text: Cyber Security and Resilience of Intelligent Public Transport

text: December 2015

text: December 2015

text: December 2015

text: December 2015

text: December 2015

text: December 2015

text: Don’t know

text: No 10%

text: December 2015

text: December 2015

text: See

text: Council Directive 2008/11/EC

text: on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection, specifically Art.2 and Annex I See Directive

text: of the European Parliament and of the Council on the framework for the deployment of Intelligent Transport Systems in the field of road transport and for interfaces with other modes of transport. Smart Cities are cities that integrate ICT to meet public needs and foster development in a multi-stakeholder environment. It is anticipated this integration of cyber-physical technologies and infrastructures creates environmental and economic efficiencies while improving resident’s quality of life (see US Dept. of Homeland Security, “The Future of Smart Cities: Cyber-Physical Infrastructure Risk”, August 2015).

text: December 2015

text: Figure 1: Scope of the study

text: NON-TRANSPORT OPERATORS AND NON-OPERATORS

text: PublicSsafety Energy Banks Regulators

text: data data exchange exchange

text: TRANSPORT OPERATORS

text: scopeSofS theSstudy LOCAL PUBLIC TRANSPORT PRIVATE AND NON-LOCAL

text: OPERATORS PUBLIC TRANSPORT OPERATORS

text: (examples) (examples)

text: data exchange Metro Bus LightSrail Logistics/ SmartScars Airport freight

text: ENISA, “Cyber Security for Smart Cities - an architecture model for public transport”, December 2015. https://www.enisa.europa.eu/activities/Resilience-and-CIIP/smart-infrastructures/intelligent-publictransport/architecture-model-transport-smart-cities

text: December 2015

text: Figure 2: Target audience groups

text: Service Policy

text: See Annex 5 for the survey questions. See Section 1.3 of ENISA, “Cyber Security for Smart Cities - an architecture model for public transport”, December 2015, for a distribution of respondents based on sector.

text: December 2015

text: December 2015

text: Table 1: Key definitions employed within this study

text: TERM DEFINITION

text: The application of information and communication technologies to transport so as to

text: Intelligent Transport

text: improve levels of service and efficiency.

text: The application of information and communication technologies to public transport

text: Intelligent Public Transport (IPT)

text: networks so as to improve levels of service and efficiency.

text: The application of information and communication technologies to the real-time Intelligent Transport Systems (ITS) management of vehicles and networks involving the movement of people and 8 9 10 goods.

text: A city that uses ICT to meet public needs and foster development in a multi-stakeholder

text: Smart City

text: environment.

text: Business critical Any elements which can directly impact the execution and sustainability of a business in the long-term, including business revenue, service provision, business operations, (as applied to IPT) and/or the brand and image of an organisation.

text: Societal critical

text: Any elements affecting the quality of life of the citizens and their daily experience of transport, which includes the environment, their safety and security and their privacy. (as applied to IPT)

text: An asset, system or part thereof located in MS which is essential for the maintenance of Critical Infrastructure vital societal functions, health, safety, security, economic or social well-being of people, (as applied to the EU) and the disruption or destruction of which would have a significant impact in a MS as a result of the failure to maintain those functions.

text: Intelligent Public Transport is not a term widely used or adopted, rather it is a term coined for this study. EC,16.12.2008 COM(2008) 886 final, “Action Plan for the Deployment of Intelligent Transport Systems in Europe”. EC, 20.3.2009 COM(2008) 886 final/2, “Corrigendum to Action Plan for the Deployment of Intelligent Transport Systems in Europe”. Federal Ministry for Economic Cooperation and Development (Germany), “Intelligent Transport Systems”, p.2. As defined within

text: Article 2

text: a of Directive

text: . For more details on critical infrastructure see ENISA, “Methodologies for the identification of Critical Information Infrastructure assets and services”, February 2015.

text: December 2015

text: TERM DEFINITION

text: Cyber security is the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance

text: Cyber security

text: and technologies that can be used to protect the cyber environment and organization and user’s assets.

text: For IPT, cyber security is the protection of data, systems, infrastructure and end-users

text: IPT Cyber security

text: vital to the transport network, its operation and stability.

text: https://www.enisa.europa.eu/activities/Resilience-and-CIIP/critical-infrastructure-and-services/Methodologies-foridentification-of-ciis Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. http://eurlex.europa.eu/legal-content/EN/TXT/?uri=URISERV:l14012 Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications). http://eur-lex.europa.eu/legalcontent/EN/TXT/?qid=1440673681836&uri=CELEX:32002L0058 Directive

text: of the European Parliament and of the Council of 23 April 2009 on the promotion of clean and energy-efficient road transport vehicles. http://eur-lex.europa.eu/legalcontent/EN/TXT/?qid=1440673932348&uri=CELEX:32009L0033 Directive

text: of the European Parliament and of the Council of 17 June 2008 on the interoperability of the rail system within the Community. http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32008L0057 Directive

text: of the European Parliament and of the Council of 7 July 2010 on the framework for the deployment of Intelligent Transport Systems in the field of road transport and for interfaces with other modes of transport. http://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1440674103143&uri=CELEX:32010L0040 Art.2(1), Directive

text: Art.10, Directive

text: Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL concerning measures to ensure a high common level of network and information security across the Union (COM/2013/048 final - 2013/0027 (COD)). http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52013PC0048

text: December 2015

text: Art.14(1), Proposed NIS Directive When multiple operators (including IPT operators) are integrated into the architecture of a Smart City it is uncertain to what extent they control any shared network and information systems. Additionally the scope assigned to transport as critical infrastructure within the proposed Directive as currently drafted in Annex II of the draft NIS Directive does not clearly apply to road-based IPT operators (i.e. busses). For example, it was noted during the final validation workshop that the French Agence nationale de la sécurité des systèmes d’information (ANSSI) is working with Vital Importance Operators such as public transport and railways to establish laws related to cyber security. See Annex 1: Key EU legislation and policy/strategy documents affecting IPT, for more details on these documents. Internet of Things - An action plan for Europe - COM(2009) 278 final. http://eurlex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2009:0278:FIN:EN:PDF A Digital Single Market Strategy for Europe - COM(2015)192 final. http://ec.europa.eu/priorities/digital-singlemarket/docs/dsm-communication_en.pdf European Innovation Partnership on Smart Cities and Communities: Strategic Implementation Plan. http://ec.europa.eu/eip/smartcities/files/sip_final_en.pdf Roadmap to a Single European Transport Area – Towards a competitive and resource efficient transport system - COM(2011) 144 final. http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:tr0054

text: December 2015

text: Rolling plan for ICT Standardisation. https://ec.europa.eu/digital-agenda/en/news/rolling-plan-ict-standardisation- 0 Smart Cities and Communities – European Innovation Partnership - COM(2012) 4701 final. http://ec.europa.eu/eip/smartcities/files/ec_communication_scc.pdf

text: December 2015

text: Scottish Government, “Smart Cities Maturity Model and Self-Assessment Tool”, January 2015 Key documents here included: EC, COM(2011)144 final, “Roadmap to a Single European Transport Area”, March 2011. EC, COM(2012) 4701 final, “Smart Cities and Communities. European Innovation Partnership”, July 2012. European Innovation Partnership on Smart Cities and Communities, Strategic Implementation, October 2013. EC, COM(2009) 278 final, “Internet of Things. An Action Plan for Europe”, June 2009. EC, COM(2010) 245 final, “A Digital Agenda for Europe”, May 2010. Ericsson, “Smart communication + Accurate information = Intelligent Transport users”, 2014.

text: December 2015

text: Figure 3: Critical functions and assets for IPT

text: Societal functions and associated assets Business functions and associated assets

text: Networking/communication components

text: Networking Cloud based services/platforms

text: Internet/networking Physical infrastructure

text: Radio telecommunication Networking

text: On-board equipment

text: Communication systems Trackside equipment Operational Control Centres Physical Human-machine interface devices Vehicles and physical infrastructure Physical Sustainable urban Traffic and vehicle management Hardware

text: Signalling systems Sensors, signals and detectors Digital infrastructure Data storage systems/facilities Traffic management systems Digital

text: SCADA Operating systems Digital Software/applications Traffic fluidity capabilities

text: IPT: Safety systems Functions and Assets

text: Availability of law enforcement Identity management systems

text: Passenger safety systems Public communication and social media Passenger Transportation safety Integrity and availability of data Information distribution systems safety and security and security and communication

text: Trained staff Access control mechanisms Video surveillance

text: Power distribution grid Sustainable Energy and Power distribution system environment environment

text: Sales, fees and Payment systems charges

text: Data/information Data protection and Confidentiality privacy Financial viability

text: Resilience management Reputation structure

text: December 2015

text: Chris Valasek and Charle Miller, Adventures in Automotive Networks and Control Units, 2014. http://www.ioactive.com/pdfs/IOActive_Adventures_in_Automotive_Networks_and_Control_Units.pdf

text: December 2015

text: Figure 4: IPT within the Smart City content

text: Car/sharing OPERATORS Logistics/freight Banks Smart/cars LOCAL PUBLIC Communications Taxi TRANSPORT Emergency Traffic/regulation Railways OPERATORS Energy Health/care Infrastructure Public/clouds Public/safety Ferry Street/lighting Water Light/rail Citizens

text: Trolley/bus/ tram

text: CSIRT EU/national/governments Industry/associations Local/governments Municipalities Regulators

text: US Dept. of Homeland Security, “The Future of Smart Cities: Cyber-Physical Infrastructure Risk”, August 2015. See ENISA, “Cyber Security for Smart Cities - an architecture model for public transport”, December 2015.

text: December 2015

text: These are contextually modified definitions of those from ETSI TS 102 165-1 V4.2.3 “Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); Methods and protocols; Part 1: Method and preforms for Threat, Risk, Vulnerability Analysis”, March 2011. http://www.etsi.org/deliver/etsi_ts/102100_102199/10216501/04.02.03_60/ts_10216501v040203p.pdf ENISA, “Threat Landscape and Good Practice Guide for Internet Infrastructure”. https://www.enisa.europa.eu/activities/risk-management/evolving-threat-environment/enisa-thematiclandscapes/threat-landscape-of-the-internet-infrastructure ENISA, “ENISA Threat Landscape 2013: Overview of current and emerging cyber threats”. http://www.enisa.europa.eu/activities/risk-management/evolving-threat-environment/enisa-threat-landscape-2013overview-of-current-and-emerging-cyber-threats ENISA, “Smart Grid Threat Landscape and Good Practice Guide”. http://www.enisa.europa.eu/activities/riskmanagement/evolving-threat-environment/sgtl/smart-grid-threat-landscape-and-good-practice-guide

text: December 2015

text: On the importance of operators and user errors see: Michael G. Dinning, “Introduction to Cyber Security Issues for Transportation”, T3 Webinar, December 7, 2011. On the importance of terrorism/state sponsored attacks see: Gendron Angela and Martin Rudner, “Assessing cyber Threats to Canadian Infrastructures”, CSIS publication, March 2012. On the importance of manipulation of hardware/software, tempering, unauthorised use and access and malware and viruses see: ETSI, “Intelligent Transport Systems (ITS)”; Edward Fok, “An Introduction to Cybersecurity issues in Modern Transportation Systems”, ITE Journal, July 2013. On the importance of DDoS see: ETSI, “Intelligent Transport Systems (ITS)”. On the importance of hardware failure, software failure and loss of integrity of sensitive information see: Trond Foss, “Safe and secure Intelligent Transport Systems (ITS)”, Transport Research Arena, Paris, 2014; US Department of Transportation, “Intelligent Transportation Systems (ITS)”. On the importance of natural and

text: December 2015

text: Figure 5: Key threats to IPT identified by respondents

text: Operator and/or user errors Terrorism and/or state-sponsored attacks

text: Configuration errors Unauthorised use and/or access Unintentional Accidental disclosure damage Physical and Vandalism and/or civil disorder large-scale attacks Mismanagement Violence and/or shootings within sites Theft of data and/or infrastructures Stealing/manipulation of data/information Sales of important to competitors Insider threats Leaking information Natural disasters Acts of nature / environmental incidents Environmental disasters

text: Threats to IPT

text: Distributed Denial of Service attack (DDoS)

text: Manipulation of hardware/software

text: Malwares and viruses Hardware failure and/or malfunctions Tampering/alteration of data, Software failure and/or malfunctions including insertion of information

text: Accidental errors / Hacking of wireless/connected assets malfunctions / failures Loss of (integrity of)

text: sensitive information/data

text: Data breaches Nefarious activity/abuse Configuration errors Identify theft Exploitation of software bugs Abuse of authorisation

text: Abuse of information leakages of electrical supply Intentional disclosure Interruption/disruption

text: of frequency

text: Falsification of records including certification Disruptions / outages Eavesdropping and/or wiretapping Strike

text: environmental disasters see: US Department of Transportation, “Intelligent Transportation Systems (ITS)”. On the importance of interruption/disruption of electrical supply and frequency see : CRO Forum, “Power Blackout Risks. Risk Management Options. Emerging Risk Initiative”, Position Paper, November 2011; US Department of Transportation, “Intelligent Transportation Systems (ITS)”. On the importance of strike see: US Department of Transportation, “Intelligent Transportation Systems (ITS)”.

text: December 2015

text: Table 2: Association between IPT threats and assets

text: THREAT TYPES BUSINESS ASSET TYPES/FUNCTIONS SOCIETAL ASSET TYPES/FUNCTIONS

text: Physical and large scale attacks

text: Terrorism and/ or state sponsored All All attacks

text: Sustainable urban mobility, Passenger Traffic and vehicle management, Unauthorised use and/or access safety and security, Data protection and Transportation safety and security privacy

text: Traffic and vehicle management, Sustainable urban mobility, Passenger Vandalism and/or civil disorder Transportation safety and security safety and security

text: Violence and/or shooting within sites Traffic and vehicle management Passenger safety and security

text: Sustainable urban mobility, Passenger Traffic and vehicle management, Theft of data and/or infrastructures safety and security, Data protection and Transportation safety and security privacy

text: Acts of nature / environmental incidents

text: Natural disasters All All

text: Environmental disasters All All

text: Accidental errors/malfunctions/failures

text: Traffic and vehicle management, Sustainable urban mobility, Passenger Hardware failure and /or malfunctions Transportation safety and security safety and security

text: Traffic and vehicle management, Sustainable urban mobility, Passenger Software failure and/or malfunctions Transportation safety and security safety and security

text: Loss of (integrity of) sensitive Traffic and vehicle management, Data protection and privacy, Sustainable information/data Transportation safety and security urban mobility

text: Traffic and vehicle management, Sustainable urban mobility, Passenger Configuration errors Transportation safety and security safety and security

text: Disruption and/or outages

text: Interruption and/or disruption of All assets (excepting people/living things All assets (excepting people/living things electrical supply and exclusively physical infrastructures) and exclusively physical infrastructures)

text: Interruption and/or disruption of All assets (excepting people/living things All assets (excepting people/living things frequency and exclusively physical infrastructures) and exclusively physical infrastructures)

text: Strike N/A to the top 15 assets Sustainable urban mobility

text: December 2015

text: Nefarious activity /abuse

text: Distributed Denial of Service attacks Traffic and vehicle management, Sustainable urban mobility, Passenger

text: (DDoS) Transportation safety and security safety and security

text: Manipulation of hardware and/or All assets (excepting people/living things All assets (excepting people/living things

text: software and data) and data)

text: Traffic and vehicle management, Sustainable urban mobility, Passenger Malware and viruses Transportation safety and security safety and security

text: Tempering and/or alteration of data Traffic and vehicle management, Data Protection and privacy including insertion of information Transportation safety and security

text: Traffic and vehicle management, Sustainable urban mobility, Passenger Hacking of wireless , connected assets Transportation safety and security safety and security

text: Traffic and vehicle management, Data Protection and privacy, Integrated Data breaches Transportation safety and security infrastructure and processes

text: Sustainable urban mobility, Data Identity theft Traffic and vehicle management Protection and privacy

text: Traffic and vehicle management, Sustainable urban mobility, Passenger Exploitation of software bugs Transportation safety and security safety and security

text: Traffic and vehicle management, Sustainable urban mobility, Passenger Abuse of authorisation Transportation safety and security safety and security

text: Traffic and vehicle management, Abuse of information leakages Data Protection and privacy Transportation safety and security

text: Intentional disclosure Traffic and vehicle management Data Protection and privacy

text: Falsification of records including All assets (excepting people/living All assets (excepting people/living things) certification things)

text: Traffic and vehicle management, Sustainable urban mobility, Data Eavesdropping and/or wiretapping Transportation safety and security protection and privacy

text: Insider threats

text: Stealing information or manipulation of Traffic and vehicle management, Sustainable urban mobility, Data

text: data Transportation safety and security Protection and privacy

text: Traffic and vehicle management, Sales of important data to competitors Data protection and privacy Transportation safety and security

text: Traffic and vehicle management, Leaking information Data protection and privacy Transportation safety and security

text: December 2015

text: Unintentional damage

text: All assets (excepting people/living Operator and/or user errors All assets (excepting people/living things) things)

text: Configuration errors See configuration errors above See configuration errors above

text: Traffic and vehicle management, Accidental disclosure Data protection and privacy Transportation safety and security

text: Mismanagement All All

text: US Department of Homeland Security, “The Future of Smart Cities: Cyber-Physical Infrastructure Risk”, August 2015. This meant that the impact of a cyber-system disruption was contained within the cyber domain, while physical disruption was contained in the physical domain. This is mainly because there are not very many such infrastructures that have been operational for a sufficient period such that experiences have been gained, analysed and shared See: Gideon Mbiydzenyuy, Jan A Persson and Paul Davidsson, “Threat, Vulnerability, and Risk Analysis for Intelligent Truck Parking, a Pre-study”, ETAP III Project Report, https://www.bth.se/com/intelligent_truck_parking.nsf/attachments/Del_6_Security_pdf/$file/Del_6_Security.pdf ETSI, “Intelligent Transport Systems”; and Edward Fox,” An Introduction to Cybersecurity Issues in Modern Transportation Systems”, ITE Journal, July 2013. http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.377.199&rep=rep1&type=pdf It was noted by operators that the threat “Interruption and/or disruption of frequency” identified above is considered as a major risk for transport operators as most of their moving assets are linked to their central equipment via wireless connections. Such connections could be significantly disturbed with few resources (e.g. it is quite simple to develop a frequency jammer that could block a major station).

