Smart railways… or not so smart : a cyber security perspective

![CDATA[Welcome to a world where smart railways are here and now. Real-time monitoring, embedded sensors, driverless trains, automated signalling and train control, Internet of Things (IoT), instant travel disruption alerts, and more. Operators not only need to continue to focus on operating railways, but now must monitor and protect all this connected infrastructure from a cyber-attack. The more connections, the more cyber threat attack vectors, the more potential for exploitable vulnerabilities, the more risk of a cyber-attack occurring. As the owner or operator responsible for the railway, how often do you perform risk assessments specific to cyber and/or information security? How confident are you of being proactive towards a cyber-attack? Are you able to identify, classify and/or mitigate a cyber-security related risk? Does your risk management framework allow for accurate classifications of cyber-security related risks in line with industry best practices? Will you be non-compliant and subject to financial penalties from regulations and/or legislation such as the Australian Notifiable Data Breaches Scheme (NDB)? The aim of this paper is to dive into information and cyber-security for rail networks and operations, providing advice into protecting a rail network’s infrastructure from cyber-security threats, to the same high level expected by all involved.]]