1. Specification of Countermeasures for CYRAIL
What countermeasures to mitigate the risks from the risk analysis?

2. Objective of countermeasures specification
Identify threats and vulnerabilities
76 threats identified (ISO standard & threat analysis)
Determine impact
Safety, Finance, Operational
Determine likelihood
Time, Expertise, Knowledge, Opportunity, Equipment
Calculate unmitigated risk
Risk = Impact x Likelihood
Determine Security Level Target
To identify the most critical security zones
Identify countermeasures
To mitigate the risks
Analysis of the residual risk
Below tolerable risk?

3. Widely-distributed software - Software
Methodology
Countermeasures are specified by zone and by threat.
Each countermeasure is defined according the security level target of the zone.
Example of the Command-onboard zone:
Threat
Vulnerability
Risk
Asset
Countermeasures
Corruption of data
Widely-distributed software - Software
Corrupting the data an attacked can change the software to create fake information in the asset
BTS
Logging and monitor device. Define a management policy for patches (systematic, periodic or ad hoc) that is suited to the functional constraints. For example, define priorities for deployment of patches, verify ascending compatibility, and interoperability.
Use Reliable NTP (internal real time reference)
RBC
Logging and monitor device.
Local ERTMS Control
CF BTS REQ
Use an electronic certificate to timestamp data
Applying application programs to the wrong data in terms of time - Software
These countermeasures may restrict the functionality of the system and therefore, they must not impact the safety of the system.
=> Focus on the assessment of the fail-safe concept to fall back to a safe operational mode.
In some cases, no countermeasure is available to a threat. It is usually due to the fact that the affected asset cannot embed cyber security related countermeasure.

4. Synthesis of Countermeasures
Cyber countermeasures
Other countermeasures

5. Countermeasure examples (conduits)
Type
Countermeasure
Assets
Risk
Threat
Threat class
Process & Human actions
Set some Key Performance Indicator (KPI) in order to evaluate the level of Quality of Service served by the system and logging. Monitor and alert the gap between normal activities and abnormal activities. Define Thresholds and send an alert.
ERTMSBalise
The track-to-train communication is jammed
Electromagnetic radiation
T.RA
Occupancy
The interlocking-to-track communication is jammed
Signalling
The communication between zones connected to the Signalling network is jammed
Data Protection
Control integrity of message with a robust security algorithm (). Use double authentication. Make sure that integrity is controlled by the server and not by the End user.