Cybersecurity in the German Railway Sector

Abstract

Cybersecurity breaches are on the rise. Due to increased network interconnection, industrial systems are becoming more attractive targets for such attacks. Therefore, various industries must acquire knowledge and experience regarding cybersecurity for their IT and OT systems. One such sector is the safety-critical railway and public transport sector. Technological leaps like digital interlocking, fifth-generation networking, and the move from proprietary field busses to IP networking are driving the sector into an inter-connected age. This work scrutinizes the sector’s cybersecurity awareness, knowledge, and preparedness. To this end, we created a two-stage study comprising a quantitative online survey to gain comprehensive insight and qualitative interviews to deepen selected issues in a SWOT analysis. The results show that the sector still has a long way to go regarding cybersecurity, with the average company not meeting basic implementation levels. Furthermore, we identified multiple factors contributing to this result. Key issues are a lack of staff and management sensitivity to cybersecurity and support from authorities.

Appendices

Sample Questions from the Online Questionnaire

• 1. What cybersecurity measures is your company pursuing?

• 2. What percentage of your company’s revenue do you plan to spend on cybersecurity over the next 3 years?

• 3. What percentage of your company’s staff are full-time equivalents dedicated to cybersecurity?

• 4. What forms of cyberattacks have occurred in your company in the last 3 years?

• 5. How many of the cyberattacks mentioned in the previous question have occurred as a total in your company in the last 3 years?

• 6. How do you assess the current cyber security risk considering current technologies in your company?

• 7. What benefits does your company see for implementing cybersecurity?

• 8. What obstacles may be standing in the way of your company’s cybersecurity goal?

• 9. What was the average loss you incurred from cyberattacks in the last 3 years, as a percentage of your company’s revenue?

• 10. Which statement(s) best describes the cybersecurity strategy in place at your company?

• 11. Does your company have a cybersecurity officer role?

• 12. Does your company have a strategy in place to sustainably counter attacks?

• 13. Does your company ensure that all employees are trained in cybersecurity?

• 14. Has your company implemented a monitoring process to assess cybersecurity awareness?

• 15. Are employees in your company able to identify and report cybersecurity anomalies?

• 16. Does your company have established processes for dealing with acute cybersecurity attacks?

• 25. Has your company defined measures for dealing with an acute cybersecurity attack?

• 40. Have you identified assets and their potential protection needs of the IT infrastructure used in your company?

• 41. Have you conducted a vulnerability assessment of the IT infrastructure deployed in your organization?

• 42. Have you conducted a threat analysis of the IT infrastructure used in your company?

• 57. Do you have measures in place to ensure cybersecurity in the supply chain at your company?

Interview Questions Adapted to Each Interview Partner

• If, in the online questionnaire, the company stated to have a strategy for a certain NIST function, but we calculated a low degree of maturity for that function:

  • You stated that your cybersecurity strategy includes measures to ensure [description of the function in question]. Please explain how these are implemented in your company.

• For each criterion mentioned in the online questionnaire to impede the improvement of cybersecurity within the company:

  • You stated that [description of the criterion] might be impeding the improvement of cybersecurity within your company. We would like to elaborate on that. Why is the [description of the criterion] missing, in your opinion?

• The question depends on whether or not the company stated to provide cybersecurity training to their employees.

  • If they do not: You stated that employees do not receive cybersecurity training. Why was a decision against such training made?

  • If they do: You stated to provide training for cybersecurity to your employees. Please provide further detail for this training.

    [If they were not addressed in the answer, the following details would be inquired individually: frequency of training, obligation to complete training, the scope of the training, and review of understanding after the training]

• For new technologies that the company stated to be using and highly knowledgeable about:

  • You stated to be using [description of the new technology] or to at least be conducting a pilot run with it. What are currently, or have been in the past, the biggest impediments in the use of this technology?