Safety & Security Principles for Railway Automation

Safety & Security Principlesfor Railway AutomationProf. Dr. Jens Braband

siemens.com/mobility© Siemens AG 2017

© Siemens AG 2017November 17Page 2 Mobility Division / Mobility Management

Agenda

Short introduction to Railway Automation

Some stories…

So what’s the problem?

Eight Safety and Security Principles

Conclusion


… has, as a leadingmanufacturer in thefield of mobilitysolutions, a uniquerange of integratedtechnologies forpassenger mobility andcargo logistics.

… generates newrevenue and savingspotential for cities andcommunities by meansof flexible road usagefees and operatormodels for trafficmanagement andservices.

… combineshardware, softwareand services to forminnovative products,systems and solutions– from componentsthrough to completeturnkey solutions.

… optimizesinfrastructures for railand road by means ofautomation,digitization andelectrificationthroughout the entirevalue chain.

… offers newtechnologies forsustainable mobilityand logistics, e.g.Controlguide Dispolino,Trackguard Sinet oradaptive, environment-oriented road trafficcontrol, achievingsignificant energysavings.

Siemens Mobility Management

Copyright: Siemens AG / © 2014 Google-Map data © 2014 GeoBasis-DE/BKG (© 2014), Google


Siemens Mobility ManagementKey Facts

Austin

Pittsburgh

New YorkNovatoLouisvilleMarionJacksonville

London

PooleChippenham

Caracas

São PaoloMidrand

Singapore

Mumbai

Dubai

BeijingX'ian

RouibaMadrid

Wallisellen

Ankara

Vienna

Zilina

Lisbon

Châtillon

AugsburgBerlinBraunschweig

ErlangenHamburgMunich

BrisbaneMelbourneEmployees: 12,200

Headquarter: BerlinHeadquartersSegment headquartersLocation

Brno


Portfolio OverviewRail Automation

Mainline Mass Transit Freight & Products

Operations control and safetysystems as well as products formonitoring and controlling to ensuresafe and efficient long-distance railservices

Automatic train control systemsand signaling products monitor allvehicle movements to make masstransit operations efficient andcost-effective

Rail Automation solutions for thespecific needs of yards andindustrial, mining and freight trainsto ensure a just-in-time delivery


Passenger information system CCTV

Operations control center

LED signal

Train control system

Access pointPassenger announcement

CBTC system

Rail AutomationMass Transit


Some recent railway news stories …

• German TV broadcasted a demo by a hacker who claimed he could hack the automated metro system inNuremberg [BR].

• An IT consultancy reported that they registered about 2.7 million access attempts to a honeypot lookinglike a railway control system within six weeks [KORAMIS].

• A scientist said to be a government adviser claimed that ERTMS might be endangered by cyber threats,in particular malware [BBC].

• On October 4, 2015, a fire completely destroyed an interlocking at Mülheim/Ruhr station in Germany,leading to severe service disruptions in the Ruhr area expected to last more than six months [DIE WELT].

• Many railway operators try to enhance their service by predictive maintenance collecting data from thesystems in the field 24/7 [IET].


What’s the problem?

If it’s not secure, then it’s probably not safe! (DoT, UK)

Safety and Security have

• complementary goals• different regulatory authorities• different terminology• different communities• different standards• ….

Thilo Parg / Wikimedia Commons

Lizenz: CC BY-SA 4.0


What‘s in and what‘s out…

9


Principle 1: Safety and Security are different and should be treated as such

Some proposed distinctions• benevolent ↔ malicious• danger to the environment ↔ threat from the environment• unintentional ↔ intentional• slow changes ↔ rapid changes The safety

expert…

… and thesecurity

expert


Principle 2: Security shall protect essential functions incl. safety

1. Security approaches need to be holisticand realistic to be successful.

2. Security provides an environment in whichessential functions are not adverselyaffected.

3. Safety evaluations are based on theassumption of effective security measures.

Security protectedenvironment

EssentialFunctions

and SafetyFunctions

Vulnerability

Operation environment

Defense-in-depth is advised.

The weakest link in the chain matters…

Organizational, physical and ITdefenses need to be coordinated.


Principle 3: Seperate Security and Safety as far as possible …

Safety

Impact on:• Physical harm to

humans• Environment

Transparency on:• Methods• Measures• Defects

Rather static field

Foreseeable misuse

Security

Impact on:• Availability• Integrity• Confidentiality

Confidentiality on:• Methods• Measures• Vulnerabilities

Highly dynamic field

Intentional andunintential manipulation

Criminal intent

More items of separation:

• Different experts and methods• Different processes and timelines• Different laws, technical reguations and

standards


… but coordinate them effectively

Safety DomainSafety Management

Safety Risk Assessment

Analysis related to:• Physical harm to humans• Environment

Identified Safety Measures

SafetyDesign

Security DomainSecurity Management

Threat-risk Assessmentrelated to:• Availability• Integrity• Confidentialityalso with impact on Safety

Identified Securitycountermeasures

SecurityEnvironment

support by Safety Expert

Conflict Resolution & Compatibility

Reference to other domain


Principle 4: Security shall be evaluated based on international standards


Additional Technical Principles

Principle 5: Threat & Risk Analysis is the interface to Safety Analysis• Safety Analysis is concerned with the proof that Security cannot impact Safety Functions• Safety should only reference adequate Security Standards• Safety can rely on appropriate Security Certificates

Principle 6: It is impossible to evaluate Security Risk probabilistically• Security attacks have a systematic nature, there are no laws of nature behind• Security should be treated qualitatively similar to SW faults in Safety

Principle 7: Safety and Security Target measures shall not be coupled• There is no intrinsic relation between Safety Integrity Level (SIL)/Performance Level (PL) and Security Level(SL) /Protection Level (PL)• Nevertheless Safety Functions can support Security as part of Defense-in-depth


Principle 8 (last but not least): Security is a collaborative continuous effort


Conclusion: Security principles have to become part of our DNA

• Safety and Security have to beseparated as far as reasonablebut need effective coordination

• Adequate level of integrity,availability, traceability andconfidentiality is needed fromSecurity environment

• Products, systems and serviceshave to be developed and usedin accordance with the applicablelegal and normative standards

• IT security has to be reflectedholistically in all relevantprocesses and supported byadapted procedures and tools byall stakeholders


Thanks for your attention! Questions?

Prof. Dr. Jens Braband

Siemens AGMobility DivisionMobility Management

Ackerstr. 2238126 BraunschweigGermany

E-mail: [email protected]

Documents

Safety & Security Principles for Railway Automation