Keeping the Supply Chain on Track
Supply chains—the vast networks that move products and raw materials from supplier to manufacturer to distributor to consumer—can be, like many other ecosystems, both robust and supremely fragile.
Recent disruptions to supply chains caused by the COVID-19 pandemic and other factors have prompted trillions in revenue losses alone.
Cargo ships, trucks, and freight trains are vital to countless supply chains for moving goods efficiently. But as they become increasingly digitized and connected, their attack surfaces expand, making these critical systems far more vulnerable to potentially crippling cyber-attacks—strikes that can easily cascade down the supply chain, with potentially dire consequences.
Cargo ships, trucks, and freight trains are vital to countless supply chains for moving goods efficiently.
Freight rail is no exception to this rule. Indeed, a variety of attacks to freight infrastructure took place in 2022, including physical damage to northern Germany’s Deutsch Bahn GSM-R communications infrastructure by unknown entities, a cyberattack that halted train operations for several hours in Denmark, and the cyber breaches that ultimately damaged some of Belarus’s rail control systems in an attempt to slow Russian troops’ invasion of Ukraine—to name a few.
The latest averted rail strike in the United States highlights the sheer economic importance of uninterrupted rail freight systems. Just one day of such a strike would have brought 7,000 fully packed freight trains to a halt, amounting to an estimated $2 billion in lost output per day.
In light of the growing number of such attacks and their potential consequences, it is more important than ever that the cybersecurity of our rail freight systems continues to be bolstered. The need for strong, proactive cybersecurity solutions that detect vulnerabilities before they’re adversely exploited is—and will continue to be—imperative.
Staying on Track
To achieve this will require uniquely tailored solutions, updated regulations, and widespread industry collaboration. The good news is that, according to a survey by McKinsey, 93 percent of supply chain executives are actively taking steps to reinforce supply chain resiliency. These measures include “building in redundancy across suppliers, nearshoring, reducing the number of unique parts, and regionalizing their supply chains,” according to the survey.
One key move towards achieving such a goal is tailoring cybersecurity measures to fit specific transportation systems. Generic cybersecurity systems that alert rail operators to vulnerabilities that require patching or that necessitate shutting down systems to implement damage control are proving cumbersome, expensive, and impractical. A one-size-fits-all approach to cybersecurity does little to ensure the continuity, safety, and reliability of rail systems’ information and operational technology (IT and OT) systems.
93 percent of supply chain executives are actively taking steps to reinforce supply chain resiliency.
Governments worldwide are doing their part by continuing to mandate stricter cybersecurity regulations and requiring they be assessed and updated on an ongoing basis to keep up with increasingly sophisticated and networked hackers. In 2022, for example, Europe bolstered its cybersecurity regulations with a second set of Network and Information Systems requirements, and the United States published a second set of Transportation Security Administration security directives.
With the threat landscape evolving alongside advances to rail systems, supply chain leaders and rail executives alike should continue to collaborate closely to share best cybersecurity practices. As the saying goes, “two heads are better than one.” All relevant parties need to continue to be on the same page, particularly when it comes to alerting others to potential threats and informing new rail system tenders.
A Group Effort
Supply chain infrastructure is critical to the economy. It only takes one precise attack to trigger a costly disaster. Threat actors have proven their in-depth knowledge of rail systems and their vulnerabilities, and will no doubt continue their malicious cyber campaigns. These emerging cyber-risks are pointing to the dire need for top-notch cybersecurity protections specifically tailored to the rail industry. No one industry player or government agency can shoulder this task alone.
Miki Shifman is the co-founder and chief technology officer at Cylus, a global leader in rail cybersecurity. Shifman is also a member of the World Economic Forum’s Future of Mobility & Cybersecurity Expert Network. Prior to co-founding Cylus, Shifman served as a cyber researcher and an R&D leader in the Cyber R&D Division of the Israel Defense Force’s Elite Technological Unit. He led teams awarded the Israel Defense Prize for exceptional technological breakthroughs and received high military honors for extraordinary achievement and exceptional contributions to national security.
© 2023 Cylus Cybersecurity