text: December 2015

text: C.K. Marigowda and Manjunath Shingadi, “Security Vulnerability issues in Wireless Sensor Network: A short Survey”, International Journal of Advanced Research in Computer and Communication Engineering Vol. 2, Issue 7, July 2013 US Department of Homeland Security, “The Future of Smart Cities”. Bertrand Berche, Christian von Ferber, Taras Holovatch and Yurij Holovatch, “Public Transport Networks under Random Failure and Directed Attack”, Workshop NET 2009, Rome, May 28th-30th, 2009; US Department of Homeland Security, “The Future of Smart Cities”. Mulligan, Catherine, “ICT and the Future of Transport”, Ericsson, 2014. http://www.ericsson.com/res/docs/2014/ict-and-the-future-of-transport.pdf; and US Department of Homeland Security, “The Future of Smart Cities”.

text: December 2015

text: Figure 6: Matrix of IPT vulnerabilities

text: Common to other IT systems

text: Wireless and cellular communications

text: Online passenger services

text: Integration of Higher volumes of physical and Cohabitation between passengers and freight Access to virtual layers legacy and new systems real-time data

text: Increased automation Multiple interdependent systems

text: Scale and complexity of transport networks

text: erna Applications of networked Ext technology across large transport systems

text: December 2015

text: In risk management methodologies risk is interpreted as “the risk factor”, which is calculated based upon the likelihood of a particular threat being successful and the impact that a successful threats would have on the system. In this study we do not use risk as a risk factor but instead in more general term as the negative impact produced by a successful threats. Ahmed Abdel Rahim and Ybette Ochoa “A Framework to Analyze the Survivability and Vulnerability of Intelligent Transportation System Networks”, Journal of Intelligent Transportation and Urban Planning, Jan 2014, Vol. 2 Issue 1, pp. 22-29 Transport for London , “Strategic Risk Management and Assurance Annual Report 2013/14”, July 2013 US Department of Homeland Security , “The Future of Smart Cities”.

text: December 2015

text: Steven H. Bayless, Sean Murphy and Anthony Shaw, “Connected Vehicle Assessment. Cybersecurity and Dependable Transportation”, Connected Vehicle Technology Scan Series, 2012-2014. US Department of Homeland Security , “The Future of Smart Cities”. EC, “ Information Society and Transport: Linking European Policy”, DG Information Society and Media publication, 2006. See Section 2.3 CGI, “Could Your Security Vulnerabilities Cause Network Gridlock?”, A Discussion Paper for Transportation Information Technology Leaders and Executives, http://www.cgi.com/sites/default/files/whitepapers/transportation-information-technology_security-vulnerabilities-causing-network-gridlock.pdf Transport for London , “Strategic Risk Management and Assurance Annual Report 2013/14”, July 2013.

text: December 2015

text: Figure 7: Cyber security spending

text: Don’t know 40% Don't know Yes 10% 20% Less than 2% No 10% 40%

text: Even though not directly applied to IPT, the Volkswagen emission scandal shows that emission levels of vehicles can be modified by software https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal Steinfeld, Aaron, “Ethics and Policy Implications for Inclusive Intelligent Transportation Systems”, Second International Symposium on Quality of Life Technology, 2010. Please note that the respondents could select multiple relevant answers.

text: December 2015

text: Figure 8: Measuring Effectiveness in Cyber security Measures

text: Ashford Warwick, “How can businesses measure the effectiveness of their IT security teams to ensure they are getting value?”, http://www.computerweekly.com/feature/Security-Think-Tank-How-can-businesses-measure-theeffectiveness-of-their-IT-security-teams

text: December 2015

text: Figure 9: Cyber security Information Exchange

text: Mandatory 10% Don't know 20%

text: Voluntary 20%

text: No 30% Plan to do 20%

text: Steven H. Bayless, Sean Murphy and Anthony Shaw, “Connected Vehicle Assessment. Cybersecurity and Dependable Transportation”, Connected Vehicle Technology Scan Series, 2012-2014. For example electrified transport systems report good integration with energy suppliers. Some data exchanges are happening between infrastructure providers, law enforcement and emergency services (and to a less extent with local government, transport industry associations, e.g. UITP, and government/regulatory bodies) in relation to criminal incidents and emergency events yet other stakeholders/elements such as banks and social media are often not well integrated. US Department of Homeland Security, “The Future of Smart Cities”.

text: December 2015

text: See Cristin Goodwin and Paul Nicholas, “Developing a City Strategy for Cybersecurity: A seven-step guide for local governments”, October 2014. http://download.microsoft.com/download/1/B/3/1B3C6BE3-8FA4-40BD-9BD6- 640FD2F1F648/City%20Strategy%20for%20Cybersecurity.pdf A Risk Assessment will be required to differentiate between areas of high risk/value and low risk/value. 68 nd Ross Anderson, “Security Engineering (2 Edition)”, 2008.

text: December 2015

text: HM Government, “2015 Information Security Breaches Survey”, June 2015. http://www.pwc.co.uk/assets/pdf/2015-isbs-technical-report-blue-03.pdf Mariana Carroll and Paula Kotzé, “Secure Cloud Computing: Benefits, Risks and Controls”, Information Security South Africa, 2011. http://researchspace.csir.co.za/dspace/bitstream/10204/5184/1/Kotze4_2011.pdf HM Government, “Cyber Essentials Scheme: Requirements for basic technical protection from cyber attacks”, June 2014. https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/317481/Cyber_Essentials_Require ments.pdf Government of the HKSAR, “VPN Security”, February 2008. http://www.infosec.gov.hk/english/technical/files/vpn.pdf See for example: ENISA, “Algorithms, key size and parameters report – 2014”, November 2014; ANSSI, “Mécanismes cryptographiques, V2.03” 2014; BSI “Kryptographische Verfahren: Empfehlungen und Schlussellangen: BSI TR-02102-1”, February 2015. Ye Yan, Yi Qian, Hamid Sharif and David Tipper, “A survey on Cyber Security for Smart Grid Communications”, Communication Surveys & Tutorials, IEEE, Vol.14(4), 2012, pp.998-1010. Hung-Jen Liao, Chun-Hung Richard Lin, Ying-Chih Lin and Kuang-Yuan Tung, “Intrusion detection system: A comprehensive review”, Journal of Network and Computer Applications, Vol.36, 2013, pp.16-24. Chih-Fong Tsai, Yu-Feng Hsu, Chia-Ying Lin, and Wei-Yang Lin, “Intrusion detection by machine learning: A review”, Expert Systems with Applications, Vol.36, 2009, pp.11994-12000.

text: December 2015

text: Thomas Calabrese, “Information Security Intelligence: Cryptographic Principles and Applications”, 2004. Bonnie Zhu, Anthony Joseph and Shankar Sastry, “A Taxonomy of Cyber Attacks on SCADA Systems”, Internet of Things (iThings/CPSCom), 2011 International Conference on and 4th International Conference on Cyber, Physical and Social Computing, pp.380-388, October 2011. Ann Cavoukian and Marc Chanliau, “Privacy and Security by Design: A Convergence of Paradigms”, January 2013. https://www.ipc.on.ca/images/resources/pbd-convergenceofparadigms.pdf A. Bartoli et al., “Security and Privacy in your Smart City”, EU project ICT-258512 EXALTED, December 2011. Chris Johnsona, Barry Kirwanb and Tony Licuc , “The interaction between safety culture and degraded modes: A survey of national infrastructures for air traffic management”, October 2009. http://www.palgravejournals.com/rm/journal/v11/n3/pdf/rm200910a.pdf

text: December 2015

text: Karin Hone and J.H.P Eloff, “What Makes an Effective Information Security Policy?”, Network Security, Vol.6(1), 2002, pp.14-16. BBC News, “Fiat Chrysler recalls 1.4 million cars after Jeep hack”, 24 July 2015. http://www.bbc.co.uk/news/technology-33650491 BBC News, “Car hack uses digital-radio broadcasts to seize control”, 22 July 2015. http://www.bbc.co.uk/news/technology-33622298 See Eric D. Knapp and Joel Langill, “Industrial Network Security: Securing Critical Infrastructure Networks for Smart nd Grid, SCADA, and Other Industrial Control Systems (2 edition)”, 2015. This is not to say that non-critical infrastructure should be unprotected; merely that critical infrastructure should be assessed for additional protections.

text: December 2015

text: Giovanni Bocchetti, Francesco Flammini, Concetta Pragliola and Alfio Pappalardo, “Dependable integrated surveillance systems for the physical security of metro railways”, Third ACM/IEEE International Conference on Distributed Smart Cameras, 2009. Preeti Tuli and Priyanka Sahu, “System Monitoring and Security Using Keylogger”, International Journal of Computer Science and Mobile Computing, Vol.2 (3), March 2013, pp.106-111. Robert Newby, “Security Think Tank: Procurement and security are uneasy bedfellows”, ComputerWeekly.com, November 2013. See Cristin Goodwin and Paul Nicholas, “Developing a City Strategy for Cybersecurity: A seven-step guide for local governments”, October 2014.

text: December 2015

text: December 2015

text: While Directive

text: is a partial exception here covering the interoperability of EU railways, this Directive also has nothing to say on cyber security needs. See: ENISA, “Good Practice Guide for Incident Management”, 2010; and ENISA, “Technical Guidelines on Security Measures”, October 2014. More mature IPT implies the coordination and cooperation among different operators and users in different countries , hence the EU focus is a paramount. EC, “Action Plan for the Deployment of Intelligent Transport Systems in Europe - COM(2008) 886 final/2 – CORRIGENDUM”, 2008. EC, “Directive

text: on the framework for the deployment of Intelligent Transport Systems in the field of road transport and for interfaces with other modes of transport”, 2010. In addition they only address road vehicles, therefore other major modes of transportation of IPT are not covered.

text: December 2015

text: Figure 10: Use of definition of Intelligent Transport Figure 11: Cyber security policy and definitions for critical assets

text: Don’t know 10%

text: Don't know

text: Don’t know Yes 30%

text: Documented cyber security policy for IPT

text: No No 70% 60%

text: No Definition of 60% "critical assets"

text: ISO, “Smart Cities. Preliminary Report 2014”, ISO/IEC publication, 2015. http://www.iso.org/iso/smart_cities_report-jtc1.pdf While we have avoided ranking either the identified gaps or challenges, during the validation workshop for this research, practitioners were of the consensus that the lack of corporate governance currently represents the most important gap/challenge facing IPT. ESADEgeo and Zurich, “Global cyber governance: preparing for new business risks”, Risk Nexus, April 2015. The recent work on IPT standards from ETSI and the US Department of Transportation aim at filling this gap at the European and US level. See: http://www.etsi.org/technologies-clusters/technologies/intelligent-transport and http://www.its.dot.gov/standards_strategic_plan/#ID; US Department of Transportation, “Intelligent Transportation Systems (ITS) Standards Program Strategic Plan for 2011–2014 “, Final report, April 2011.

text: December 2015

text: Rae Zimmerman and Carlos E. Restrepo, “Analyzing Cascading Effects within Infrastructure Sectors for Consequence Reduction”, Proceedings of the 2009 IEEE International Conference on Technologies for Homeland Security, HST 2009, Waltham, MA. E. Bekiaris, A. Parkes, A. Stevens and M. Wiethoff, “A Structured Methodology and Preliminary Results of ADAS Risk Assessment, including Technical, Behavioural, Liability and Organisational Risks”, 8th WORLD CONGRESS ON ITS, Sydney, Australia, 2001. See also Riek Joosten and André Smulders, “Networked Risk Management: How to successfully manage risks in hyperconnected value networks”, July 2014, TNO. http://publications.tno.nl/publication/34612233/jfvm8m/joosten- 2014-networked.pdf Catherine Mulligan, “ICT and the Future of Transport”, Ericsson, 2014. http://www.ericsson.com/res/docs/2014/ict-and-the-future-of-transport.pdf US Department of Homeland Security , “The Future of Smart Cities”.

text: December 2015

text: Figure 12: Challenges and gaps

text: Technology Organisation, people & process

text: G5 As the figure indicates, challenges and gaps C3 G2 G1 C1 tend to concentrate in both the technology and G3 tools area and policy and standards area.

text: C7 C8

text: All Policy & standard

text: C1 Difficulties to integrate security for safety G1: Lack of a common EU approach to IPT C2 Inadequate importance and spending being G2: No integration of security in current guidelines afforded to cyber security or strategies for IPT C3 Inadequate checking for countermeasures G3: Lack of common definitions and formalised C4 Unwillingness to collaborate and exchange cyber security policies information on cyber security G4: Lack of corporate governance for IPT security C5 Slow phasing out of legacy systems G5: No specific security standards for IPT C6 Inadequate data exchange between IPT and SC G6: Lack of advanced interdependent analysis tools operators G7: Lack of advanced risk assessment tools C7 Weak situational awareness of cyber threats G8: Lack of advanced real-time and multi- C8 Resistance to security adoption stakeholder-enabled security technologies

text: The allocation was based on desktop research, survey and interviews

text: December 2015

text: By “decision makers” we are referring primarily to publically elected/appointed officials with decision-making powers that impact on IPT at both the EU and Member States levels. These organisations were given a mandate to develop European standards to provide interoperability, compatibility and continuity for the deployment and operational use of ITS (see Directive

text: of the European Parliament and of the Council of 7 July 2010 and Directive

text: December 2015

text: December 2015

text: December 2015

text: December 2015

text: Table 3: EU legislation and policy documents

text: EXISTING EU LEGISLATION

text: Title General Description Impact on IPT

text: This Directive (together with Directive Under this Directive, MS shall protect the Directive

text: ) sets out rules protecting fundamental rights and freedoms of on the protection of individuals fundamental rights and freedoms of citizens, and in particular their right to with regard to the processing of individuals, specifically in relation to data privacy with respect to the processing of personal data and on the free privacy, security and the re-use of personal data, as well as ensuring the free information. This includes passengers on movement of such data movement of such data between MS. IPT networks.

text: This Directive (together with Directive

text: ) sets out rules protecting fundamental rights and freedoms of

text: Directive

text: Directive

text: complements individuals, specifically in relation to concerning the processing of Directive

text: . It concerns the consent, privacy, security and the re-use personal data and the protection protection of privacy with respect to the of information. Services provided to the of privacy in the electronic processing of personal data in the public within IPT networks via electronic communications sector (Directive electronic communication sector, as well communications will need to have regard on privacy and electronic as ensuring the free movement of such for this Directive. Use of location data data between MS. linked to user’s devices, provision of

text: security, use of cookies, and recording/storage of data are all possible issues here.

text: This Directive requires applicable Directive (

text: ) applies to public authorities, entities and operators to take Directive

text: transport, including; railways, automated into account lifetime energy and on the promotion of clean and systems, tramways, trolley buses, and environmental impacts when purchasing energy-efficient road transport buses. However, the focus is very narrow road transport vehicles. This includes vehicles covering only a specific set of energy consumption and emissions of CO2 environmental vehicle specifications. and of certain pollutants.

