railway

The railway industry has embraced digitisation and interconnectivity by introducing Information and Communication Technologies into traditional operational technology infrastructure. This convergence has brought numerous advantages, including improved visibility, reliability, operational efficiency, and better passenger experience. But it has also introduced new cyber risks and amplified the existing ones in Digital Railways (DRs) and the entire supply chain. The threat and vulnerability landscape has become wider than ever. To better understand the scope of security risks, impacts on normal operations, and appropriate solutions, a security taxonomy that covers the broader views and contexts around DRs can help. Recorded attacks show that railway systems/networks are clearly intolerant to network interference, and require strong security, resilience, and safety. Cyber attack impacts on DRs can take economic or financial, reputational, environmental, and/or physical dimensions, and can target rail Operational Technology OT data and functionality, rail Information Technology IT data and functionality, rail IT and OT workforce, and rail organisational structures, cultures, and exploit policies, especially when they are either weak or non-existent. Attacks can come from a range of malicious threat actors driven by their diverse motives. DR is a socio-technical system that is complex, large, and distributed, comprising technologies, humans, organisational structures, policies elements and attributes, etc. Thus, a socio-technical security approach is required to effectively mitigate cyber threat impacts. DR stakeholders must collaborate to make the system functions work properly so that a successful implementation of change, security, resilience, and safety operations depends on the ‘joint optimisation’ of the system’s organisational/operational, technology, physical, and human or people security controls.