How to build a next-generation of railway cybersecurity

The railways are a pivotal part of the UK’s infrastructure. The most recent Office for Road and Rail figures recorded a total of 420 million journeys made by passengers in Great Britain from April to June 2024, up 7% from the same period in 2023.

Rail makes a huge contribution to the UK’s economic productivity and connectivity. With many parts of the network now full at peak times, new capacity is urgently needed, alongside making existing operations more resilient and efficient. 

One way this is happening is through digital transformation. With modern signalling and train control capabilities, such as Connected Driver Advisory Systems (CDAS) and Traffic Management (TM), the industry can start to improve capacity on existing lines in the short to medium term, without the high costs and long timelines of delivering completely new railway infrastructure.

Building trust in digital systems 

Improving the ability of operators to measure and sense what’s going on is a big part of this. We’re starting to see greater use of Internet of Things (IoT) sensors to monitor everything from passenger flow and fleet status to planning, scheduling, and optimising maintenance schedules. This increased digitisation must also be cyber resilient, with railway cybersecurity designed into these systems from the outset.

Operators need to be confident that they can proceed with rolling out more digitally enabled ways of working, with automated reporting, warnings, and actions; and trust the output those systems are giving. 

This cyber resilience is fast becoming a legal requirement. There must be a detailed understanding of the intricacies of designing secure, resilient solutions for control and management – and trust that data on things such as train position can be trusted to be accurate.