# Towards the Internet of Smart Trains:
## 6 IoT-Enabled Services: From More Efficient Operations to New Business Models
### Train Control Systems
#### 6.4.3 Cyber Security for Railways  
As it was shown in previous Sections, rail systems have evolved significantly towards new technologies and communication-based systems led primarily by the technological progress. Despite the fact that security in the railway industry has been always related with operational safety, due to the increasing integration of ICT into land transport, mobile units and infrastructure, the number of potential cyber risks has risen steadily during the last decade. In the same way, train control systems are relying more and more on ICT systems and radio communications, even for the ones automated.  
Cyber security is about protecting information systems against theft or damage, thus defending them against external and internal attacks and risks, in particular as a result of criminality. For this reason, future research related to rail security should focus on the rising of new cyber threats. For instance, the generalization of automation and computerization in the rail vehicles and signaling systems, could also become a high potential risk.  
Every railway operator faces the massive challenge of protecting its own infrastructure reducing its vulnerability to cyber-attacks. In most cases, heterogeneous ICT technologies and software solutions are used and result in wide-ranging and diverse data sets. The protection of such environments is complex and multi-dimensional. A proper design of the architecture of the infrastructure will help to improve resilience, but it is essential to integrate safety into every aspect of the solution throughout its life-cycle. Cyber systems used on rail networks may be subject to unauthorized access through various means: remotely, via the Internet, or unsecured communication networks; through direct contact with infrastructure (e.g., through a USB port); locally, through unauthorized access to physical infrastructure, or an insider threat (e.g., infiltration).  
Rail operators have to comply with a set of international industry and government standards on the topic of security (e.g., ISO 27001, NIST SP800-53, ISA/IEC 62443 or APTA). Nonetheless, each infrastructure and each security solution is unique. While meeting national and international security regulations, it is necessary a comprehensive analysis on how to design and protect information systems. It is also essential to develop, implement and maintain integrated solutions, and added-value services to protect sensitive information at any given time.  
The most relevant vulnerabilities are related to weaknesses in control systems, information systems, system procedures, configuration and maintenance, software development, the communications network, or in the lack of training and awareness. All of them can be exploited by threats that can be originated by many sources, including:  
* Connecting physical infrastructure (e.g., tracks, tunnels, bridges/viaducts, switches/rail junctions).
* Mobile units (e.g., locomotives, rolling-stock system).
* Train stations (e.g., exterior, interior or restricted areas) and areas outside the train station.
* Control systems (e.g., signaling, central and local rail traffic management).  
* Communication systems and communication network.
* Power supply (e.g., catenaries, power supply, national grid, diesel stations).
* Staff (e.g., driving personnel, handling personnel, maintenance personnel, information processing personnel).
* Freight (e.g., non-dangerous, explosive, toxic, flammable).
* Passengers.  
Regarding the classification of assets presented, access, construction techniques, control command and communication systems are considered to be the most vulnerable elements of the railway transportation systems. Indeed, these central elements are easily exposed to malicious uses leading to serious threats.