{"id":74824,"date":"2026-06-09T09:05:43","date_gmt":"2026-06-09T08:05:43","guid":{"rendered":"https:\/\/www.systra.com\/uk\/?post_type=expert_insights&p=74824"},"modified":"2026-06-09T09:07:57","modified_gmt":"2026-06-09T08:07:57","slug":"beyond-safety-addressing-the-security-gap-in-railway-software-standards","status":"publish","type":"expert_insights","link":"https:\/\/www.systra.com\/uk\/expert_insights\/beyond-safety-addressing-the-security-gap-in-railway-software-standards\/","title":{"rendered":"Beyond Safety: Addressing the Security Gap in Railway Software Standards\u00a0"},"content":{"rendered":"\n

The railway industry\u00a0operates\u00a0under strict regulations, with software solutions expected to meet both safety and security requirements. While considerable focus is placed on safety-critical software, it raises the question: is security given equal priority? How is the industry managing the \u201celephant in the room\u201d,\u00a0tackling the significant challenge of bridging gaps in software standards and best practices related to security?\u00a0Lucia Capogna<\/strong>, our\u00a0Cyber Security and Software Assurance Team Leader,\u00a0sets\u00a0the scene and examines\u00a0the current landscape surrounding these issues.\u00a0<\/strong><\/p>\n\n\n\n

<\/div>\n\n\n\n

Digitalisation\u00a0has been introduced exponentially across railway solutions in recent years.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

The prevalence of this\u00a0new technology\u00a0means the rail network is more flexible and\u00a0inter-connected. Railways are more advanced than ever before \u2013 they are easier to enhance and customize and more responsive to sub-system failures.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

But with this digital evolution comes new and diverse risks that evolve over time \u2013 particularly\u00a0in regard to\u00a0cyber security.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

What are the threats to the railway from\u00a0cyber security?<\/strong>\u00a0<\/h3>\n\n\n\n
<\/div>\n\n\n\n

The digital risks for the railway are higher than they\u00a0ever have\u00a0been.\u00a0They are\u00a0dangerous,\u00a0with the potential to be highly damaging.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

The\u00a0ENISA 2023 report\u00a0identified\u00a0one of the biggest\u00a0threats\u00a0comes from supply chain compromise of software dependencies.\u00a0This is when malicious actors may exploit flaws or defects in\u00a0software or\u00a0inject malicious code into\u00a0open source\u00a0libraries \u2013 causing shutdowns of crucial services and infrastructure.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

For the railway, this\u00a0can play out through attacks on\u00a0digital signalling, remote access for electrical isolations and even with the provision of Wi-Fi on trains.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

The digital risk comes from the fact rail systems are built to achieve targets around safety,\u00a0reliability\u00a0and functionality \u2013 but\u00a0cyber security is addressed separately from system design and engineering.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

Software standards in general do not address the\u00a0cyber security requirements and often\u00a0fail to\u00a0provide recommendations on the\u00a0development\u00a0lifecycle and related activities.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

Put simply, there is not a direct relationship between security levels (SL) and the\u00a0safety\u00a0integrity levels (SIL) protecting people from system failures \u2013 however, if\u00a0it\u2019s\u00a0not secure,\u00a0it\u2019s\u00a0not safe.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

The current\u00a0operational technology\u00a0regulations\u00a0for manufacturers and developers\u00a0do not go far enough. They\u00a0are\u00a0high level requirements that are not specific for railway applications, which makes it difficult to align with associated software development lifecycles.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n
\n
\"\"<\/figure>\n<\/figure>\n\n\n\n
<\/div>\n\n\n\n

What is needed to address\u00a0cyber security risks?<\/strong>\u00a0<\/h3>\n\n\n\n
<\/div>\n\n\n\n

As the existing standards\u00a0illustrate,\u00a0generalised, high-level requirements for secure coding are not fit for railway purposes.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

It means there needs to be a defined approach\u00a0for\u00a0different levels\u00a0and stakeholders along the process.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

For manufactures and product suppliers, they need to integrate secure coding practice within the software development lifecycle.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

Teams must\u00a0identify\u00a0software vulnerabilities in the software dependencies or existing software\u00a0versions, and\u00a0consider\u00a0end of life or end of support for those dependencies.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

Asset owners in turn need to add specific security requirements for software development lifecycles and best practice.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

And the industry,\u00a0as a whole,\u00a0will\u00a0need to develop a standard or guideline that covers both safety and security aspects apportioned to software components.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

SYSTRA\u2019s approach to\u00a0cyber security integration<\/strong>\u00a0<\/h3>\n\n\n\n
<\/div>\n\n\n\n

SYSTRA\u00a0specialists\u00a0provides\u00a0a diversified set of services from policy and strategy definition, planning and process definition\u00a0and also\u00a0risk assessment.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

We recognize\u00a0cyber security threats and vulnerabilities span all lifecycle phases of a railway system, from the planning and design through to in-service use.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

Poor implementation of digital assets can easily and unintentionally create\u00a0cyber security vulnerabilities between infrastructure and rolling stock; between operations and asset data; and even interrupt operations along the project design and build supply chain.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

Our\u00a0Cyber security and Software Assurance team\u00a0operates\u00a0cross-industry and across all organisational levels. This includes setting strategic vision to the definition of operational processes and the tactical review of designs\/deliverables produced by others.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

We carry out the work\u00a0either as independents to support a\u00a0third\u00a0line of defence assurance regime or as acceptance of design and deliverables on our projects and programmes.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

Managing cyber security and defining security requirements at the start saves time and costs down the track.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

The rail industry needs to shift from a position where\u00a0cyber security is an afterthought and an\u00a0additional\u00a0layer placed around a system, to one that is integrated throughout the design, build and\u00a0ultimately operation\u00a0of a system.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n

Cyber risks and threats are continually evolving.\u00a0Failure to stay\u00a0up-to-date\u00a0in relation to the changing threat landscape\u00a0means the\u00a0rail industry\u00a0risks not\u00a0achieving\u00a0value for money, best\u00a0practice\u00a0and an assured solution.\u00a0<\/p>\n\n\n\n

<\/div>\n\n\n\n
\n
\n
\n
\n \n\t\t
\n\t\t
\n\t\t\t\"\"\n\t\t\t
\n\t\t\t\t\t\t\t\t\t