Experiences from testing security solutions in the railway use-case CIPSEC workshop Frankfurt am Main, 16.10.2018 Dominik Renkel, DB Netz AG Christian Schlehuber, DB Netz AG heard a lot about the different solutions No lets talk about experiences made by testing the solutions in the railway testing facility The research leading to these results has received funding from the European Union’s Horizon 2020 Research and Innovation Programme, under Grant Agreement no 700378.

CIPSEC Security Framework Application (D3.1) Architecture below = digital interlocking system Layer are described in the CIPSEC framework architecture CIPSEC Workshop Frankfurt 16/10/2018 2

CIPSEC Deployment (@ Testing Facilities) Eisenbahnbetriebsfeld Darmstadt Tools are deployed Communications are working Events are generated and are received by the XL-SIEM solution Alerts are raised and visualized in the CIPSEC Dashboard CIPSEC Workshop Frankfurt 16/10/2018 3

Work ongoing Tests to be performed Successful Services to face the new challenges CIPSEC will provide solutions Staff Training and Awareness Is our staff capable to understand cyber security? Forensic Analysis Analysis vs. Fast Recovery Detection/Locating of Denial of Service Attacks Future railway operation will rely heavily on GSM-R Work ongoing Tests to be performed Successful Forensic Analysis: Add specific dashboard for RaSTA communication WOS DoS Sensing: Test performed and CIPSEC framework noticed and presented Alert CIPSEC Workshop Frankfurt 16/10/2018 4

CI Requirements vs. Current Status Some findings: Some solutions had few possibilities for own configuration CI operators require the possibility to adapt solutions to their needs (e.g. disable certain functionalities) SSH configuration by supplier is required In general no uncontrolled access is granted to a supplier to a productive environment; also not possible due to missing Internet link Implementation should be performable by a normal user and not only an expert  automated installation would be beneficial see above point, besides the maintenance personnel of CI may not be able to perform complex setup procedures CIPSEC will offer consulting services & in-house assistance  Minor issue Usage of update and patching service SSH in operative environment not needed anymore  Major issue CIPSEC easy to deply -> commercial of the shelf CIPSEC core easy to install and deploy CIPSEC services Update and patching In-house assistance  Minor issue CIPSEC Workshop Frankfurt 16/10/2018 5

Thanks for your attention! Questions? Contact: Christian Schlehuber / Dominik Renkel DB Netz AG christian.schlehuber@deutschebahn.com www.cipsec.eu @CIPSECproject https://www.linkedin.com/in/cipsec-project/ https://www.youtube.com/channel/UCekxicSFAwZdIPAV3iLHttg CIPSEC Workshop Frankfurt 16/10/2018