text: This Directive establishes a framework to support the coordinated, coherent Defines ITS. Enables the EC to adopt

text: Directive

text: deployment and use of Intelligent specifications necessary to ensure the on the framework for the Transport Systems (ITS) within the EU. It compatibility, interoperability and deployment of Intelligent also provides for the development of continuity for the deployment and Transport Systems in the field of specifications and necessary standards operational use of ITS. Also, promotes the road transport and for interfaces within areas including; ITS road safety and development of necessary standards in security, linking vehicles with transport these areas. Sets out rules on privacy,

text: with other modes of transport

text: infrastructure, optimal use of data, and security and the reuse of information. continuity of service.

text: December 2015

text: This Directive establishes Technical This Directive concerns the provisions Specifications for Interoperability (TSIs) relating to the interoperability for the subsystems that comprise the Directive

text: constituents, the interfaces and trans-European rail system. No specific on the interoperability of the rail procedures, as well as the conditions of mention of ITS, however, the system within the Community overall compatibility of the rail systems development of interoperability across across the EU, that are required to national rail networks provides a achieve its interoperability. convenient common platform for developers of ITS to utilise and link into.

text: FUTURE EU LEGISLATION

text: Title General Description Impact on IPT

text: The aim of the proposed Directive is to Proposed NIS Directive ensure a high common level of network Operators of critical infrastructures, concerning measures to ensure a and information security (NIS). This means including transport, will be required to high common level of network improving the security of the Internet and manage cyber security risks and report and information security across the private networks and information serious incidents to their national the Union systems underpinning the functioning of competent authorities. EU societies and economies.

text: PRINCIPLE EU POLICY & STRATEGY DOCUMENTS

text: Title General Description Impact on IPT

text: While the overall focus of this Action Plan is wider than just security and resilience of ITS, specific actions identified within This Action Plan aims to accelerate and Action Plan for the Deployment this plan are applicable. These include: the coordinate the deployment of Intelligent of Intelligent Transport Systems optimal use of traffic/travel data; road Transport Systems (ITS) in road transport, in Europe - COM(2008) 886 safety and security; integration of the including interfaces with other transport final/2 – CORRIGENDUM vehicle into the transport infrastructure; modes. data security and protection and liability issues; and European ITS cooperation and coordination.

text: This action plan sets out 14 “Lines of The IoT will become integrated into the Action” regarding the future design of ICT networks of Smart Cities and IPT objects/systems falling under the Internet systems. This action plan is useful in that

text: Internet of Things - An action

text: of Things (IoT) umbrella. Specifically this it raises a number of issues yet to be

text: plan for Europe - COM(2009) 278

text: introduces questions of privacy, the addressed. As the IoT develops and

text: monitoring of individuals, and the storage becomes integrated elements of this of personal data. Also issues of design action plan will take on increased standardisation are raised. significance.

text: EC, “EU Cybersecurity plan to protect open internet and online freedom and opportunity - Cyber Security strategy and Proposal for a Directive”. http://ec.europa.eu/digital-agenda/en/news/eu-cybersecurity-plan-protect-openinternet-and-online-freedom-and-opportunity-cyber-security

text: December 2015

text: Title General Description Impact on IPT

text: This Strategy has the potential to impact

text: The overall aim is to develop a Digital the technical operation of ICT networks,

text: A Digital Single Market Strategy

text: Single Market across EU cyber space create a more joined-up approach to the for Europe - COM(2015) 192 final whereby the principle of free movement development of online network security

text: of people, goods, services and capital is solutions, and boost the development of

text: translated and applied online. standards for interoperability in the

text: transport sector.

text: This plan places strong emphasis on urban Presents the Strategic Implementation European Innovation Partnership mobility (i.e. map public transport) and Plan for creating Smart Cities produced by on Smart Cities and the integration of infrastructure assets the High Level Group of the European Communities: Strategic and processes across energy, ICT and Innovation Partnership for Smart Cities Implementation Plan transport to improve the efficiency and and Communities. sustainability of cities (i.e. creating IPT).

text: While the focus is limited the Roadmap

text: does specifically mention the

text: development of smart mobility systems

text: such as intelligent transport systems, and Roadmap to a Single European Focus is on how to remove barriers and the need for regulatory frameworks to Transport Area – Towards a bottlenecks so as to complete the internal protect privacy and personal data in competitive and resource market for transport by creating a parallel with the wider use of information efficient transport system - competitive and sustainable transport technology tools. Highlights COM(2011) 144 final market within the EU. standardisation and interoperability as

text: keys to avoiding the technological

text: fragmentation of the European transport

text: market.

text: Within Intelligent Transport Systems, this This Rolling Plan provides a multi-annual document sets out the standards overview of the needs for preliminary or Rolling plan for ICT developments that have occurred and the complementary ICT standardisation Standardisation legislation and policy documents at the activities to undertake in support of EU European and (to a lesser extent) at the policy activities. MS level.

text: Covering Smart Cities and Communities Strong focus on energy efficiency and

text: European Innovation Partnerships; these environmental concerns, this

text: are partnerships across the areas of communication does emphasise the need

text: Smart Cities and Communities –

text: energy, transport and information and for interoperability of smart technologies.

text: European Innovation Partnership

text: communication with the objective to Highlights the lack of standards and the

text: - COM(2012) 4701 final

text: catalyse progress in areas where energy immaturity of the market in truly

text: use, mobility and transport, and ICT are integrated energy, transport and ICT

text: intimately linked. solutions as market impediments.

text: December 2015

text: Table 4: Top critical functions, assets and threats

text: TOP 5 CRITICAL TOP 21 CRITICAL ASSETS TOP 15 CRITICAL THREATS SOCIETAL/BUSINESS FUNCTIONS

text: Passenger safety and security 1 Payment systems 1 Distributed denial of service attack (DDoS) = Transportation safety and = Financial viability security 2 Terrorism and/or state 3 Internet & networking sponsored attacks 3 Data protection and privacy = Networking &communication 3 Manipulation of hardware = Traffic and vehicle components and/or software management = Radio telecommunication 4 Interruption and/or 5 Sustainable urban mobility = On-board equipment disruption of electrical supply

text: Operational control centres = Interruption and/or disruption of frequency = Physical infrastructure = Software failure and/or errors = Data 7 Natural disasters = Power distribution grid = Environmental disasters 11 Identity management systems 9 Malware and viruses 12 Safety systems = Hardware failure and/or = Passenger safety systems malfunctions 14 Integrity and availability of data and 11 Unauthorised use and/or communications access = Staff = Loss of (integrity of) sensitive 16 Reputation information/data

text: = Confidentiality = Tampering and/or alteration of data including insertion of = Data protection and privacy information 19 Availability of law enforcement 14 Operator and/or user errors 20 Public communication and social 15 Strike media

text: = Information distribution systems

text: LEGEND FUNCTIONS AND ASSETS THREATS

text: Societal critical Unintentional damages Business critical Insider threats Nefarious activities/abuses Physical and large-scale attacks Acts of nature/environmental incidents Accidental errors / malfunctions / failures Disruptions/outages

text: December 2015

text: Table 5: Complete list of threats

text: THREAT GROUPS BUSINESS ASSETS AND FUNCTIONS SOCIETAL ASSETS AND FUNCTIONS

text: Physical and large scale attacks

text: Traffic and vehicle management, Sustainable urban mobility, Passenger Transportation safety and security, safety and security, Sustainable Unauthorised use and/or access Sales, fees and charges, Resilient environment, Data protection and management structure, Energy and privacy environment

text: Traffic and vehicle management, Sustainable urban mobility, Passenger Transportation safety and security, safety and security, Sustainable Vandalism and/or civil disorder Sales, fees and charges, Energy and environment environment

text: Traffic and vehicle management, Passenger safety and security Violence and/or shooting within sites Resilient management structures

text: Traffic and vehicle management, Sustainable urban mobility, Passenger Transportation safety and security, safety and security, Sustainable Theft of data and/or infrastructures Resilient management structures, environment, Data protection and Energy and environment privacy

text: Natural disasters All All

text: Environmental disasters All All

text: Accidental errors/malfunctions/failures

text: Traffic and vehicle management, Sustainable urban mobility, Passenger Transportation safety and security, safety and security, Sustainable Hardware failure and /or malfunctions Sales, fees and charges, Resilient environment management structures, Energy and environment

text: Traffic and vehicle management, Sustainable urban mobility, Passenger Transportation safety and security, safety and security, Sustainable Software failure and/or malfunctions Sales, fees and charges, Resilient environment management structures, Energy and environment

text: Traffic and vehicle management, Data protection and privacy, Sustainable Loss of (integrity of) sensitive Transportation safety and security, urban mobility information/data Resilient management structures

text: December 2015

text: Traffic and vehicle management, Sustainable urban mobility, Passenger Transportation safety and security, safety and security, Sustainable Configuration errors Sales, fees and charges, Resilient environment management structures, Energy and environment

text: Disruption and/or outages

text: Strike Resilient management structures Sustainable urban mobility

text: Nefarious activity /abuse

text: Traffic and vehicle management, Sustainable urban mobility, Passenger Transportation safety and security, safety and security, Sustainable Distributed denial of service attacks Sales, fees and charges, Resilient environment (DDoS) management structures, Energy and environment

text: Manipulation of hardware and/or All assets (excepting people/living things All assets (excepting people/living things software and data) and data)

text: Traffic and vehicle management, Sustainable urban mobility, Passenger Transportation safety and security, safety and security, Sustainable Malware and viruses Sales, fees and charges, Resilient environment management structures, Energy and environment

text: Traffic and vehicle management, Data Protection and privacy Tempering and/or alteration of data Transportation safety and security, including insertion of information Resilient management structures

text: Traffic and vehicle management, Sustainable urban mobility, Passenger Transportation safety and security, safety and security, Sustainable Hacking of wireless , connected assets Sales, fees and charges, Resilient environment management structures, Energy and environment

text: Traffic and vehicle management, Data Protection and privacy, Integrated Data breaches Transportation safety and security, infrastructure and processes Resilient management structures

text: Traffic and vehicle management, Sales, Sustainable urban mobility, Data Identity theft fees and charges, Resilient management Protection and privacy structures

text: December 2015

text: Traffic and vehicle management, Sustainable urban mobility, Passenger Transportation safety and security, safety and security, Sustainable Exploitation of software bugs Sales, fees and charges, Resilient environment management structures, Energy and environment

text: Traffic and vehicle management, Sustainable urban mobility, Passenger Transportation safety and security, safety and security, Sustainable Abuse of authorisation Sales, fees and charges, Resilient environment management structures

text: Traffic and vehicle management, Data Protection and privacy Abuse of information leakages Transportation safety and security, Resilient management structures

text: Traffic and vehicle management, Data Protection and privacy Intentional disclosure Resilient management structures

text: Traffic and vehicle management, Sustainable urban mobility, Data Eavesdropping and/or wiretapping Transportation safety and security, protection and privacy Resilient management structures

text: Insider threats

text: Traffic and vehicle management, Sustainable urban mobility, Data Stealing information or manipulation of Transportation safety and security, Protection and privacy data Resilient management structures

text: Traffic and vehicle management, Data protection and privacy Sales of important data to competitors Transportation safety and security, Resilient management structures

text: Leaking information Ditto Ditto

text: Unintentional damage

text: All assets (excepting people/living All assets (excepting people/living things) Operator and/or user errors things)

text: Traffic and vehicle management, Data protection and privacy Accidental disclosure Transportation safety and security, Resilient management structures

text: Mismanagement All All

text: December 2015

text: Table 6: Good practice security measures for protecting IPT

text: WHEN TO APPLY GOOD PRACTICE BUSINESS / SOCIETAL FUNCTIONS THREAT GROUPS ADDRESSED GOOD PRACTICE

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats  Transportation safety and security / Passenger safety and security  Acts of nature/environmental incidents  Energy and environment / Sustainable environment Conduct security-focused  Pre-attack Post-attack

text: Accidental errors/malfunctions/ failures

text:  Sales, fees & charge / Data protection & privacy/ Resilient

text: risk assessments

text: management structure

text:  Nefarious activities/abuse  Insider threats

text: This Refers to when the good practice should be engaged so as to address the different threat groups. It does not refer to when the good practice should be developed and implemented by the IPT operator – which will always be “before the threat has manifested itself”.

text: December 2015

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats Employ physical security,  Transportation safety and security / Passenger safety and security  Accidental errors/malfunctions/ failures Pre-attack

text: access controls and

text:  Nefarious activities/abuse

text: protection measures

text:  Insider threats

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats Employ secure digital  Transportation safety and security / Passenger safety and security  Accidental errors/malfunctions/ failures Pre-attack access controls to 

text: Sales, fees & charge / Data protection & privacy/ Resilient

text: networks and data  Nefarious activities/abuse

text: management structure

text:  Insider threats

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility Employ  Physical & large-scale threats  Transportation safety and security / Passenger safety and security Pre-attack alarms/surveillance for 

text:  Energy and environment / Sustainable environment

text: protecting physical and

text:  Nefarious activities/abuse  Sales, fees & charge / Data protection & privacy/Resilient During attack

text: digital assets

text:  Insider threats

text: management structure

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats  Transportation safety and security / Passenger safety and security  Accidental errors/malfunctions/ failures Pre-attack Encryption 

text: Sales, fees & charge / Data protection & privacy / Resilient

text:  Nefarious activities/abuse

text: management structure

text:  Insider threats

text:  Physical & large-scale threats  Traffic & vehicle management / Sustainable urban mobility Develop secure and 

text: Nefarious activities/abuse

text:  Transportation safety and security / Passenger safety and security

text: private communication

text: networks  Sales, fees & charge / Data protection & privacy / Resilient During attack

text: management structure

text: December 2015

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats  Pre-attack Transportation safety and security / Passenger safety and security Employ intrusion detection  Accidental errors/malfunctions/ failures  Energy and environment /Sustainable environment systems (IDSs)  Nefarious activities/abuse During attack  Sales, fees & charge / Data protection & privacy / Resilient

text: management structure

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats Employ identity  Transportation safety and security / Passenger safety and security Pre-attack  Accidental errors/malfunctions/ failures management and 

text: authentication systems  Nefarious activities/abuse

text: management structure

text:  Insider threats

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility Integrate shut-down 

text: Physical & large-scale threats

text:  Transportation safety and security / Passenger safety and security procedures/remote 

text:  Energy and environment / Sustainable environment During attack

text: deactivation of capabilities

text:  Nefarious activities/abuse

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats  Transportation safety and security / Passenger safety and security  Acts of nature/environmental incidents Operate in degraded mode  Sales, fees & charge / Data protection & privacy / Resilient  Accidental errors/malfunctions/ failures of operation management structure  Nefarious activities/abuse During attack

