CYRAIL Final Conference ERA on cybersecurity UIC – Paris, 18 September 2018

EU Agency for Railways - Mandate MAKING THE RAILWAY SYSTEM WORK BETTER FOR SOCIETY The objective of the Agency is to contribute, on technical matters, to the implementation of the European Union legislation aimed at improving the competitive position of the railway sector by: Enhancing the level of interoperability of railway systems Developing a common approach to safety on the European railway system Contributing to creating a Single European Railway Area without frontiers, guaranteeing a high level of safety level of safety In 2019, the "4th Railway Package" transforms the Agency from a consultative body to an Authority issuing Safety Certifications and Vehicle Authorisations “make it work” Founded in 2004* Valenciennes (F) approx. 165 staff

The EU Agency for Railways Cyber Action Plan 1/2 To monitor all activities related to cybersecurity in the railway context Promote adoption of native security features in future radio communication and signaling systems To cover safety requirements of the rail system, including the assessment of safety consequences originated by security threats Security threats based on physical access to assets outside of scope Radio link inherent threats considered Safety AND Security Management Systems To reflect the above in TSIs (TAF/TAP, OPE, CCS) and CSMs

Activities related to cybersecurity in the railway context WG 26 Draft Technical specification: “Railway Applications – IT-Security / Cybersecurity for railway systems”  Implementation of a consistent approach to the management of the security of the railway systems TC CYBER Technical Report: “Implementation of the NIS Directive”  Guidance on considerations for incident notification; best practices in cyber security risk management TD 2.11 and CYRAIL Definition of a security by design system, dedicated to railways (e.g. Protection Profiles Specification) Application of the methodology to railways (demonstrator)

The EU Agency for Railways Cyber Action Plan 2/2 To foster close cooperation with ENISA and EC Support railway stakeholders on cybersecurity strategy development Assist the development of network of Railway Cyber Security Experts Consider incident reporting schemes To cooperate with EU-Agencies in the transport sector (EASA, EMSA)  Conference planned in Portugal in January 2019 To investigate with National Cybersecurity Authorities (e.g. ANSSI, BSI…) potential gaps in cybersecurity requirements To support the concept of an ISAC (Information Sharing & Analysis Center) for Rail Kick-off meeting supported by DB and Infrabel on 05/06 @ERA Next meeting in October in Frankfurt

Towards a rail sector ISAC

ERA on cybersecurity strategy in summary Monitor relevant activities related to cybersecurity in the railway context Cover safety requirements of the rail system, including the assessment of safety consequences originated by security threats Reflect the above in Technical Specifications for Interoperability and Common Safety Methods Regulation considerations Close relationship with ENISA and EC in support of railway stakeholders Cross-fertilisation with EASA and EMSA to develop a transport cybersecurity policy Investigations with National Cybersecurity Agencies (e.g. ANSSI, BSI) on potential gaps Support the concept of a Rail ISAC (Information Sharing & Analysis Center) Cooperation building