As recent cyberattacks on transportation companies reveal, by and large the transportation industry is ill-equipped to handle the risks it’s facing, due largely to a number of factors: interconnectivity with external systems, inadequate regulation (compared to other national-critical infrastructure like power generation), lack of awareness among decision makers and the overarching shortage of OT-security experts.
By nature, cybersecurity system for transportation needs to interoperate with passenger information systems (PIS), physical security, customer service, BMS systems at stations or depots (for managing electricity, HVAC, escalators etc.) and more. Much of this connectivity, e.g. in rail or metro systems, is done over the internet, often over wireless/cellular connections. This greatly increases the attack surface of the transportation utility, creating numerous potential attack vectors toward exploiting vulnerabilities in OT and other systems.
As mentioned, the transition to IIoT-based automation, communications and operation management systems has increased the attack surface in the transportation sector. This is due to the large amount of data and interconnected systems that they handle, which makes them prime targets for hackers.
For example, the International Maritime Organization’ (IMO) strategic transition to e-navigation allows continuously collecting, integrating, and analyzing ship and container information to track ships’ locations, cargo details, maintenance issues and more; this means that a breach into the e-navigation system would affect the entire spectrum of shipping operations. The same goes to for the numerous other interconnected OT systems in ships and ground transportation vehicles and facilities, that are increasingly relying on edge device operation rather than relying on centralized, system-wide management, thanks to the adoption of 5G technologies, which further increase the probability of an attack.
As for regulation, despite the sector’s global operations—or perhaps because of them—regulators have had a hard time agreeing or focusing on a set of cybersecurity standards that transportation companies should follow wherever they operate. Among the regulations proposed or already established are the EU’s Network and Information Security (NIS) directive and the soon-to-be-implemented CLC/TS 50701 and EN 50126 standards for railroads, as well as a series of rules for ships promulgated by the International Maritime Organization.
Finally, the transportation sector is competing with practically all other OT and IT sectors over a small pool of cybersecurity talent. As many as four million cyber specialist jobs were unfilled in 2020, according to the ISC2 International Information System Security Certification Consortium, and the relatively slow-moving transportation industry seems to have little appeal to recent information security graduates, who tend to be drawn to industries that involve more innovation and creativity.