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats  Transportation safety and security / Passenger safety and security  Accidental errors/malfunctions/ failures Pre-attack  Energy and environment / Sustainable environment

text: Employ security by design

text:  Disruptions/outages  Sales, fees & charge / Data protection & privacy / Resilient  Nefarious activities/abuse

text: management structure

text:  Insider threats

text: December 2015

text:  Unintentional damage  Traffic & vehicle management / sustainable urban mobility  Physical & large-scale threats  Transportation safety and security / Passenger safety and security  Acts of nature/environmental incidents Establish disaster recovery  Energy and environment / Sustainable environment

text:  Accidental errors/malfunctions/ failures processes and maintain 

text: back-ups  Disruptions/outages

text: management structure

text:  Nefarious activities/abuse

text:  Insider threats

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats  Transportation safety and security / Passenger safety and security Pre-attack

text: Define degraded modes of

text:  Acts of nature/environmental incidents  Sales, fees & charge / Data protection & privacy / Resilient

text:  Accidental errors/malfunctions/ failures During attack

text: management structure

text:  Nefarious activities/abuse

text:  Unintentional damage  Transportation safety and security / Passenger safety and security  Physical & large-scale threats  Sales, fees & charge / Data protection & privacy / Resilient Pre-attack

text: Implement an information

text:  Accidental errors/malfunctions/ failures

text: management structure

text: security policy

text:  Nefarious activities/abuse

text:  Insider threats

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats  Transportation safety and security / Passenger safety and security  Acts of nature/environmental incidents  Energy and environment / Sustainable environment Pre-attack Forecasting, early warning 

text:  Sales, fees & charge / Data protection & privacy / Resilient

text: systems and risk analysis

text: management structure

text:  Nefarious activities/abuse

text:  Insider threats

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats Separate critical systems  Transportation safety and security / Passenger safety and security Pre-attack  Accidental errors/malfunctions/ failures

text: from non-critical systems

text:  Nefarious activities/abuse

text:  Insider threats

text: December 2015

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats Enhance physical security  Transportation safety and security / Passenger safety and security Pre-attack  Accidental errors/malfunctions/ failures protecting critical physical 

text: Energy and environment / Sustainable environment

text:  Nefarious activities/abuse

text:  Insider threats

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats  Transportation safety and security / Passenger safety and security  Acts of nature/environmental incidents Implement a security  Energy and environment / Sustainable environment control centre with real-  Accidental errors/malfunctions/ failures

text:  Disruptions/outages During attack

text: time monitoring

text:  Nefarious activities/abuse

text:  Insider threats

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats  Transportation safety and security / Passenger safety and security  Acts of nature/environmental incidents  Energy and environment / Sustainable environment Pre-attack

text: Ensure redundancy for

text:  Accidental errors/malfunctions/ failures  Sales, fees & charge / Data protection & privacy/Resilient

text: critical systems

text: management structure

text:  Nefarious activities/abuse

text:  Insider threats

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats  Transportation safety and security / Passenger safety and security Create resilient 

text: Acts of nature/environmental incidents

text: communication systems During attack

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats  Energy and environment /Sustainable environment Create resilient power  Acts of nature/environmental incidents

text: systems  Accidental errors/malfunctions/ failures

text: During attack

text: December 2015

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats  Transportation safety and security/ Passenger safety and security  Acts of nature/environmental incidents  Sales, fees & charge /Data protection & privacy / Resilient Post-attack Monitor and record 

text: Accidental errors/malfunctions/ failures management structure

text:  Disruptions/outages During attack

text:  Nefarious activities/abuse

text:  Insider threats

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats Define security  Transportation safety and security / Passenger safety and security

text: requirements during

text: procurement processes  Nefarious activities/abuse

text:  Insider threats

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats  Transportation safety and security / Passenger safety and security  Acts of nature/environmental incidents Pre-attack Post-attack  Energy and environment / Sustainable environment Coordinate with LEAs and 

text:  Disruptions/outages During attack

text: management structure

text:  Nefarious activities/abuse

text:  Insider threats

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats  Transportation safety and security / Passenger safety and security Pre-attack Post-attack Raise awareness on cyber  Accidental errors/malfunctions/ failures  Energy and environment / Sustainable environment

text: threats to all levels of staff

text:  Disruptions/outages including management Sales, fees & charge / Data protection & privacy / Resilient During attack  Nefarious activities/abuse

text: management structure

text:  Insider threats

text: December 2015

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats  Transportation safety and security / Passenger safety and security  Acts of nature/environmental incidents Pre-attack Post-attack  Sales, fees & charge / Data protection & privacy / Resilient  Accidental errors/malfunctions/ failures Engage in staff training management structure  Disruptions/outages

text:  Nefarious activities/abuse

text:  Insider threats

text:  Unintentional damage  Traffic & vehicle management / Sustainable urban mobility  Physical & large-scale threats  Transportation safety and security / Passenger safety and security  Acts of nature/environmental incidents Pre-attack Post-attack Develop organisational  Energy and environment / Sustainable environment  Accidental errors/malfunctions/ failures and operational 

text: procedures and guidelines  Disruptions/outages During attack

text: management structure

text:  Nefarious activities/abuse

text:  Insider threats

text: December 2015

text: December 2015

text: December 2015

text: December 2015

text: December 2015

text: December 2015

identifier: Cyber Security and Resilience of Intelligent Public Transport. Good practices and recommendations

nummer: good-practices-recommendations

title: Cyber Security and Resilience of Intelligent Public Transport. Good practices and recommendations

text: Cyber Security and Resilience of Intelligent Public Transport Good practices and recommendations DECEMBER 2015 www.enisa.europa.eu European Union Agency For Network And Information Security

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its Member States (MS), the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU MS in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU MS by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Authors

text: Dr. Cédric LÉVY-BENCHETON, Ms. Eleni DARRA (ENISA)

text: Contact

text: For contacting the authors please use resilience@enisa.europa.eu. For media enquires about this paper, please use press@enisa.europa.eu.

text: Acknowledgements

text: Dr. Timothy MITCHENER-NISSEN (Trilateral Research) Dr. Monica LAGAZIO (Trilateral Research) Dr. Daniel BACHLECHNER (Fraunhofer ISI) Dr. Michael FRIEDEWALD (Fraunhofer ISI) Mr. Antonio KUNG (Trialog)

text: ENISA would like to acknowledge all participants to the study. In particular, ENISA would like to thank the following experts for their contribution (in alphabetical order):

text: Mrs. Lindsey BARR MANCINI (UITP) Ms. Luana BIDASCA (European Transport Safety Council) Mr. Carl-Johan BOSTORP (Stockholm Public Transport) Mr. Leon BRAIN (DG MOVE) Mr. Daniele CATTEDDU (Cloud Security Alliance) Mr. Patrick CHAMBET (Métropole Nice Côte d’Azur) Mr. Gino CORMONS (Regione Autonoma Friuli Venezia Giulia) Mr. Christopher J. COX (Metroselskabet I/S) Dr. Alexander DIX (German Data Protection Agency) Mr. Ignasi FONTANAL (Opticits) Mr. Sergey GORDEYCHIK (Securing Smart Cities / Kaspersky Lab) Ms. Michele HANSON (Transport for London – TfL) Eng. Francois HAUSMAN (UNIFE) Ms. Alena HAVLOVÁ (CER) Mr. Thomas KRITZER (Wiener Linien) Mr. Mariano LAMARCA LORENTE (Barcelona City Council – BCN.cat) Mr. Joe PICHLMAYR (Cyber Security Austria) Mr. José PIRES (International Union of Railways – UIC)

text: Mr. David PRIOR (Xuvasi Ltd.) Ms. Stefanie PROOST (De Lijn) Mr. Maxime RAPAILLE (STIB - MIVB Brussels public transportation) Mr. Luis RODA (Empresa Municipal de Transportes de Valencia – EMT) Mr. Bernardo RODRIGUES (London’s European Office) Mr. Jean-Luc SALLABERRY (FNCCR) Mr. Stephen SMITH (ECSA) ir. Andre SMULDERS, CISSP (Senior Business Consultant Security, TNO) Ms. Andrea SOEHNCHEN (UITP) Mr. Frank VAN STEENWINKEL (Fidecity)

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice

text: © European Union Agency for Network and Information Security (ENISA), 2015 Reproduction is authorised provided the source is acknowledged.

text: ISBN: 978-92-9204-146-5 | doi:10.2824/778225

text: Table of Contents

text: Executive Summary 7

text: 1. Introduction 9

text: 1.1 Scope of the study 10

text: 1.2 Target audience 11

text: 1.3 Methodology 11

text: 1.4 Outline 12

text: 2. The intelligent public transport environment 13

text: 2.1 Definitions 13

text: 2.2 EU policy context 14

text: 2.3 Critical business and societal functions and assets for intelligent public transport 16

text: 2.3.1 Asset groups 16 2.3.2 Main critical assets for intelligent public transport 17 2.3.3 Three key insights on the nature of intelligent public transport assets 19 2.3.4 Three key insights on security for intelligent public transport assets 19

text: 2.4 Intelligent public transport environment and elements 20

text: 3. A need to secure intelligent public transport 21

text: 3.1 Threats 21

text: 3.1.1 Threat model 21 3.1.2 List of threats to public transport 22 3.1.3 IPT assets exposure to cyber threats 23

text: 3.2 Vulnerabilities 26

text: 3.2.1 General vulnerabilities 26 3.2.2 Specific vulnerabilities 27

text: 3.3 Risks 29

text: 3.3.1 Business risks 29 3.3.2 Societal risks 30

text: 3.4 Challenges 31

text: 3.4.1 Challenge 1: Difficulties to integrate security for safety 31 3.4.2 Challenge 2: Inadequate importance and spending being afforded to cyber security 31 3.4.3 Challenge 3: Inadequate checking for countermeasures 31 3.4.4 Challenge 4: Unwillingness to collaborate and exchange information on cyber security 32 3.4.5 Challenge 5: Slow phasing out of legacy systems 33 3.4.6 Challenge 6: Inadequate data exchange between IPT and Smart Cities operators 33 3.4.7 Challenge 7: Weak situational awareness of cyber threats 33 3.4.8 Challenge 8: Resistance to security adoption 33

text: 4. Good practices for securing intelligent public transport 34

text: 4.1 Technical good practices 34

text: 4.2 Policies and standards 36

text: 4.3 Organisational, people and processes 38

text: 5. Gap analysis 40

text: 5.1 Gap 1: Lack of a common EU approach to Intelligent Public Transport Security 40

text: 5.2 Gap 2: No integration of security in current EU guidelines for IPT 40

text: 5.3 Gap 3: Lack of common definitions and formalised cyber security policies 40

text: 5.4 Gap 4: Lack of corporate governance for IPT security 41

text: 5.5 Gap 5: No specific security standards for IPT 41

text: 5.6 Gap 6: Lack of advanced interdependent analysis tools 41

text: 5.7 Gap 7: Lack of advanced risk assessment tools 42

text: 5.8 Gap 8: Lack of advanced real-time and multi-stakeholder-enabled security technologies 42

text: 6. Recommendations 43

text: 6.1 For decision makers 44

text: 6.1.1 EC and MS institutions should promote public/private collaboration on IPT cyber security at national level and EU-wide 44 6.1.2 EC institutions and agencies should promote and facilitate the development of a common EU approach to IPT security 44 6.1.3 EC institutions and agencies should develop a comprehensive EU strategy and framework for cyber security in IPT 44 6.1.4 EC and MS should integrate and converge security efforts made in other sectors of activity 45 6.1.5 EC and MS should foster the development of harmonised cyber security standards for IPT 45

text: 6.2 For transport operators 45

text: 6.2.1 IPT operators should integrate cyber security in their corporate governance 45 6.2.2 IPT operators should develop and implement an integrated corporate strategy addressing holistically cyber security and safety risks 45 6.2.3 IPT operators should implement risk management for cyber security in multi-stakeholder environments including external contractors and dependencies 45 6.2.4 IPT operators should clearly and routinely specify their cyber security requirements 46 6.2.5 IPT operators should annually review organisational cyber security processes, practices and infrastructures 46

text: 6.3 For manufacturers and solution providers 46

text: 6.3.1 Manufacturers and solution providers should create products/solutions that match the cyber security requirements of IPT end-users 46 6.3.2 Manufacturers and solution providers should collaborate in the development of IPT-specific standards and apply them to IPT solutions 47 6.3.3 Manufacturers and solution providers should develop a trusted information sharing platform on risks and vulnerabilities 47 6.3.4 Manufacturers and solution providers should provide security guidance for your systems, products and solutions 47

text: Annexes 48 A.1 Key EU legislation and policy/strategy documents affecting IPT 48 A.2 Top critical functions, assets, and threats identified for Intelligent Public Transport 51 A.3 Threats to individual assets 52 A.4 Reference guide for applying good practices to Intelligent Public Transport 55 A.5 Survey questions 62

text: Executive Summary

text: The concept of “Smart Cities” revolves around the interconnection of different operators from domains of activity such as public transport, energy… These operators rely on Information and Communication Technology (ICT) systems to retrieve, process, and exchange data in order to improve their services and the quality of life of citizens.

text: In this context, public transport operators have an important role to enable this smartness. They contribute to the life of the city, to the economy and ensure the resilience of the Smart City. The integration of several ICT systems enables “Intelligent Public Transport” (IPT), where cyber-physical devices, communication networks and central servers optimise the transport service up to a certain degree of automation.

text: While this fusion of cyber technology, physical infrastructures and mass transport vehicles creates new opportunities for improving services and functionality, it also has the effect of introducing cyber security risks into transport networks that have not historically been susceptible to such risks. Moreover, IPT becomes a natural target for emerging cyber threats that will have an impact not only on the operations of the transport service but also on the whole economy and potentially on the health and safety of citizens.

text: For that reason, it is important to consider security for Intelligent Public Transport to protect the

text: operators, the economy and the life and safety of 40% Don't know citizens. However, IPT faces several challenges in Yes 10% this direction: there is currently no EU policy on 20% cyber security for transport, the awareness level is Less than 2%

text: low and it is difficult for operators to dedicate 40% budget to this specific objective of cyber security (see picture on the right). Cyber security spending

text: This study proposes a pragmatic approach that will highlight the critical assets of Intelligent Public Transport systems. It gives an overview of the existing security measures (good practices) that could be deployed to protect these critical assets and ensure security of the IPT system, based on a survey and interviews of experts from the sector, municipalities, operators, manufacturers and policy makers.

text: The good practices propose a first step toward actionable security and a better protection of the transport ecosystem. Good practices go beyond technical security measures; they also integrate policies, standards, operational and organisational measures. For example, transport operators can use this study in support of their risk assessment in order to understand which critical assets to protect, and how.

text: In spite of the fact that security becomes a concern for all actors of Intelligent Public Transport, additional efforts are still needed to improve the current situation. Following that direction, the study proposes recommendations to three stakeholders groups that need to enhance the status of cyber security for IPT. For that purpose:

text: Decision makers in the European Commission and in Member States should:

text:  Promote public/private collaboration on IPT cyber security at national level and EU-wide  Promote and facilitate the development of a common EU approach to IPT security  Develop a comprehensive EU strategy and framework for cyber security in IPT  Integrate and converge security efforts made in other sectors of activity  Foster the development of harmonised cyber security standards for IPT

text: Intelligent Public Transport operators should:

text:  Integrate cyber security in their corporate governance  Develop and implement an integrated corporate strategy addressing holistically cyber security and safety risks  Implement risk management for cyber security in multi-stakeholder environments including external contractors and dependencies  Clearly and routinely specify their cyber security requirements  Annually review organisational cyber security processes, practices and infrastructures

text: Manufacturers of IPT systems and solutions should:

text:  Create products/solutions that match the cyber security requirements of IPT end-users  Collaborate in the development of IPT-specific standards and apply them to IPT solutions  Develop a trusted information sharing platforms on risks and vulnerabilities  Provide security guidance for your systems, products and solutions

text: 1. Introduction

text: Transport networks are designated as critical infrastructure within the European Union (EU) and are essential for maintaining the health, safety, security, and social and economic well-being of citizens within EU Member States (MS). Yet the effective operation of these transport networks is vulnerable to the increasing levels of traffic, which also contribute to rising energy consumption and environmental and social problems. These negative symptoms are strongly felt in European cities which draw together large concentrations of citizens within relatively small geographic areas.

text: To help manage and mitigate increases in traffic congestion, cities rely upon effective public transport networks as efficient mobility solutions. However, when seeking to expand and improve these public transport networks it is not enough to count solely upon the traditional measure of simply increasing the physical road and rail infrastructure. Rather technological innovation has a major role to play here in the creation of appropriate solutions, and the realisation of this fact is directly connected with the rise of Intelligent Transport Systems (ITS) integrated into Smart Cities.

text: ITS integrates information and communication technology (ICT) with transport engineering so as to plan, design, operate, maintain and manage transport systems, which in turn significantly contribute to improving the efficiency and operation of such networks. The application of these technologies to public transport systems produces Intelligent Public Transport (IPT).

text: However, this process of increasing the incorporation of ICT into public transport through both the introduction of networked devices and the expansion of remote access and control capabilities, coupled with the linking together of different operators within a single Smart City network (creating a system-ofsystems), all acts to increase the cyber threat exposure of traditional transport networks. While current transport operators and engineers possess a wealth of knowledge and experience in ensuring their networks and products are designed with safety in mind, they have less experience in ensuring the cyber security of their networks and products.

text: This increase in the cyber security risks for IPT produces new objectives that need to be met. These include the identification of critical IPT assets and the associated threats that target them, as well as the identification of good practices in cyber security that can address these threats and increase the cyber resilience of IPT operators. Such outcomes need to be coupled with a coherent strategic and policy approach that encompasses all of the stakeholders linked to IPT within the Smart City environment.

text: 1.1 Scope of the study

text: This study focuses on the protection of the assets critical to Intelligent Public Transports in the context of Smart Cities. These assets are considered critical as they contribute to the normal operation of local public transport networks, including metro, buses, light rail and other modes of mass public transport found in Smart Cities.

text: For that purpose, this study identifies these critical assets from a business and societal point of view. It highlights good security practices against cyber threats. The objective is to enhance the resilience of IPT. From the point of view of Smart Cities, these assets can be considered “internal” to IPT operators.

text: Figure 1 defines the scope of the study by focusing on the critical assets of local public transport operators (displayed in the green box). The scope does not consider a specific architecture but rather a comprehensive list of assets owned by an IPT operator.

text: The protection of critical assets for other transport operators (private and non-local), operators from other sectors and non-operators fall out of the scope of this study. The protection of data exchange between IPT operators and other stakeholders is also out of scope of this study. ENISA study “Cyber Security for Smart Cities - an architecture model for public transport” focuses on the protection of this data exchange and its associated assets.

