Threat identification & analysis What are the current and emerging threats targeting railway infrastructures?

Methodology for threat identification & analysis Threat identification and analysis Context Transport verticals Rail sector profile Historical attacks All transport sectors Focus on the rail sector Comparative study Targets: Countries, Sectors, Zones and assets Attacks: Attack types and effects, Vulnerability, health and safety Threat Actors profiles: APT, Ransomware Threat scenarios for CYRAIL New likely threat scenarios Overview of potential future attacks Advisory Threat taxonomy and ontology Threat taxonomy: Context, Threat Actor, Target , Attack, Impact Threat ontology

Timeline of historical attacks

Timeline of historical attacks 2008, Poland: Homemade transmitter that tripped rail switches and redirected trains and injured a dozen people in Lodz 2012, USA: Cyberattacks disrupted rail signaling and traffic in the north-western USA for two days 2015, South Korea: Malware attack against dozens of terminals of a subway operator in Seoul over the course of several months 2016, UK: Multiple cyberespionage operations against Network Rail 2017, Germany: WannaCry ransomware attack on Deutsche Bahn

Comparative study Rail/Transport Targeted sectors Targeted countries Impacted zones Attack types

Cyber-attack classification methodology Identity card of a cyber-attack Based on a threat taxonomy

Threat taxonomy Context Geopolitical Attack Type Effect Impact Safety Unknown geopolitical context Conflicts Economical Not relevant Personal Threat taxonomy Threat Actor Name Name of the attacker or group of attacker Geographical area Location Country Motivation Accidental Coercion Dominance Ideology Notoriety Organisational-gain Personal-gain Personal-Safisfaction Revenge Unpredictable Unknown motivation Resource-level Individual Club Contest Team Organization Government Unknown resource-level Sophistication None Minimal Intermediate Advanced Expert Innovator Strategic Unknown level of sophistication Target Geographical area Location Country Organizational Unit Name of the impacted Organizational Unit Sector Rail Aviation Highway & motor carrier Military transport Maritime Shipping Zone Onboard Wayside Signal Command-onboard Maintain JRU Movement KMC Control Center IT infrastructure Multiple zones Unknown zone Asset Name of the impacted asset(s) Attack Type Type of attack Effect Effect of the attack on the targeted system Vulnerability, health and safety Exploited vulnerability or weakness Impact Safety Unknown Life-threatening injuries Severe and life-threatening injuries Light and moderate injuries No injuries Financial Existence-threatening financial damage Substantial financial damage Undesirable financial damage Operational Vehicule unusable Service required Comfort affected Not relevant

New threat scenarios for CYRAIL

Risk assessment based on a threat ontology