The Aventra was introduced on TFL Rail services operated by MTR in 2017, and is expected to become increasingly familiar over the next two years as it is added to fleets operated by South Western Railway, Greater Anglia, London Overground, London Northwestern Railway, and West Midlands Railway.
Bombardier says to provide confidence that the train offers the highest standards of security against current and emerging threats, Ricardo-Roke have been contracted to undertake an in-depth assessment of the Aventra’s exposure to a range of possible threats - from espionage to remote hacking - and evaluate the potential impact on its operation.
“Unlike traditional enterprise security assessments, the Ricardo-Roke approach focuses squarely around the unique characteristics and priorities of day-to-day rail operations, such as the importance of maintaining a safe and open environment for passengers whilst ensuring minimum disruption to the network,” says Ricardo Rail head of digital railway, Mr Doug Blanc.
The assessment will integrate Roke’s cyber expertise and Ricardo’s knowledge of rail operations, rolling stock design, systems engineering and passenger interactions.
“Transport systems are set to be the next big challenge in cyber security,” says Roke innovation director, Dr Andrew Rogoyski. “Connecting trains, vehicles and ships via the internet has the potential to post significant ‘life and death’ safety implications. This work is therefore a landmark development, as a major train manufacturer seeks to integrate cyber security assessments into their design and testing processes, keeping passengers safe, while delivering next generation train systems.”
To deliver the findings, the companies will benchmark against current industry standards and national legislation, including the network and information systems directive (NIS Regulations), and well-defined practices from sources such as National Institute of Standards and Technology, Certified Information Systems Security Professional, and previous vulnerability and risk reviews conducted by Roke for the British Ministry of Defence.
Once the investigations are concluded, the contractors will provide Bombardier with a detailed risk-based assessment of the Aventra platform, accompanied by recommendations that identify vulnerabilities and mitigate risks.