text: 1.2 Target audience

text: The interconnected network of actors facilitates the operation of IPT within a Smart City environment. Hence, the task of developing secure and resilient IPT systems falls on multiple actors, requiring the cooperation of both public and private stakeholders working together to enhance cyber security. Given this fact, the target audiences of this study are drawn from a number of sectors (see Figure 2):

text:  Operators: they cover a wide range of actors; both those directly involved in operating different public transport modes (metro, bus, tram/trolley-bus, light rail, ferry) and an interconnected network of operators within the Smart City (energy, Operators Manufacturers infrastructure, public & private clouds, communications, banks and payment systems, etc.).  Manufacturers: Covering the full spectrum of manufacturers IPT Critical including physical transport infrastructure, providers, vehicle

text: manufacturers, developers of ICT networks, hardware and software engineers, etc.  Service Providers: Including risk managers, cloud providers, ICT

text: providers makers network providers, security providers, etc.  Policy Makers: Different levels of government (local, national, EU), regulators and law enforcement agencies involved in IPT.

text: 1.3 Methodology

text: This study is based on a combination of desktop research as well as empirical research (i.e. survey and interviews) with the results validated through a stakeholder workshop. Initial data gathering scoped the development of the study, including the current key policies and legislation. Critical societal and business assets for IPT were identified by integrating the desktop and empirical findings, and a comparative approach was employed (i.e. between threats, risks, vulnerabilities, good practices, and challenges and gaps) focussing on enhancing cyber security within IPT.

text: Results of the desktop research were further developed, and good practices identified, through an online survey and series of interviews involving a total of 22 respondents drawn from different stakeholder groups. While this is sample size is limited it nevertheless represents a good starting point for conducting research into IPT. These respondents were based in the following EU MS:

text:  Belgium  Luxembourg  Denmark  Netherlands  Estonia  Republic of Ireland  France  Spain  Germany  Sweden  Latvia  United Kingdom

text: The findings and recommendations of this study were validated through a final workshop of IPT operators, Smart City municipalities and policy makers.

text: 1.4 Outline

text: This study is structured as follows:

text:  Section 1 – Introduction: introduces the topic and provides an outline of the study, the target audiences and the methodologies employed.  Section 2 – The Intelligent Public Transport environment: provides the contextual environment for IPT, including the key legislative environment, critical business and societal functions for IPT, and key assets.  Section 3 – A need to secure IPT: identifies and organises the key cyber threats affecting the critical assets of IPT operators. The cyber threat vulnerabilities inherent to IPT are identified and discussed, and an initial analysis of risks is conducted.  Section 4 – Good practices for securing Intelligent Public Transport: good practices for securing IPT networks from cyber threats are presented here, as identified through both desktop research and the interviews/surveying of IPT operators.  Section 5 – Gap analysis: The identification and analysis of existing gaps in securing IPT (arising from existing policies, legislation, operational practices and employed technologies) identified throughout this research via a comparative analysis of previous findings.  Section 6 – Recommendations: Sets out nine key recommendations for policy makers, IPT operators, manufacturers and solution providers on enhancing the security and resilience of IPT.

text: 2. The intelligent public transport environment

text: This section provides an overview of the IPT environment. It defines terms commonly used within this sector, outlines the current legal and policy environment within which IPT operates, places IPT within the wider smart environment, sets out the critical functions and assets for IPT operators, and finally it explains why cyber security is so fundamentally critical in the physical-digital fusion that is IPT.

text: 2.1 Definitions

text: Many of the common concepts within intelligent transport are the subject of multiple definitions provided by different stakeholders, each with differing perspectives and agendas. These have been distilled here to produce a single set of definitions describing how these concepts are approached within this study. Table 1 defines the terms employed throughout this study.

text: 2.2 EU policy context

text: At the EU regulatory level, Regulations and Directives have yet to be specifically drafted to govern the form and operation of IPT. Instead, what currently exists are a number of Directives whose broader remits are, to differing degrees, applicable to IPT. These existing Directives cover the protection of personal data, the processing of personal data in the electronic communications sector, the promotion of clean and energyefficient road transport vehicles, creating interoperability of national rail systems across the European

text: Community, and the deployment of intelligent transport systems in the field of road transport. Individual analyses of these Directives is provided in Annex 1.

text: Collectively these Directives demonstrate that while there is currently no piece of EU legislation focussing specifically on the operation of IPT at the EU level, there are elements of IPT operations that are still subject to a level of regulation. Despite this fact, when it comes to either cyber security protections, requirements and/or guidance specific to IPT, these Directives have very little to say beyond a cursory mention of general security and the need to protect in-vehicle communications in Directive

text: , and the need to protect the data privacy rights of citizens in Directives

text: and

text: . There is the proposed Network Information Security (NIS) Directive which, if enacted, will place a duty on

text: operators of critical infrastructures (including transport) to manage the risks posed to the security of the networks and information systems which they control and use in their operations. While this Directive will apply to IPT operators, the level of impact is uncertain as again it is not primarily focussed on the operation of IPT.

text: At the national level, while Member States need to ensure these Directives are incorporated into their respective legal systems, they are free to go beyond existing EU legislation by establishing additional national measures to promote IPT and cyber security.

text: Running parallel with these Directives are a number of important EU policy documents acting to drive the future development of IPT. These have appeared with regularity since the late 2000’s focussing on Intelligent Transport and its integration within Smart Cities, and they indicate the importance being assigned to these topics at the EU level. These policy documents include the following:

text:  Action Plan for the Deployment of Intelligent Transport Systems in Europe: This Action Plan aims to accelerate and coordinate the deployment of Intelligent Transport Systems (ITS) in road transport, including interfaces with other transport modes.  Internet of Things - An action plan for Europe: Sets out 14 “Lines of Action” regarding the future design of objects/systems falling under the Internet of Things (IoT).  A Digital Single Market Strategy Europe: Sets out the Commission’s strategy for creating a Digital Single Market whereby the free movement principles of goods, services, people and capital are translated and implemented into EU cyber space.  European Innovation Partnership on Smart Cities and Communities: Strategic Implementation Plan: Presents the Strategic Implementation Plan for creating Smart Cities produced by the High Level Group of the European Innovation Partnership for Smart Cities and Communities.  Roadmap to a Single European Transport Area – Towards a competitive and resource efficient transport system: Focus is on how to remove barriers and bottlenecks so as to complete the internal market for transport by creating a competitive and sustainable transport market within the EU.

text:  Rolling plan for ICT Standardisation: This Rolling Plan provides a multi-annual overview of the needs for preliminary or complementary ICT standardisation activities to undertake in support of EU policy activities.  Smart Cities and Communities – European Innovation Partnership: These are partnerships across the areas of energy, transport and information and communication with the objective to catalyse progress in areas where energy use, mobility and transport, and ICT are intimately linked.

text: What is most telling is that many of the EU policy and strategy documents within IPT have moved beyond simply seeking to educate the reader about IPT and/or justifying the development of this capability, and on to promoting concrete actions and outcomes through the use of action plans and/or the setting of specific objectives. This represents the level of acceptance IPT has achieved within the EU.

text: However, an EU policy specific to the development and security of IPT as a whole is still lacking. Instead the focus of these documents is primarily to promote the uptake and development of ITS, IoT, ICT, Smart Cities. Yet, there is no related policy on the cyber security requirements for the operators of such systems.

text: 2.3 Critical business and societal functions and assets for intelligent public transport 2.3.1 Asset groups

text: In order to identify the key IPT assets, based on the field work we have extrapolated key functions and their relevant specific assets from a business and societal prospective. Successfully managing an IPT business requires identifying and protecting those functions that are critical to the effective, continued operation of that business: i.e. business critical functions. Given the role and importance of IPT networks to citizens and societies, there are also functions that are critical from a societal perspective; i.e. societal critical functions. Within each of these business and societal functions are individual assets related to the provision of that function. Through the survey, interviews as well as desktop research covering key documents, the following five business and five societal functions were identified.

text: Business functions:

text:  Traffic and vehicle management defines IPT through the use of ICT, and underlies its goals of increasing efficiencies and productivity through the linking of systems and employing data. As a result this function contains a long list of related assets covering the full digital-physical spectrum. This mirrors the societal function “sustainable urban mobility”.  Transportation safety and security focuses on ensuring the effective cyber/physical security and safety of IPT infrastructures (including both physical and digital entities) attached to the business operations of the IPT operator. As such the assets range from cyber protection measures (i.e. ensuring the confidentiality, integrity and availability of data and communications) to access controls to both physical and digital assets.  Sales, fees and charges are essential to the continuing financial viability of an IPT operator, whether privately or publically owned. Protecting the payment system assets is therefore of fundamental importance.

text:  Resilient management structure allows an IPT operator to respond effectively to, and overcome, the range of threats IPT networks are subject to, including: acts of nature, cyber attacks, physical attacks, energy supply problems, etc. Staff and business reputation are important assets here.  Energy and environment concerns have a direct impact on the operation of IPT networks. Operators need to ensure the sufficient and continuous supply of energy to meet their network’s needs. While at the same time they must manage energy usage to control costs and mitigate any negative environmental impacts arising from their transport network. This function also mirrors the societal function “sustainable environment”.

text: Societal functions:

text:  Sustainable urban mobility networks are fundamental to the efficient operation of a city, providing a wealth of social and economic benefits. Incorporating ICT into the operation of traditional mobility networks to create IPT acts to maximise the efficiency, operation and sustainability of these mobility networks. This is fundamental in differentiating IPT from the traditional silo-based model of an urban public transport system. This infusion of ICT into the physical infrastructure and assets of different operators enables the integration of wider systems and processes. The critical assets to this function now include the digital infrastructure and integrated systems as well as physical infrastructures.  Passenger safety and security focuses on ensuring the effective cyber/physical security and safety of passengers using urban public transport networks. Achieving acceptable levels of safety and security are fundamental prerequisites for passengers to trust and willingly choose to use such networks. Providing the safety and (cyber) security of passengers on IPT networks requires a range of assets, from technological safety systems and surveillance (CCTV) capabilities, through to trained staff and the real-time ability to communicate with passengers.  Data protection and privacy are digital rights valued by societies, as well as representing EU legal requirements which apply to the operation of IPT networks (see Section 2.2). Mature IPT operators recognise that the data/information they hold constitutes one of their most valuable assets.  Sustainable environment recognises the impact of traffic networks on the wider city environment through vectors including; air quality, noise pollutions, traffic flow, user safety, sustainable energy grids, and the economic impact for both end-users and local businesses.

text: Because of the different nature and focus of these two viewpoints (i.e. business and societal), business assets tend to focus more on individual components of IPT, while societal assets tend to be concerned more with integrated and broader elements of IPT systems cutting across several operators.

text: 2.3.2 Main critical assets for intelligent public transport

text: Figure 3 below set out the business and societal functions grouped together with associated assets as identified through the survey, interviews and desktop research of related documents. These were also evaluated to identify those that are critical. The resulting five critical functions and 21 critical assets are

text: presented in bold and highlighted red in Figure 3. In addition, Annex 2 provides an easily referable table listing those functions, assets and threats identified as critical.

text: Assessing the nature and distribution of those assets prioritised within IPT, which act to connect IPT to the wider Smart City networks, produces key insights into both the “physical-digital” nature of those assets distributed throughout an IPT network, as well as their security requirements. Three key insights on the nature of IPT assets and security requirements are set out below.

text: 2.3.3 Three key insights on the nature of intelligent public transport assets

text:  Individual IPT assets combine multiple components: IPT assets are more complex than similar assets in traditional silo-based transport systems, as they combine multiple assets into one. For example, a bus is no longer just a public transport vehicle – it is also a data collection and recording system, an information dissemination asset, mobile Wi-Fi hub, and a source of real-time intelligence for optimising the transport network. This is especially true for those assets linked to societal functions.  The cyber/physical divide disappears within IPT assets: IPT assets fuse together both physical and digital components. The resulting assets are now cyber-physical hybrids.  IPT assets are linked together to form individual systems and systems-of-systems shared amongst multiple stakeholders: Through the use of ICT, the individual assets of a traditional silo-based transport network are linked together to form a transport operators IPT system. A Smart City links these assets further by integrating the systems of multiple operators and/or other stakeholders and providers, forming a system-of-systems.

text: 2.3.4 Three key insights on security for intelligent public transport assets

text:  IPT assets are subject to a greater range of security threats: When assets become cyber-physical hybrids, they become susceptible to both physical attacks and cyberattacks.  Cyber security and physical safety can no longer be treated as separate concerns: When attackers can affect the physical operation of ICT-enabled vehicles or other physical assets, network cyber security and physical safety become interdependent.  Determining where an IPT operator’s (security) responsibilities end is no longer clear: By integrating IPT into the wider Smart City through the sharing of assets, data and ICT networks with rd 3 parties, the boundary of the transport operator’s network is no longer clear. If an organisation cannot accurately map the network they control, this has important implications for how they conduct their network risk assessments.

text: 2.4 Intelligent public transport environment and elements

text: In order to discuss IPT it makes sense to place it in the urban context that both justifies the need for developing IPT systems, as well as provides the necessary cyber-physical infrastructure that enables public transport to become intelligent. This environment is the Smart City. Producing IPT systems (as opposed to traditional public transport systems) within this Smart City environment requires the successful integration of cyber-physical technologies and urban infrastructure. This entails the linking and integration of

text: (physical) infrastructures and (digital) processes which are not always well connected. Figure 4 depicts the different stakeholders operating within Smart Cities that can be integrated into the networks and cyber-physical architecture of IPT operators.

text: PRIVATE AND NON-LOCAL PUBLIC TRANSPORT OPERATORS

text: Bike/hire NON-TRANSPORT

text: NON-OPERATORS

text: 3. A need to secure intelligent public transport

text: This section focuses on the threats, vulnerabilities and risks that are faced by IPT networks and operators and their impact on both businesses and society. To this end we employ the following definitions when discussing these terms.  Threat: is the potential cause of an incident that may result in harm to an IPT system or IPT organisation.  Vulnerability: is a weakness within an IPT asset that can be exploited by the threats.  Risk: is the potential that a given threat will successfully exploit vulnerabilities within an IPT asset and thereby result in harm to the businesses and/or society as a whole.  Challenges: are current limitations faced by stakeholders on the security status of IPT (as expressed during the survey and the interviews).

text: 3.1 Threats 3.1.1 Threat model

text: For the purpose of this study, a practical IPT based threat-taxonomy has been developed. The threats included in the suggested threat model are all applicable to the IPT assets presented in the previous section. The presented threat taxonomy covers mainly cyber-security threats; that is, threats applying to information and communication technology assets. Additional non-IT threats have also been included in order to cover threats to physical assets that are necessary for the operation of the considered ICT-assets. Threats appear to be multifaceted and can be directed against specific assets, ranging from IPT systems to data, through to broad organisational structures and entire IPT infrastructures. Furthermore, due to IPT assets blurring the lines between digital and physical layers (see Section 3.2), IPT operators lean more towards multifaceted threats affecting complex assets having both physical and digital characteristics.

text: This threat taxonomy draws upon the key findings from the survey, interviews and desktop research. Previous ENISA studies have also been employed as a basis for the taxonomy (e.g. ENISA Threat Landscape 36 37 and Good Practice Guide for Internet Infrastructure 2015, ENISA Threat Landscape 2013 and the Smart Grid Threat Landscape and Good Practice Guide). In order to keep a practical focus we propose a threat model that regroups threats into seven threat categories. These groups define the origin of the threat with each category having its own implications over the security of IPT. However, it must be noted that these seven threat categories represent a generalised model. The threats each IPT operator must address will vary depending on multiple factors, including the size of the operator and the contextual nature of their

text: operating environment. As such it is essential IPT operators conduct individualised risk assessments to identify the specific threats that they need to address.

text: The identified seven threat categories are as follows:

text:  Physical and large scale attacks are intentional offensive actions, which aim to achieve maximum distraction, disruption, destruction, exposure, alteration, theft or unauthorised accessing of assets such as infrastructure, hardware, or ICT connections. This threat group has general application, thus covers the entire spectrum of cyber-physical infrastructure.  Acts of nature and/or environmental incidents are serious disruptions of the functioning of a society and can be divided into those natural disasters not directly triggered by humans, and environmental disasters caused by humans. These threats apply to assets in general, hence also to IPT infrastructures. Typical threats include: earthquakes, floods, wildfires, pollution, dust and corrosion.  Accidental errors/malfunctions/failures are related to the condition of not functioning and/or insufficient functioning of any IT infrastructure assets. Examples include; failures or disruptions of network devices or systems, software bugs, and configuration errors.  Disruption and/or outages are unexpected disruptions of services or significant decreases in expected quality, and can affect all kind of IPT assets. Disruption and outages may be triggered by a range of different reasons.  Nefarious activities and/or abuse are intentional actions that target IPT assets, ranging from systems and infrastructure to networks, by means of malicious acts with the aim to steal, alter, or destroy a specified target. This group contains those common threats generally referred to as cyber attacks, but also related actions that do not have a digital asset as a direct target.  Unintentional damage refers to the destruction, harm, or injury of property or people by accident. Damage includes both physical and non-physical damage.  Insider threats are similar to nefarious activities, but originate from within the organisation being attacked or targeted. The perpetrator is often an employee or officer of an organisation or enterprise. An insider threat does not have to be a present employee or stakeholder, but can also be a former employee, board member, or anyone who at one time had access to proprietary or confidential information from within the organisation.

