ISA/IEC 62443-3-2: Securing West Midlands Class 196 Train Fleet
Complete Cyber was tasked with conducting a comprehensive risk assessment of the West Midland Trains (WMT) Class 196 train fleet, adopting the ISA/IEC 62443-3-2 Risk Assessment process. This included a detailed analysis of the trains network architecture, its connected internet infrastructure (Wayside) and potential vulnerabilities that could be exploited by malicious actors
SCOPE
CHALLENGES
The primary challenge was the sheer volume of information that needed to be processed to build and end-to-end architecture of the train's network. This involved understanding the intricacies of the train's systems, the Wayside infrastructure, and identifying potential attack vectors to the Railway. A penetration test was conducted to support the risk identification and vulnerability process, which required a deep understanding of both the trains Operational Technology (OT) and Cybersecurity principles.
OUTCOMES
Our team successfully delivered a compliant risk assessment to the ISA/IEC 62443 standard, identifying risks along with tangible economic solutions for the trains manufacturer to implement. The findings from our assessment not only highlighted areas of vulnerabilities, but also provided a roadmap for enhancing the security posture of the Class 196 train fleet. This comprehensive approach ensured that potential threats were mitigated, enhancing the safety and reliability of the fleet for both WMT and its passengers.