Cybersecurity of Railway Control Systems Fred Woolsey LTK Engineering Services David Teumim, CISSP Teumim Technical, LLC
About the Speakers Dave Teumim Fred Woolsey CISSP (Certified Information System Security Professional) BS in Electrical Engineering, MEng in Systems Engineering MS in Chemical Engineering Chair of IEEE RTVISC Working Group 9 Author of book Industrial Network Security published by ISA Independent Consultant 30+ years in railway industry with LIRR, ABB/Adtranz, LTK Member IEEE, ISA, ACM 2
Introducing Rail Transit Transport passengers, not goods Usually run by public agencies Freight railways transport goods Usually privately owned Other transportation modes Air Highway Shipping 3
Types of Rail Transit Commuter Rail Light Rail Heavy Rail (Metro) (Light Rail Image Courtesy of Houston Metro) 4
Railway Control Systems Use: SCADA PLC s Fieldbus Sensors (speed, pressure, temperature), actuators (motors, valves), Windows XP; embedded on locomotives and coaches, Windows workstations in control centers Vital = Intrinsically Safe (signaling, interlocking, train control) 5
Example Light Rail Control System OCC Ethernet configuration Router Router Hub S O N E T Hub Hub Hub Hub Hub Hub Hub SIH1 FANNIN SIH2 GEENBRIAR ST. SIH3 GALEN SIH4 MAC GREGOR SIH5 WICHITA ST. SIH6 ALABAMA ST. SIH7 PIERCE ST. SIH8 FRANKLIN ST. Switch TPSS DP slaves TPSS DP slaves TPSS DP slaves TPSS DP slaves TPSS DP slaves TPSS DP slaves TPSS DP slaves TPSS DP slaves provided by TPSS Ethernet IEC 104 on TCP/IP connection Ethernet TCP/IP connection Profibus DP connecetion TTY Point to Point connection communication house RTU distributed I/O equipment (if necessary) DP/DP coupler TWC equipment TPSS PLC equipment (Network Diagram Courtesy of Metro) 6
Do These Names Sound Familiar? Rail control system vendors include: Siemens Invensys GE Rockwell Automation 7
What are Areas for Applying Control System Security? Wireless (Computer Based Train Control) Wireless (Telemetry) Networked Ticket Vending Machines SCADA (electric traction, signals) Control system/enterprise connections 8
Introducing APTA Primary Industry Organization for Rail Transit 1,500 Member Organization Members Serve More Than 90% Of Public Transit Riders In U. S. And Canada Provide Services To Members That Create A Safer And More Secure Environment For Public Transportation Riders, Workers And The Public At Large. 9
APTA Industry Activities Standards committees Technical forums Conferences and exhibitions 10
Rail Transit Communication Links Commuter Rail Wayside Signaling Highway-Rail Traffic Control Light Rail Control Centers Travelers and Stations Bus Shops 11
Wireless (Telemetry) 10.1.0.0 RADIUS Server Ground Station Server Home Agent NJT WAN Intranet Clients Internet Clients 10.2.0.0 Internet Access Point with Proxy Mobile IP Mobile Node Authoritative Access Point with Proxy Mobile IP Foreign Agent 10.3.0.0 Foreign Agent Authoritative Access Point with Proxy Mobile IP Access Point with Proxy Mobile IP Mobile Node 12
Wireless (CBTC) NYC Transit Canarsie Line SF Muni Light Rail Detroit APM London Docklands (IL In Service) Lyon Line D Malaysia Kuala Lumpur Putra Line (In Service) JFK - Airport (IL-in service) SF BART (RF-under development) Toronto Scarborough Line (IL in service) London Jubilee & Northern Lines Paris Line 13 (RF under Development) Hong Kong West Rail (IL in Service) Long Island Railroad SFO Airport (RF- in service) Vancouver SkyTrain (IL- in service) London Heathrow Airport (Recent Award) Paris Line 14 (IL in Service) Ankara ARTS (IL-in service) Washington DC APM at Dulles (RF being deployed) Las Vegas Monorail (RF in Service) Barcelona (RF-recent award) Singapore North East Line URBALIS 300 (RF in service) Philadelphia Subway Surface Line (RF- nearing deployment) Paris Lines 3/4/9/10 /12 "OURAGAN" Hong Kong Penny's Bay (RF - nearing revenue service date) Dallas Ft.-Worth Airport (RF recent award) Madrid (Recent Award) Wuhan Mainland China LRT Line (IL in service) Seattle (Airport) (RF being deployed) Budapest Taipei Neihu Line (RF awarded) 13
Vulnerabilities Rogue Client Point of Attack: Denial of Service Attack Publicly Accessible Not Publicly Accessible NJT WAN Packet Flood Ticket Vending Machines Ticket Vending Server 14
Railway Age Magazine First Article on Rail Control Security January 05 Railway Security Conference January 06 Railway Security Conference 15
Collaboration with the PCSF Community Technical Interchange Wireless Issues/Technology hot area Transportation potential market area for new control security technologies 16
Contact Information Fred Woolsey LTK Engineering Services 215-641-8865 fwoolsey@ltk.com Dave Teumim Teumim Technical, LLC 610-398-5546 dave431@enter.net 17