text: 3.1.2 List of threats to public transport

text: This section presents the most relevant threats to IPT structures based on the desktop research, survey and interviews, and arranges them according to the categories described in Section 3.1.1. Respondents to the survey and interviews further evaluated these threats to identify those they consider to be critical. The top 15 they identified are highlighted red and presented in bold in Figure 5.

text: 3.1.3 IPT assets exposure to cyber threats

text: In this section, first ideas on the threat exposure of IPT assets are presented. The list of threats is nonexhaustive and could be complemented at a later date by a more in-depth study. The association between the threats (both threat groups and individual threats) from Figure 5 and the top asset types from Figure 3 is established through Table 2 below (see Annex 3 for a more detailed table showing all the asset types). As such, Table 2 shows the relationship between the identified critical threats and the asset types/functions to which these threats apply.

text: This information is important for identifying countermeasures that will reduce the exposure surface of assets. This threat-to-assets association is made on the basis of the field work and initial assessment done within the project. Since IPT assets tend to blur the lines between digital and physical layers, the same threat can affect multiple assets. The association performed in this study is non-exhaustive and subject to refinements, according to particular transport and threat environments.

text: 3.2 Vulnerabilities

text: In this section, initial reflections are provided on IPT vulnerabilities. By implementing cyber-physical systems into critical infrastructures, IPT brings benefits but also introduces a new set of vulnerabilities and risks to operators and society as a whole. Historically, cyber and physical systems have operated fairly independently of one another , however, IPT is leading to an integration of both domains and therefore to a situation where the exploitation of cyber vulnerabilities can result in physical consequences. This brings both new vulnerabilities and risks. Since IPT is relatively new and on the making, information on IPT vulnerabilities mainly originates from research, requirements and generic assumptions.

text: 3.2.1 General vulnerabilities

text:  Common to other IT systems: This category relates to areas that communally affect other IT systems (i.e. customer privacy and personal data, customer security and physical security and publicly accessible devices). This also includes vulnerabilities in commercially available mainstream IT products and systems.  Wireless and cellular communication: Wireless communication and cellular services introduce all the typical vulnerabilities in the area of communication conducted between points not connected by an

text: electrical conductor. For example, inadequate security protocols, inadequate authentication mechanisms, energy constrain, poor security and unreliable communication.  Integration of physical and virtual layers: The physical and virtual layers are becoming increasingly permeable as cyber and physical systems become networked and remotely accessible. “Increased connectivity, faster speeds, and multi-directional data flows diversify access points into critical infrastructure, changing and stretching the borders that must be secured.”  Cohabitation between legacy and new systems: IPT evolves at different rates among operators because of several factors including; resource availability, user preferences, and scale and accessibility. Inconsistency of IPT technologies introduces new vulnerabilities. Blind-spots may emerge in areas where legacy equipment and infrastructures are still used.  Increased automation: While the process of removing or limiting human interaction for IPT systems through increased automation improves safety by removing the possibility of human error, it also introduces new potential vulnerabilities. These include, but are not limited to: an increased number of system access points and, therefore, potential attack vectors; skill atrophy; cascading failures; and changes in emergency response plans.

text: 3.2.2 Specific vulnerabilities

text:  Scale and complexity of transportation networks: This refers to the difficulty of mapping the entire IPT system (i.e. due to the loss of visibility for all parts of a system) and the difficulty of securing the connectivity of mobile devices within transportation networks. Other issues include; the need to trust components and participants within the network, working with teams with different skills and competences, and the effective involvement of multiple stakeholders.  Applying networked technology across large transport systems: This leads to a large number of system access points stemming from the presence of networked technology across these large systems, which in turn increase both the difficulty and cost of properly securing each system device.  Multiple interdependent systems: This refers to the burden of ensuring the smooth interfacing, communication, and security among interdependent systems. These diverse systems include; sensors, computers, payment systems, financial systems, emergency systems, ventilation systems, automated devices, power relays, etc.  Access to real-time data: IPT requires nonstop access to real-time data which in turn leads to higher costs associated with maintenance and service downtime and therefore increased vulnerability.  Higher volumes of passengers and freight: This refers to logistical and security hurdles of physically accommodating enormous volumes of passengers and freight, along with the reality that security breaches could result in public safety risks.

text:  Online passenger services: The online provision of passenger services (such as timetabling, passenger information and ticket booking) that historically have only been available offline, means these functions and now susceptible to all the associated cyber risks.

text: The inferred vulnerabilities are listed below and presented in Figure 6, whereby these vulnerabilities are mapped (based on the desktop analysis) on an axis system with axes general vulnerabilities (i.e. applicable beyond IPT) and specific vulnerabilities (i.e. those specific to IPT); and internal vulnerabilities (i.e. originating from and controlled by a few operators) versus external vulnerabilities (i.e. those originating from operators’ interdependence and controlled by multiple operators).

text: This mapping allows for the identification of “quick wins”, defined as improvements that will impart significant benefits to transport operators but are relatively easy and inexpensive to implement. These are vulnerabilities that are internal and hence more likely to be under the direct control of the operator thus allowing for more impactful interventions, and those that are general which imply more affordable solutions (i.e. through off-the shelf products and/or greater competition between solution providers).

text: Quick Wins l rna te In General Specific l 3.3 Risks

text: As defined earlier, risk is the potential that a given threat will successfully exploit vulnerabilities within an IPT asset and thereby produce a negative impact on businesses and/or society as a whole.

text: Risks exploit several vulnerabilities within an IPT company, but above all those found in the area of: “wireless and cellular communication”, “cohabitation between legacy and new system” and “integration of physical and virtual layer”.

text: The risks are divided in two categories:

text:  Business risks, which can be at the source of economic loss and impact normal operations;  Societal risks, which may lead to safety issues and limit service unavailability.

text: 3.3.1 Business risks

text: Business risks usually affect different and multiple components due to dependencies between the affected IPT assets.

text:  Impact on operations: When operations are impacted, service usually follows a degraded mode. Specific actions are needed to recover operations, usually in a limited timeframe.  Loss of revenue: In the case of an incident, operations can become limited or suspended, which leads to a loss revenues. Moreover, responsibilities in case of an incident can also lead to loss of revenue (fines…).  Impact on reputation / loss of trust: In the case of major service disruptions, risks can also cover reputational damage and the loss of revenue which can directly impact a company’s bottom line.  Non-compliance with the regulation on data protection: The disclosure of personal data, voluntarily or not, is covered by regulation. This risk is usually associated with loss of revenue (due to fines and mitigation action) and loss of trust (from passengers, clients and municipalities).  Risks on hardware and software: Risks related to the manipulation or destruction of IPT components, hardware and software (see Section 3.1 Threats) impact the stability and availability of the IPT systems. This can lead to the disruption of services, inferior passenger and freight experience, loss of sensitive data and fraud.  Reliance on invalid information: The area of multiple interdependent systems is also becoming a more relevant source of concern as traffic operators become more interconnected with each other and with other smart operators. Using invalid information is a risk as it may limit the quality of the service.

text:  Lack of security of dependencies: The more IPT is moving towards “a system of systems”, the more important is to understand the dependencies among involved components. Hence, the output of individual vulnerability and risk assessments will depend on the particular mix of components, processes and infrastructure involved in a particular scenario. For example, with the increasing proliferation of mobile devices in traffic systems mobile security becomes another important component of the complex traffic infrastructure.  Unavailability of a dependency: The IPT service depends on several internal and external dependencies (e.g. power supply, mobile telecommunications…). Hence, the IPT service may suffer from the unavailability of a dependency and become unavailable.

text: 3.3.2 Societal risks

text: Similarly to business risk, societal risks are mainly triggered by the manipulation and destruction of IPT components (see Section 3.1 Threats).

text: Effective transportation systems are essential to European society: not only do they enable the mobility of citizens and goods, they also have significant impacts on economic growth, social development and the environment. Although the expectation is that IPT will cut costs, improve environmental quality and enhance traditional safety (i.e. by reducing road accidents), it could also amplify old and open up new societal risks.

text:  Unavailability of the IPT service: Given the nature of societal assets, these components tend to be integrated systems which are shared among multiple stakeholders. This amplifies the interdependency effect and consequently increases the risk that such events will lead not only to interrupted and disrupted transport services for a single IPT operator but also to the unavailability of transport systems (i.e. network gridlock) with consequent secondary effects for other sectors, and increases in traffic accidents.  Disruption to the society: The IPT service is used by citizens to carry out their daily lives. Incident on the transport system will bring disruption to the society with several impacts on the economy and the life of the citizens. In case of severe network gridlocks, societal financial losses and slower economic growth could also occur.  Passengers’ health and safety: Passengers safety in IPT is the priority of all actors. Yet, specific incidents may impact the transport system and bring a risk to health and safety (e.g. derailing train…). Furthermore, the international context has changed in recent years: the sustained threat from terrorism is real and needs to be accounted for when protecting IPT infrastructures.

text:  Environmental impact: The reliance on ICT assets to control energy assets (e.g. fuel, gas, electricity) may lead to increased energy consumption with an environmental impact. For example, vehicles may emit higher pollutants than their expected levels.  Confidentiality and privacy: The increased use of sensing, tracking, real-time behavior evaluation and automated decisions within IPT raises new risks against the confidentiality and privacy of citizens.

text: 3.4 Challenges

text: This section summarises eight identified key challenges facing cyber security within IPT. Challenges are identified based on criticisms and/or shortcomings of the existing status quo that were collected during the survey and the interviews with stakeholders.

text: While they are numbered 1 to 8 below, these challenges have not been ranked according to any measure of importance.

text: 3.4.1 Challenge 1: Difficulties to integrate security for safety

text: While there is a tendency in other contexts to combine safety and security into a single category, within transport these two concepts are traditionally very separate. Manufacturers and IPT operators usually prioritise the need for safety requirements, due to the fact that IPT operators experience difficulties in understanding the concept of (cyber) security, acquiring the necessary skills and developing the necessary measures to integrate security for safety in their systems.

text: 3.4.2 Challenge 2: Inadequate importance and spending being afforded to cyber security

text: A key finding from the survey and interviews (see Figure 7) indicates that transport organisations still do not grant the necessary importance to cyber security within their company. Spending on cyber security also appears to be inadequate in response to the range of multifaceted cyber threats affecting IPT.

text: 3.4.3 Challenge 3: Inadequate checking for countermeasures

text: The majority of transport organisations do not measure the effectiveness of their countermeasures (see Figure 8 below presenting findings from the survey and interviews). This in turn produces a lack of

text: awareness and knowledge in relation to what “works” and what “does not work” in cyber security for IPT. The question of measuring the value of security in a transport organisation is also important when security teams ask the business to invest in security. The inability to answer this question can often explain why the business is reluctant to invest.

text: 3.4.4 Challenge 4: Unwillingness to collaborate and exchange information on cyber security

text: Overall, transport organisations are less than willing to collaborate on and exchange information about cyber security with other industry players, most likely because of the reputational costs, competitive pressures and other indirect losses related to cyber crime. Additionally, they may not have implemented the necessary systems/measures to collect the necessary information to be shared (see Figure 9 below presenting finding from the survey and interviews). Furthermore, they also have low awareness of any collaboration and information-sharing activities pertaining to cyber security being carried out within the sector. However, operators are open to collaborate and exchange information with national Computer Security Incident Response Team (CSIRT) and Law Enforcement Agencies (LEA).

text: 3.4.5 Challenge 5: Slow phasing out of legacy systems

text: The existence and use of legacy systems can weaken cyber security. Legacy systems have security controls typically focused on the simple necessity of reducing the risk of physical product tampering or theft. However, the security and threat environment within IPT is beginning to shift towards connected transportation systems as they become increasingly interconnected to the wider world.

text: 3.4.6 Challenge 6: Inadequate data exchange between IPT and Smart Cities operators

text: Data exchanges between IPT and different Smart Cities operators (i.e. railways, LEA, local government, etc.) tend to be restricted, uncoordinated and ad-hoc. These interactions also vary depending on the context and/or business model adopted by the operators. The potential implications of this uneven data exchange include weaker security as threats are not being communicated and there is uncertainty over who is responsible for the security of individual components within systems that integrate multiple stakeholders.

text: 3.4.7 Challenge 7: Weak situational awareness of cyber threats

text: Due to the fast moving and interconnect nature of IPT, transport organisations are struggling to achieve a full awareness of the range of cyber threats and boundaries for securing the IPT landscape.

text: 3.4.8 Challenge 8: Resistance to security adoption

text: One finding from the field work indicates that some countermeasures are widely adopted even though they are not considered effective (e.g. monitoring ICT systems for hardware and software faults), while others that are considered effective are frequently not deployed (e.g. privacy-by-design, building-in redundancy and shut down procedures). This underlines a resistance to adapt within the IPT sector and a culture where things are done because operators are told to do them and/or have always done them rather than because they work.

text: 4. Good practices for securing intelligent public transport

text: This section sets out existing good practices for securing IPT networks as identified through both an analysis of existing good practice documentation complemented by interviews with a range of stakeholders, including; transport operators, Smart City municipalities, risk managers and cyber security experts. By good practices we are referring to effective security measures that should be implemented if they address weaknesses identified during a risk assessment of your business operation. The inclusion of these good practices reflects our intention that this study should operate as a practical guide for IPT operators, one that will assist in supporting their internal processes.

text: One point that must be remembered when considering the good practices discussed here is that this section only deals with existing good practices as identified during the desktop research and the survey and interviews. Gaps in the current suite of existing good practices are not addressed here, but are identified and discussed in Section 5.

text: This section provides a brief description of each individual good practice identified to secure IPT. They are presented and arranged into three categories according to their inherent nature:

text:  Technical good practices;  Policies and standards;  Organisational, people and processes.

text: These good practices are effective to counter threats before, during and/or after an attack. For more information, Annex 4 details these good practices by presenting them as a checklist to assist stakeholders in their assessment and implementation.

text: 4.1 Technical good practices

text: Conduct security-focused risk assessments: Each operator should conduct regular risk assessments covering physical, cyber and information security that entail mapping the scope of their business operations, identifying the critical business functions, and then identifying the assets critical to these functions. Regular risk assessments are required to identify changes in the threat landscape and thereby ensure that the correct threats to the business are identified and efficiently addressed.

text: Employ appropriate physical security, access controls and protection measures: Physical security is required to protect both the physical and digital assets of an IPT network by preventing unauthorised physical access to sensitive locations, whether deliberate and unintentional. The nature of the physical security employed should be commensurate to the assets being protected (i.e. from simple locks for areas designated low risk/value to layered security, such as multi-factor authentication systems potentially combined with guards/CCTV, for high risk/value areas).

text: Employ secure digital access controls to networks and data: To complement physical security measures, IPT operators must ensure they employ robust digital access controls to their networks and stored data (whether in local servers or cloud-based) so as to prevent attackers accessing these via ICT due to the 69 70 prevalent of these attacks on both large and small businesses. Common measures include: firewalls; 71 72 password controls; multi-factor authentication; use of firewall based VPNs.

text: Employ alarms/surveillance for protecting physical and digital assets: Closely linked to the monitoring and recording of activity is the need to install alarms and surveillance systems across the cyber/physical network of an IPT operator to secure that network. Alarms and surveillance systems designed to focus the attention of operators on specific locales or events are necessary requirements. This is because the size and complexity of an IPT network distributed across a city demands the implementation of systems enabling a limited security team to effectively monitor the entire network.

text: Encryption: Operators need to ensure the confidentiality of sensitive data (e.g. customer/employee financial details, intellectual property, etc.) that they both hold (either internally or on external servers/clouds) and communicate across networks, due to the prevalence of cyber attacks. In effect, IPT operators should work on the assumption their digital systems will be successfully accessed by attackers. 73 74 To this end they should employ industry-recognised encryption standards, use VPNs, and if available make use of national cyber security agencies to guide on encryption methods.

