End-to-end system of increase in cybersecurity of microprocessor systems of train dispatching

End-to-end system of increase in cybersecurity of microprocessor systems of train dispatching - joint development of Positive Technologies companies, Bombardier Transportation (Signal) and JSC NIIAS.

On July 5, 2016 Positive Technologies companies, Bombardier Transportation (Signal) and Research and design institute of informatization and communication on railway transport (JSC NIIAS) announced development of an end-to-end system of increase in cybersecurity of microprocessor systems of train dispatching.

As a part of a product:

• the sensor of the analysis of network traffic on the basis of an incident management system of cyber security of Positive Technologies Industrial Security Incident Manager (PT ISIM),
• device of cybersafe monitoring CyberSafeMon.

Developers declared uniqueness of a system, having designated it as "the first experience of industrial implementation of similar devices in the transport industry not only in the territory of Russia, but also in the world".

The main objective of microprocessor systems of train dispatching (MPSU) — ensuring effective and safe train service, including due to minimization of a role of a human factor in emergence of emergency situations. However widespread introduction of information technologies in the transport system and active growth of the hacker attacks transfer a problem of increase in level of security of the systems using IT to number of the most priority. Search of the solution of this task demanded that we as parent organization in the field of cyber security on network of Russian Railways created a tandem from developers of such systems and specialists in information security field. Most actively among MPSU developers the Bombardier Transportation (Signal) company acted. In the field of cybersecurity the Positive Technologies company — the market leader in the field of counteraction to cyber attacks on which account detection more than 250 vulnerabilities of zero day in an APCS was involved as the experts. Boris Makarov, head of the center of cyber security of JSC NIIAS

Experts of Positive Technologies jointly with specialists of JSC NIIAS analyzed security of the natural model of one of management systems for train service — MPTs EBILock 950. On the basis of analysis results created requirements for ensuring cyber security of such systems and began works on increase in their resistance to cyber attacks.

Within these works specialists of Positive Technologies company together with "Bombardier Transportation (Signal)" and JSC NIIAS adapted the sensor of the analysis of the network traffic intended for counteraction to incidents of cyber security (PT ISIM). In the solution support of specialized industry protocols, identification of cyber attacks and incidents of security with the operational notification of responsible services are provided. Monitoring of network activity of MPTs EBILock 950 is made in the passive mode. The sensor allows to visualize in detail development and distribution of the attack in space and time, and in addition developed interface allows to trace all stages of an incident on the process chart of a local network of an object in a user-friendly type.

Any our project on protection of an APCS has several components thanks to which the final solution is most adapted to specifics of a subject to protection, with its protocols, business logic, technology processes and characteristic security risks. It is high-quality audit and identification of possible vectors of development of the attack on a system at all levels, the choice and implementation of countervailing measures, adaptation of PT ISIM under a specific system. Only such expert approach — labor-intensive and individual — can provide real protection which solutions "from a box" are not able to give. Boris Simis, director of business development of Positive Technologies company

For July 5, 2016 the PT ISIM sensor and the CyberSafeMon device passed preliminary tests and are put into trial operation at one of stations of the central region equipped with a management system of MPTs EBILock 950.

Results of works were discussed on expert advice on cyber security of JSC "Russian Railways" with participation of the international experts. According to the results of trial operation the decision on application of the developed system on the infrastructure facilities of JSC "Russian Railways" equipped with microprocessor systems of management of different producers will be made.

It is the first-ever practical experience of ensuring cybersecurity of microprocessor systems of train dispatching. We are grateful to JSC "Russian Railways" for participation of our company in such important project. The achieved results can be used for the different systems taking into account their features, and the acquired experience will be demanded by our foreign colleagues. Nevertheless we understand that we ensuring cyber security — continuous process, and are not satisfied with what has already been achieved. Together with the center of cyber security of JSC NIIAS we continue to trace new vectors of threats and to continuously improve our products. Only such pro-active approach allows us to remain the market leader of railway management systems for train service. Vadim Gross, chief executive of Bombardier Transportation (Signal) LLC