# Failure Mode and Effect Analysis for Cyber-Physical Systems
## 5 Communications-Based Train Control
#### CBTC Risk Prevention Analysis  
As a modern railway control system, the CBTC system contains several network and information components, which requires high cyber-security responsibilities. CBTC's most problematic security issues are cyber-attacks exposure and high-risk vulnerabilities in critical devices [25]. Thus, security measures are required not only to help prevent unauthorized users from intermediate in train-to-wayside communications with their Wi-Fi devices but also to avoid traffic sniffing and signal jamming. Hence, jamming attacks and Man-in-the-Middle (MitM) attacks require primordial attention when considering CBTC security's most relevant concerns. While jamming attacks cause interference into wireless communications [26], MitM attacks may cause, not only traffic sniffing, but also wrong control messages injection, and consequent train derailment and collision [27]. With a jamming attack, the attacker intends to jam the wireless signal to disrupt the communication between the train and wayside ATP. Through the emission of an electromagnetic wave, the attacker confuses the train which is unable to distinguish between the jamming signal and the correct data signal from the wayside ATP. The train perceives the electromagnetic wave as noise, significantly lowering the signal-to-noise ratio (SNR) for the wayside ATP signal. In the worst-case scenario, this may cause a communication failure. If the wireless signal continues to be jammed and consequently the communication disconnected, the train stops for safety [28]. In MitM attacks, the attacker assumes control of the communication between the two network nodes. Depending on the type of the attack, the attacker may replay, drop, or even spoof messages, according to its malicious intentions. As Wi-Fi networks are susceptible to MitM attacks, these can be carried at the data-link layer of the Open System Interconnection (OSI) model, which is the base for the Wi-Fi communication protocol. The Address Resolution Protocol (ARP) spoofing is one of many methods for performing a MitM attack [28]. In our analysis, we consider two different types of MitM attacks, message spoofing and replay attacks. The Message spoofing attack consists of injecting unauthorized packets on a communication assuming a false authorized identity [29]. This attack is a significant threat to the CBTC system, since the attacker can identify himself as a CBTC AP and inject wrong control messages. This attack's consequences may be unexpected abrupt braking, train location loss, train speed control loss, train full stop, train derailment, and train collision. In a replay attack the intruder copies targets' exchanged packets and sends extra copies into the network. This attack generates data overflow and may originate an incoherent system's behavior. In a CBTC environment, the critical consequences may be train stop and train control performance breakdown. The message dropping attack creates a false node inside the network and intentionally drops the received packets. Causing Denial of Service (DoS) to many system nodes and eventually to the entire system. This attack's repercussions to CBTC are the same as the ones jamming attack may cause and change to conventional operation. As end-to-end data encryption and authentication methods rise as adequate solutions to prevent message spoofing and replay attacks, [PERSON] et al. [30] introduce Rail Radio Intrusion Detection System (RRIDS) as a command replay and message corruption detection system. Using a \(\upmu\)Time Efficient Stream Loss-tolerant Authentication (TESLA) approach called \(\upmu\)Tesla, this system highly increases burnout on the intruder, which decreases intrusion efficiency and ramification. The RRIDS makes use of a subset of \(\upmu\)Tesla, appropriated to CBTC systems, with algorithms built on the originating seed and salt variations. RRIDS also is capable of analyzing Radio Frequency (RF) and detecting real-time threats.