text: Develop secure and private communication networks: Operators need to ensure the security of their communication networks and the privacy of the data traveling across these networks as they represent a target for attacker. As IPT communication networks include both physical and digital elements, a combination of protection methods are required, including; tamper-resistant devices, access controls, firewalled VPNs, encryption, message integrity provisions, network intrusion detection systems, etc.

text: Employ intrusion detection systems (IDSs): IDSs aid in monitoring a network to inform on internal and external attacks, malicious network communications and usage of computer systems. Common methods include anomaly detection and misuse (signature) detection. IDSs are needed to supplement firewalls

text: and virus scanners as there is no network security measure that will ensure perfect cyber security. Hence IPT operators should employ multiple protection measures through a defence-in-depth approach.

text: Employ identity management and authentication systems: To secure IPT requires restricting access to both physical spaces and digital networks, such that only authorised individuals can access these spaces. This requires the implementation of measures, such as multifactor (i.e. two and three-factor) authentication systems, for confirming that the person seeking access is who they claim to be. Additionally there is the need to link activity within a network to the identity of the actor to prevent repudiation: measures such as digital signatures, access controls, and audit trails should be employed here.

text: Integrate shut-down procedures/remote deactivation of capabilities, for assets: Malfunctioning, compromised or stolen assets may be in geographically remote locales on a transport network. To enable prompt reactions by IPT operators, the ability to either remotely shut-down or deactivate certain capabilities/functionalities of these assets can minimise damage/loss. Operators can use SCADA systems to issue such supervisory commands to field devices/assets.

text: Operate in degraded mode of operation: In case of a failure, the system might still operate at with a reduced level of service. In these conditions, the IPT system manages to ensure certain critical functions at a minimum level. For that purpose, IPT operators have to determine which key performance indicators can be relaxed until the normal service is recovered.

text: 4.2 Policies and standards

text: Employ security by design: Physical/cyber infrastructure should incorporate security requirements upstream during the engineering process to minimise the potential and impact of breaches. As per these requirement, employing security by design improves the security capabilities of products and helps mitigate the likelihood of the costly retrofitting of security protections.

text: Establish disaster recovery processes and maintain back-ups: It is imperative to develop and establish a disaster recovery processes, and to maintain back-ups of business data preferably in a remote secure location to minimising the likelihood of collateral damage. These actions acknowledge the reality that despite an operator’s best security efforts, it is inevitable that incidents will occur, whether through deliberate attacks, user errors, accidents and/or environmental incidents.

text: Define degraded modes of operation: The definition of degraded modes of operation contributes to enhancing the resilience of the IPT system by ensuring a minimum level of service. One of several degraded modes can be defined in function of the systems impacted and the dependencies identified. For example, degraded modes of operation are applied in air traffic management in order to ensure safety.

text: Implement an information security policy: An organisation’s information security policy sets their course for information security. It emphasises the need for information security to all staff members, and reflects the commitment of the organisation to operate in a controlled, secure manner and achieve information security. Failure to develop and implement an information security policy undermines the operator’s ability to focus their information security activities consistently across their organisation.

text: Forecasting, early warning systems and risk analysis: IPT operators possess finite security resources, hence it is essential they can direct these resources appropriately so as to maximise their impact. Knowing of, or predicting the risk of, threats in advance of their emergence enables the stakeholder to efficiently allocate their resources and to take pre-emptive steps to mitigate damages.

text: Separate critical systems from non-critical systems: Critical systems (i.e. those controlling steering, braking, etc.) should not be accessible though other non-critical systems installed within the same vehicle (e.g. information displays, entertainment systems, etc.). Successful attacks on critical systems in smart vehicles where access was gained through non-critical systems demonstrates the safety and security 83 84 imperatives of keeping these systems separate. Similarly, networks linking critical systems and/or those essential to the provision of critical services should be separated (either physically or virtually) from networks linking non-critical systems/services.

text: Enhance physical security protecting critical physical infrastructure: Risk assessments should be used to identify which infrastructure is critical to the IPT operator and, enhanced physical protection measures should be implemented as a result. Each operator will have their own unique assets requiring protection, and this two-step process ensures resources are allocated on an evidence basis.

text: Implement a security control centre with real-time monitoring: A centralised control centre for directing and coordinating security resources to respond to threats as they are identified enables the efficient allocation of resources, and provides a recognisable point of contact for liaising with LEA, CSIRTs and other Smart City stakeholders.

text: Ensure redundancy for critical systems: Building redundancy into critical systems reduces the likelihood that the failure of a single or small number of components, or an isolated incident within the network, will result in the failure of the entire network. While this good practice is applicable to all critical systems, two specific instances were highlighted by respondents as being particularly critical for IPT, these being; communication systems and power systems.

text: Create resilient communication systems: Communication systems are essential components of IPT systems with the integration of ICT into public transport defining IPT. At its extreme, the failure of the communication system will halt an IPT network, and these communication systems are susceptible to a multitude of physical and cyber attacks, acts of nature and environmental incidents. Hence it is essential to

text: build redundancy into IPT communication systems so no single failure will break the network. When public telecommunication networks are used, this resilience can be contractual if specified in the Service Level Agreement established with communication providers.

text: Create resilient power systems: IPT infrastructure (including some vehicles) require electricity to operate. Nevertheless, these power systems are susceptible to a multitude of physical and cyber attacks, strikes, acts of nature and environmental incidents which can lead to disruptions and outages. Hence it is essential to build redundancy into IPT power networks so that no single point of failure exists. This resilience can be contractual if specified in the Service Level Agreement established with power suppliers.

text: 4.3 Organisational, people and processes

text: Monitor and record activity: Operators need to implement technologies to monitor and record both physical activity at high value locations (e.g. CCTV, authentication logging, etc.) and digital activity (e.g. activity logs) on their networks as part of a cohesive Security Management System. These measures are required for multiple purposes including: ensuring safety, providing security, the gathering of forensic evidence, system recovery processes, training purposes, identifying insider threats, data for risk analyses, maintaining system stability, etc.

text: Define security requirements during procurement processes: During the procurement process “security” needs to be afforded the same importance as “functionality”. This enhancing of the status of security at this early stage is to decrease business risks posed by cyber and physical threats, and acts to mitigate the likelihood of the costly retrofitting of security protections.

text: Coordinate with LEAs and CSIRTs: IPT operators should coordinate with LEAs/CSIRTS. The level of coordination can include sharing threat/good practice information, developing and running online training programmes, and conducting live drills. This level of coordination is necessary as LEA/CSIRTs occupy privileged positions to see emerging and/or applicable threats from other stakeholders outside of IPT.

text: Raise awareness on cyber threats to all levels of staff including management: Cyber threats keep evolving at fast pace. It is important to raise awareness among staff by informing them periodically about current and top threats targeting IT systems and assets of the organisation. Highlighting security good practices to protect against these threats is also important. In order to improve the awareness level efficiently, all staff including non-technical staff and in particular management shall be informed. In particular, informing management on existing governance models is likely to help integrating cyber security in the organisation.

text: Engage in staff training: IPT staff are valuable assets for protecting the network against both physical and digital threats. They are also a potential source of threats to the network through accidently introducing viruses and malware, as spearfishing victims, etc. To maximise benefits and minimise risks, pre-emptive training programmes complemented by post-event training (to incorporate “lessons learnt”) are essential.

text: Develop organisational and operational procedures and guidelines: The development and implementation of operational guidelines and procedures should be integrated into the culture of an IPT via staff training. Without this process, good practices, lessons learnt from prior incidents and corporate knowledge cannot be retained and applied throughout an organisation in a systematic fashion.

text: 5. Gap analysis

text: This section provides an analysis of the main gaps in relation to cyber security in IPT as identified during the field work. Gaps were elicited from the comparison between the identified threats, vulnerabilities and risk, and good practices.

text: Gaps to be addressed are widespread and focused not just on technology but also on other areas, such as: organisational gaps, policy and standardisation issues, and the need to develop more comprehensive and integrated tools. This section summaries eight identified key cyber security gaps in IPT. While they are numbered 1 to 8 below, these gaps have not been ranked according to any measure of importance.

text: 5.1 Gap 1: Lack of a common EU approach to Intelligent Public Transport Security

text: There is currently no common EU approach specific to either intelligent or standard public transport, or related framework that specifically address IPT cyber security needs (see Section 2.2 for an analysis on EU legislation). Potentially the proposed NIS Directive might have an impact on addressing elements of this gap, above all in relation to cyber threat reporting, but may need to be expanded to encompass requirements for IPT cyber security within both urban transport networks and national/international rail networks.

text: 5.2 Gap 2: No integration of security in current EU guidelines for IPT

text: Although there are EU guidelines on cyber security, very little is specifically designed for intelligent transport. A gap here exists for EU common guidelines that deal more closely with intelligent transport above all in relation to enhancing the cyber security of IPT systems and the implementation of appropriate processes with a suitable cyber security focus. Furthermore, although some initial developments in relation to an EU-wide strategy for intelligent transport have been put in place in recent years, via the action plan for the Deployment of Intelligent Transport Systems in Europe and the Directive

text: requiring MS to develop their own strategy for implementing transport, these attempts do not focus on cyber security. Therefore there is still a gap in relation to comprehensive and integrated guidelines or strategies tailored to secure IPT from cyber threats. Such guidelines could define the action of different stakeholders involved on IPT cyber security (e.g. coordination, responsibilities…).

text: 5.3 Gap 3: Lack of common definitions and formalised cyber security policies

text: The field work indicates that definitions for IPT are not widely used or adopted (see Figure 10) within transport organisations. Furthermore, the majority of transport organisations do not have a formalised

text: cyber security policy in place and/or list of critical assets that need to be protected by cyber threats (see Figure 11). There is need for common definitions and the adoption of more formalised security strategies. This will lead to greater security and collaboration within and among transport organisations.

text: 5.4 Gap 4: Lack of corporate governance for IPT security

text: An effective governance framework for IPT security within organisations, setting out clear responsibilities and objectives is still missing. By allocating clear cyber security responsibilities with an organisation, this governance framework (covering common training programmes, the identification and advance warning of threats, support and advice, etc.) would also greatly facilitate cyber security collaboration between IPT and smart city operators on the one hand, and governments, LEA and national CSIRTs on the other.

text: 5.5 Gap 5: No specific security standards for IPT

text: There is a lack of specific security standards for IPT that can address the specific context and security threats faced by IPT assets. Generic standards, such as the ISO27000 series, are not sufficiently useful for the complex reality of IPT and are poorly related to the security environment within which transport organisations interact and operate today. It is important that standards are able to accommodate new IPT functionalities and concepts as they become relevant, while being able to remain dynamic, extensible and flexible.

text: 5.6 Gap 6: Lack of advanced interdependent analysis tools

text: Given the highly interconnected and complex nature of transportation networks, there is the need for more sophisticated analysis tools that can capture asset interdependence and cascade-effects among all

text: the involved assets and different stakeholders. These tools will help capture how interdependencies operate and will heighten impacts in order to develop procedures and policies to improve recovery.

text: 5.7 Gap 7: Lack of advanced risk assessment tools

text: Risk assessment methodologies that can deal with multiple networked stakeholders working in collaboration need to be developed. This requires a different mind-set for existing risk management approaches, which often begin by scoping a system (i.e. defining its borders) prior to a risk assessment based on the individual elements. However, in interconnected systems this clear border does not exist. To address this gap we need to redesign risk management systems/approaches so that they operate from a

text: stakeholder perspective rather than border perspective.

text: 5.8 Gap 8: Lack of advanced real-time and multi-stakeholder-enabled security technologies

text: Due to the number of networked technologies applied across the transportation systems, often belonging

text: to different operators and displaying multiple interdependence, there is a need for more advanced security IT infrastructures that allow for multi-stakeholder penetration testing, and provide real-time authentication among both trusted and un-trusted users in a multi-stakeholder environment.

text: 6. Recommendations

text: This final section of the study provides nine recommendations on how to enhance cyber security within IPT. Recommendations are directed towards different groups of stakeholders, specifically: decision makers; transport operators; and manufactures and solution providers. The recommendations try to accommodate both the rigorous requirements coming from the study and the more practical matters of short-range implementation by practitioners. Each recommendation draws upon the information and analysis presented in earlier sections and has been validated by a range of different stakeholders. Below each recommendation are brief explanatory notes.

text: Figure 12 summarizes the above mentioned challenges and gaps and allocates them across four areas:

text:  Gaps and challenges that are mainly related C5 to technology; C2  Gaps and challenges that are mainly related to organisation, people and process; C6  Gaps and challenges mainly concerning G7 G4 policy and standard; and G6 C4  Gaps and challenges concerning a mix of all G8 the previous areas (i.e. affecting all the previously mentioned areas).

text: Challenges Gaps

text: 6.1 For decision makers 6.1.1 EC and MS institutions should promote public/private collaboration on IPT cyber security at national level and EU-wide

text: This requires EC and MS institutions to actively promote greater collaboration, information exchange and knowledge on IPT cyber security across-borders via appropriate measures. For instance, this could take the form of establishing EU multi-stakeholder fora, engaging in regular consultations, conducting awareness campaigns, etc. The objectives of such initiatives will be: to set up cross-border and multi-stakeholder collaboration on cyber security; develop and implement awareness campaigns to educate end-users on risks in smart environments; and share best practices and information about cyber threats, attacks and cyber measures. Regarding this last objective, voluntary reporting of threat incidents to a trusted third party within the EU could be a viable tool for identifying and quantifying threat levels. At the moment in transport there is no real coordination on cyber security across national borders. This recommendation directly addresses challenges C4 and C7 as identified in Figure 12 above, while also having a positive impact on challenges C2, C3, C6 and C8.

text: 6.1.2 EC institutions and agencies should promote and facilitate the development of a common EU approach to IPT security

text: Relevant EC institutions and agencies (e.g. ETSI, CEN, CENELEC, ENISA, DG MOVE) must play an important role in facilitating and promoting integrated industry efforts via open IPT coordination initiatives, whereby standards and common guidelines tailored for cyber security in IPT are produced by interested parties across Europe through a transparent, open and consensus-based process. Transport operators, manufactures and vendors will be consulted in order to gain their support and buy-in for these new standards and guidelines. Existing initiatives on EC standards, led by ETSI, CEN and CENELEC , could be further developed and expanded to include wider participation from public and private partnerships, and/or industry stakeholders. In addition, the cross-exchange of knowledge and practices between transport and other sectors (e.g. telecommunication, finance, etc.) should be developed to leverage lessons learned and existing good practices. Taken together, these actions would enable the identification of common standards and guidelines for IPT in areas where these are currently less effective and mature (e.g. minimum cyber security requirements and good practices that should be in place; implementation of security by design; minimum security requirements for data exchange and collaborative IPT systems among operators, etc.). Such guidelines could be based on the work of ENISA and/or national CSIRTs. This recommendation directly addresses challenges C3-C8 as well as gap G2, while also having a positive impact on gaps G1 and G4-G7.

text: 6.1.3 EC institutions and agencies should develop a comprehensive EU strategy and framework for cyber security in IPT

text: This suggests that EC institutions should further develop the existing EU cyber security strategy and framework with a greater focus on IPT in order to provide a much more comprehensive, focused and integrated approach to IPT cyber security across Europe. This goes hand-in-hand with efforts to develop an ongoing dialogue with stakeholders to inform on policymaking and to ensure effective implementation of

text: the endorsed strategy. The anticipated NIS is an initial step in this direction and a building block for a comprehensive framework. This recommendation directly addresses gaps G1 and G8.

text: 6.1.4 EC and MS should integrate and converge security efforts made in other sectors of activity

text: IPT operators share similarities with other operators in the usage of systems (e.g. ICS/SCADA) and operations. Efforts have already been made in other sectors of activity to enhance their security (e.g. Smart Grids). In order to benefit from these existing efforts, Policy Makers from the European Commission and from Member States should assess which measures can be integrated to IPT. Moreover, it is important to converge the efforts when possible, through collaboration and experience sharing. This recommendation directly addresses gaps G1-G3 and challenge C6 and C8.

text: 6.1.5 EC and MS should foster the development of harmonised cyber security standards for IPT

text: The lack of a dedicated cyber security standard for IPT is an obstacle to the adoption of good security principles by IPT operators, manufacturers and solution vendors. With the support of the EC and MS, the industry (private and public sector) should ensure the development and adoption of harmonised standards adapted to the particularities. One or several completing standards could be developed to cover cyber security from various points of views (e.g. technical, organisational, validation of security practices, etc.) as it has been proposed in other domains (e.g. Smart Grids). This recommendation directly addressed gaps G1-G3 and challenges C1 and C3.

