West Midlands Trains: Cyber Risk Assessment of the Class 196 Rail Fleet
West Midlands Trains was preparing to introduce its new CAF Class 196 fleet into passenger service and required a detailed cybersecurity risk evaluation of the trains and their connected systems.
Complete Cyber’s scope extended beyond documentation review. Our team assessed the train itself through passive network and asset discovery, analysed the supplied technical documentation and considered connected maintainers and suppliers within the assessment. The work applied an IEC 62443-3-2 risk assessment approach, partitioning the architecture into zones and conduits to assess cyber risk across the fleet environment.
SCOPE
CHALLENGES
A previous risk assessment had not provided comprehensive analysis of the train’s network architecture or the supply-chain systems connecting to it. For a modern rail fleet with remote connections to maintainers and suppliers, those relationships were an important part of understanding the overall cyber risk.
A credible assessment also required evidence from the operational environment, not documentation alone. Complete Cyber therefore needed access to the train for passive network and asset discovery, including capturing live running traffic, while coordinating closely with depot and entry-into-service teams to avoid disrupting the introduction programme.
The findings from the train then had to be reconciled with CAF’s extensive technical documentation, providing a clearer picture of both the designed architecture and the network observed in operation.
OUTCOMES
Complete Cyber delivered a comprehensive cybersecurity risk assessment of the CAF Class 196 architecture, covering the on-train networks and connected supply chain.
To build an evidence-based view of the fleet’s cyber risk, our specialists combined on-train passive network and asset discovery, live running traffic capture and light penetration testing with detailed analysis of CAF’s technical documentation. We then applied an IEC 62443-3-2 zones and conduits approach to assess risk across the train architecture, while ensuring no intrusive testing was carried out against operational systems.
The resulting assessment gave West Midlands Trains detailed evidence of its cyber risk and prioritised actions for both the operator and its suppliers, providing an evidence base to support the Class 196 fleet’s introduction into passenger service.