text: 6.2 For transport operators 6.2.1 IPT operators should integrate cyber security in their corporate governance

text: This leads transport operators to define the roles and responsibilities of top management as well as the integration of cyber risks into their budgetary, risk and project management operational processes. This does not necessarily mean that transport operators need to develop a new governance framework, but integraty cyber security roles into its current one. The objective is to integrate within the current framework the budget and responsibilities to meet cyber security objectives (e.g. training, awareness raising, acquisition, etc.). This recommendation directly addresses challenges C1, C2, C3, C4 and C8, and gaps G3 and G4.

text: 6.2.2 IPT operators should develop and implement an integrated corporate strategy addressing holistically cyber security and safety risks

text: This requires transport operators develop effective cyber security policies for cyber security in order to start formalising cyber security processes both internally and with the other operators they interact/collaborate with. The policy should also make clear the relationship between security and safety, the minimum security requirements for collaborative IPT initiatives with other operators and the need to report and exchange information and know-how on cyber security with relevant agencies and other operators. If transport operators do not have a clear policy spelling out their objectives for cyber security, and if a senior manager is not clearly responsible for the final outcome within the organisation(s) involved in sharing IPT infrastructures (i.e. responsible for management of the cyber risk), then this final outcome will not happen. This recommendation directly addresses challenges C1, C2, C4, C6 and C8, and gaps G6 and G7, while also having a positive impact on challenges C5 and C7.

text: 6.2.3 IPT operators should implement risk management for cyber security in multi-stakeholder environments including external contractors and dependencies

text: This entails that transport operators should have tailored risk management processes in place for cyber security which involve all the relevant participating operators and are integrated into their corporate risk frameworks. These processes shall also include external contractors that interact with the IPT operators.

text: This will improve standardisation and consistency on how to manage cyber security risks within all the participant organisations, while supporting managers with cyber security responsibilities in doing their jobs. Transport operators should also think of involving other external stakeholders, such as end-users and civil society, as part of their approach to managing cyber risk. These external stakeholders could bring valuable, external insights and a customer or citizen point of view, which are necessary for the effective management of cyber risks. This recommendation directly addresses challenge C7 and gaps G3 and G4, while also having a positive impact on challenge C4.

text: 6.2.4 IPT operators should clearly and routinely specify their cyber security requirements

text: This suggests that transport operators should routinely and clearly specify their cyber security requirements for all their transports initiatives and projects as part of their risk management processes. Such activities should not be “one-off events”, rather they should be a part of regular cyber security reviews. These cyber security requirements can then be incorporated into the beginning of project-cycles through the use of security by design. They also provide a guide for enhancing the cyber security of future infrastructure developments when planning the phasing-out of legacy systems. This recommendation directly addresses challenges C5 and C8.

text: 6.2.5 IPT operators should annually review organisational cyber security processes, practices and infrastructures

text: This suggests that transport operators should check and review their internal processes, practices and infrastructures for cyber security every year as part of the organisation’s corporate review and performance management procedures. It also feed into the goal of creating/strengthening a cyber security practice knowledge base among IPT stakeholders. This annual review should be done in parallel with the review of overall risk management procedures. Senior managers discuss and assess how well the organisation has performed in relation to its cyber security objectives, and assess whether the implemented cyber security processes, practices, training, infrastructures and tools have been adequate. This review provides a systematic and periodic process for assessing the organisation’s cyber security performance in relation to certain pre-established criteria and organisational objectives, while identifying needs for further enhancement and next steps. This recommendation directly addresses challenges C3, while also having a positive impact on challenges C5 and C8, and gaps G3-G5.

text: 6.3 For manufacturers and solution providers 6.3.1 Manufacturers and solution providers should create products/solutions that match the cyber security requirements of IPT end-users

text: Manufacturers and providers should increase their collaboration with end-users in relation to R&D, while aligning their solutions much more closely to the cyber security requirements, needs and affordability concerns of end-users. Solutions should be specifically tailored to address both existing gaps and the needs of end-users that the end-users themselves have identified via their own risk analyses (examples here may include; the development of advanced interdependent analysis tools, improving real-time capabilities, developing advanced risk assessment tools that can operate in multi-stakeholder environments, and technologies that enable security). Products should also be developed by employing security by design principles including; defence in depth, separation of privilege, securing the weakest link, promoting privacy, etc. At the moment solutions tend to be too general and do not reflect the contextual reality of IPT offerings. This recommendation directly addresses gaps G3-G5.

text: 6.3.2 Manufacturers and solution providers should collaborate in the development of IPT-specific standards and apply them to IPT solutions

text: This recommends that manufacturers and providers should collaborate in the development of security standards tailored for IPT by participating in open IPT coordination initiatives (see recommendation in Section 6.1.2), while also meeting all applicable EU and international standards in the development of their products and solutions (e.g. ETSI, Intelligent Transport Systems (ITS); Security; Security header and certificate formats, 2015 and US government, Federal Information Security Management Act - FISMA, 2002). This recommendation directly addresses gap G2.

text: 6.3.3 Manufacturers and solution providers should develop a trusted information sharing platform on risks and vulnerabilities

text: A trusted information sharing platform offers the possibility to its participants to exchange knowledge on risks and vulnerabilities. The trust aspect of such platform is necessary to ensure good participation, as it constitutes an incentive to share about incidents and solutions. For Intelligent Public Transports, it is recommended that manufacturers and solution providers participate to the development of such a trusted information sharing platform. The objective is to understand existing vulnerabilities in IPT systems, the risks associated to IPT as well as to promote possible solutions in order to improve the readiness level of the participants. This recommendation directly addresses challenges C4 and C7 as well as gap G3.

text: 6.3.4 Manufacturers and solution providers should provide security guidance for your systems, products and solutions

text: IPT operators who integrate new systems needs guidance to do it securely. Manufacturers and service providers should provide security guidance to describe proper procedures and parameters for secure configuration, operation and maintenance. Such guidance should lead IPT operators to improve their awareness and clarify liabilities. For instance, one possible guidance regarding patch management could explain the consequences on patching systems in relation to compatibility and availability. This recommendation directly addresses challenges C6 and C7 as well as gaps G6 and G7.

text: Annexes

text: A.1 Key EU legislation and policy/strategy documents affecting IPT

text: Table 3 describes the legislation and policies that combine to form the legal and policy environment governing IPT at the EU level.

text: A.2 Top critical functions, assets, and threats identified for Intelligent Public Transport

text: Table 4 below lists the critical societal/business functions, assets and threats identified for IPT during the survey and the interviews. While all of these functions, assets and threats are to be treated as critical they have also been ranked by the end-users who have participated in the stocktaking and may be subjective.

text: A.3 Threats to individual assets

text: Table 5 below associates the threat groups and individual threats to all assets functions.

text: A.4 Reference guide for applying good practices to Intelligent Public Transport

text: Table 3 provides a reference guide of the current good practices identified for IPT whereby the practices are described according to both the business/societal functions identified in Section 2.3, and the different threat groups identified in Section 3.1.1. In addition these good practices are assessed according to when they should be applied using the following three categories:

text:  Pre-attack good practices: Focus is on identifying threats to, and weaknesses within, an IPT network and increasing the preparedness and resilience of that network prior to attacks such that threats can be reduced or even negated.  During attack good practices: Focuses on both measures that will enable the operator to identify that an attack is occurring, as well as measures to be implemented once an ongoing attack is detected so as to halt and/or mitigate the consequences of that attack.  Post-attack good practices: Focuses on system monitoring practices that will enable the operator to identify that an attack has occurred, returning the network to its pre-attack state, gathering evidence on the nature and perpetrators of the attacks, and identifying lessons-learnt for improving the security of the network to resist future similar attacks.

text: Technical good practices Policies and standards Organisational, people and processes A.5 Survey questions

text: The following are the survey questions used for the initial elicitation of information on cyber security within both IPT and Smart Cities.

text: Organisational description

text: 1. What organisation are you affiliated with?

text: 2. What is your role within this organisation?

text: 3. Which of the following sectors does your organisation belong to? (select one option and include any additional details if requested)  Professional organisation (please specify)  Public transport operator (which mode(s) of public transport: metro, bus, light-rail, tram, other?)  Vendor (please specify primary area)  Service provider (please specify service area)  Manufacturer (what products do you manufacture?)  EU level organisation/representative (please specify: e.g. policy maker, regulator, elected representative, administrative authority, etc.)  Member State level organisation/representative (please specify: e.g. policy maker, regulator, elected representative, administrative authority, etc.)  Local government (please specify area of control: e.g. single-city municipality, district, region, etc.)  Academia/research (please specify: e.g. university, research centre, think-tank, etc.)  Civil society (please specify)  Other (please specify)

text: 4. Please state which country your organisation is based in, or if multi-national/EU-wide, please describe this here:

text: 5. Please state the Smart City your organisation operates in/has responsibility over, also indicating the size of that city using the following scale ≤500k = small, 500k<1,000k = medium, 1,000k+ = large. If you operate in multiple Smart Cities, choose up to 5 for inclusion here.

text: 6. What is the size of your organisation?

text:  1-9 employees/members  10-49 employees/members  50-249 employees/members  250+ employees/members

text: General attitudes to Smart Cities and Intelligent Public Transport

text: 7. In your experience how important are each of the following components for making a city “smart”?

text: (please rate all of the following components as either: not-important / low-importance / mediumimportance / high-importance / crucial)  “In-the-field” and physical infrastructures  Data collection and processing  Connectivity and digital networking  Data exchange/collaboration  Smart applications  Analytics and new knowledge extraction

text:  Mobile and virtual technology  Multichannel platforms  Cyber/network security  Human infrastructure  Social capital  Integrated services  Smart services  Personalised services  Business-citizen collaboration  eGovernance activities  Government smart city policies  Smart city legislation  Clear vision/objectives for the future  Other (please specify the component)

text: 8. Does your organisation engage in and/or enable Smart City collaboration in the following forms (yes/no/don’t know):

text:  Across sectors? (please name the sectors)  Between multiple Smart Cities? (please name the cities)  Across national borders (please name the countries)

text: 9. Does your organisation have or use a definition for “intelligent transport”?

text:  Yes (please provide this definition)  No  Don’t know

text: Data flow via Information Technologies in Smart Cities

text: 10. Based on your experience, in order for Intelligent Public Transport to operate effectively within a Smart City which of the following aspects of Smart Cities should be linked with Intelligent Public

text: Transport? (please indicate as many as you consider relevant)  Financial/banking components  Energy  Health systems  Public safety components  Logistics  Retail  Water/wastewater  Telecoms  Traffic lights and other traffic-flow systems  Other (please specify aspect)  Don’t know

text: 11. Does your organisation either exchange data with other operators, or recommend the exchange of data between operators, to support Smart Cities?

text:  Yes - If “yes” what data does your organisation exchange/recommend to be exchanged and with whom? Please specify the nature of this data (e.g. traffic data, ticketing data, financial transaction data, etc.) and recipient of this data (e.g. public transport operators, governments, service providers, etc.)

text:  No - If “no” what are the key reasons/inhibitors that are preventing your organization from exchanging/recommending the exchange of this data? (for example are they - technological constraints (please specify), financial costs (please specify), legal reasons (please specify), security concerns (please specify), trust concerns (please specify), organisational constraints (please specify), resource constraints (please specify), other (please specify))  Don’t know

text: 12. In relation to the exchanging of data within Smart Cities:

text:  Are there specific technology(s) you use or recommend be used to facilitate the exchange of data within Smart Cities? (please specify what these technologies are)  Are there specific process(es) you use or recommend be used to facilitate the exchange of data within Smart Cities? (please specify what these processes are)  Are there specific standard(s) you use or recommend be used to facilitate the exchange of data within Smart Cities? (please specify what these standards are)

text: 13. From the list provided, which of the following components of a Smart City’s architecture would your

text: organisation be most likely to either integrate with, or recommend that they be integrated? (please select as many options as are relevant)  Data and data storage layer  Software/applications  Business processes/service delivery  System networking  Sensors and other monitoring devices  Physical infrastructure  Operating system  None - we do not integrate  Don’t know

text: 13.1 Please provide details about the specific nature of any component integration you selected from the list in Q.13 above

text: 14. From the list provided, which of the following components of Intelligent Public Transport would your

text: 14.1. Please provide details about the specific nature of any component integration you selected from the list above

text: Legislation

text: 15. Are you aware of any specific pieces of legislation that apply to Intelligent Public Transport?

text:  Yes (please list this legislation)  No  Don’t know

text: 16. Does your organisation either have a documented cyber security policy in place for Intelligent Public Transport, or recommend to others that they should implement one?

text:  Yes  No  Don’t know

text: 17. Within the context of Intelligent Public Transport, does your organisation have or use a definition for “critical assets” (either business critical or societal critical)?

text:  Yes (what is this definition?)  No  Don’t know

text: 18. Specifically in relation to Intelligent Public Transport, which of the following are critical assets that your organisation either includes in its own cyber security policy/procedures, or recommends others to

text: include in their cyber security policy/procedures? (select as many as are relevant from the list provided)  Data  Data storage systems/facilities  Hardware  Software/applications  Operating systems  Sensors and detectors  Physical infrastructure  Networking and communication components  Human-machine interface devices  Traffic management applications  Trackside equipment  On-board equipment  Payment systems  Identity management and authentication systems  Cloud-based services and platforms  Others (please specify what these “other” critical assets are)  Don’t know

text: 19. From a societal perspective, what are the critical assets that need to be protected? (please specify up to 10 assets)

text: 20. What are the key threats to cyber security within Intelligent Public Transport your organisation has

text: experienced and/or identified? (Please indicate as many options as are relevant from the list provided)  Distributed denial of service attacks (DDoS)  Manipulation of hardware and software  Manipulation/insertion of information  Eavesdropping  Traffic analysis  Malware and viruses

text:  Data breaches  Insider attacks  Exploitation of software bugs  Abuse of authorisations  Generation and use of rogue certificates  Abuse of information leakages  Identity theft  Natural disasters  Accidental disclosure  Configuration errors  Hardware/software failure  Distribution/disruption problems for electrical supply  Vandalism/civil disorder  Other (please specify)

text: Security measures

text: 21. Does your organisation either allocate, or advise others to allocate, some of their IT budget to cyber security for Intelligent Public Transport

text:  Yes (What percentage of your organisation’s IT budget is spent/recommended for cyber security? Less than 2%; 2-10%; 11-25%; Greater than 25%; Don’t know)  No  Don’t know

text: 22. What would you regard as the main motivators driving cyber security expenditure in the Intelligent

text: Public Transport context? (Please indicate as many options from the list provided as required to answer this question)  Protecting non-physical assets (Please specify these assets)  Improving efficiencies/reducing-costs  Enabling business opportunities  Protecting intellectual property  Business continuity in a disaster situation  Protecting customer information  Preventing downtime and service outage  Compliance with regulation/legal requirements  Protecting an organisation’s reputation  Maintaining data integrity  Protecting privacy/maintaining confidentiality  Protecting physical infrastructure  Other (Please specify)  Don’t know

text: 23. List the key measures either your organisation has implemented, or recommends that others

text: implement, in order to protect Intelligent Public Transport from cyberattacks. This can include technical measures, processes and policies implements, organisational structures and roles, standards, and any other measures. For each measure listed please rate how effective you believe these measures to be (please list

text: your measures and for each rate their effectiveness using the following scale: ineffective; low-effectiveness; high-effectiveness). List as many as appropriate.

text: 24. Does your organisation engage in or regulate the exchange of information related to cyber security?

text:  Yes, through mandatory reporting regulation (Specify the legislation – or state if not known)  Yes, on a voluntary basis  No, but we plan on doing so  No  Don’t know

text: 25. How does your organisation go about measuring or benchmarking the effectiveness of cyber security

text: measures? (Please select as many responses as are relevant from the list provided)  By measuring trends in security incident costs  By benchmarking against other organisations  By conducting a return-on-investment calculation  By measuring staff awareness  By relying on certification  By conducting risk analyses  By monitoring levels of regulatory compliance  Through feedback from management  Through other formalised processes (Please specify)  Through the mandatory or voluntary collection of incident data  By relying on the advice of third-parties such as law enforcement agencies, CSIRTs, etc.  Through stakeholder feedback  We don’t formally evaluate/benchmark the effectiveness of our cyber security measures  We do not employ any cyber security measures  Don’t know

text: 26. How has your organisation responded to, or recommended how others should respond to, previous

text: cyberattacks on Intelligent Public Transport (please select as many responses as are relevant from the list provided)  Through additional staff training  Through additional vetting of staff/contractors  By changing the nature of business carried out  By making changes to policies and procedures  Through the deployment of new technologies  By taking disciplinary actions  By undertaking a formalised incident review

text: ENISA

text: Athens Office

text: 1 Vass. Sofias & Meg. Alexandrou Marousi 151 24, Athens, Greec

text: PO Box 1309, 710 01 Heraklion, Greece ISBN: 978-92-9204-146-5 doi:10.2824/778225 Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu