Someone could potentially just go to the toilet in the place that it's not monitored
at all because they are not cameras, and of course inside the toilet you
can put them there and manipulate something inside the train network. Welcome everyone to
the Industrial Security Podcast. My name is Nate Nelson. I'm sitting as usual
with Andrew Ginter, the vice president of Industrial security at Waterfall Security Solutions.
Andrew's going to introduce the subject and guest of our show today. How's it
gone. I'm very well, Thank you, Nate. Our guest today is
Mickey Schiffman. He is the chief technology officer and co founder at Silas and
our topic is cybersecurity for rail systems harder than it sounds. Okay, well,
then, without further ado, here's you and Mickey. Hello, Mickey,
and you know, welcome to the podcast. Thank you for joining us.
Before we get started, can you say a few words about yourself and
about the good work that you're doing at SILAS. Hey, Andrew, thank
you for having me. It's a pleasure to bear on the podcast. I'm
a little excited towards it. So my name is Mickey Schiffman and I'm city
uncle founder at Silos, so we founded Silos at twenty seventeen. Prior to
founding Silos, I served as an officer in analyt Technology Unit in the Isbrael
Defense Forces and dealt mainly with cybersecurity, communications systems, embedded systems and everything
in between. Within Silos overseeing product and technology and in silence, our mission
is to protect railway systems all around the world from cyber threats. We'll explain
their own why is it even a topic? And Other than my work at
Silos, I'm also contributing to various cybersecurity working groups in the rail field worldwide.
The latest is actually an IC group that is currently working on developing the
latest standard for rail cybersecurity, something that should be drafted like sorry, published
over the next year and we're looking forward to it as supposed to be an
important milestone for rail security worldwide. And our topic today is trains. It's
rail system cybersecurity. We've had a couple of guests on the show some time
ago talking about rail systems. You can you remind us, you know,
what is a modern train? How does it work? How's it automated?
Yeah, So before digging into how the trains actually work, I want to
put like a few facts here just for the audience to get more familiar with
the operating constraints. So first is that trains can operate in speeds that are
over three hundred kilometers per hour and have a stopping distance of one kilometer and
more. Sometimes. The reason I'm mentioning that is to explain that only automation
can enable that because a normal driver cannot really see in such a distance,
and of course in such a speed you cannot really notice the state of the
signals, so you need to have something that transmits the information to the cab
or makes decisions on your behalf. A second thing is that you have more
and more services for passengers, and that results and modern trains, and of
course the safety constraints and the requirements for high availability trains are now many times
have hundreds of connected device in a single train and they communicate with each other
through safety critical and non safety critical communications. Other than that, you have
wireless links, so a train operator can sometimes have a huge wireless network.
In Europe's GSMR for positive train control, they use many times the two hundred
and twenty megahertz radios and other signaling systems have other wireless models of communications,
such as CBTC, which is used for Metro many times uses just Wi Fi
and all of them together as a single system caused the train to be heavily
reliable technology, and this technology is very proprietary and used only in a rail.
Let me jump in here and give just a bit of background. Make
you use the word signaling a couple of times. In the old days.
What was signaling In my dim understanding of it, it was an electrical process.
If a train was on a segment of tracks, it closed an electrical
connection between the two tracks, and so you could sense that, hey,
you know, there's a train on the tracks, or you know, I
suppose a metal bar could have faked it out, but you've got you've got
electricity, you know, a small amount of it, a signal moving from
one track to the other. And this told the you know, a light
at the beginning of that segmented track to go red, saying there's a train
on the track, you have to stop. And it was, you know,
similarly electrically connected to the previous segmented track, so that the light at
the beginning of the previous segments went yellow, So that an engineer driving another
train sitting in the locomotive coming up on a segmented track. If that engineer
saw a green light, and I might have the colors wrong, but let's
use the traffic light, you know, convention. If the engineer saw a
green light, knew that the next two segments and track ahead of them were
you know, clear. If they saw a yellow light, they knew that
the next segment ahead was clear and the one after was not. If they
saw a red light, it was stop stop, Now you've got something on
the tracks ahead of you. This was old school and it relied on the
reflexes and the attention of the engineer. Nowadays it's all been automated and the
buzzword is positive train control. You know. Train control basically means you get
a signal from computers saying which tracks are clear, which tracks have locomotives on
them, are you know, trains on them, and the computer in the
in the locomotive it brings the locomotive to a stop if if it needs to.
Positive train control means that it's it's not a stop signal that is sent
to the locomotive by the computers. It is a go signal. And if
the computer in the locomotive ever fails to get a go signal in a given
amount of time, it immediately stops. That's what the positive in the positive
train control means. It means you continue moving only if you continue getting a
positive signal saying the the heeady was clear. So this is sort of the
modern world that it's all automated. These are safety critical environments. There's there's
challenges in terms of you know, being able to see what's coming down the
track, you know, stopping these these very large, very fast trains if
if there's an issue. How does that relate to cybersecurity? We know what
what are sort of the unique challenges for cybersecurity and the rail systems. Yeah,
so the main aspect of a rail system that is quite unique is the
long life cycle. So a train can be operated in thirty years. Usually
give the analogy of like we can think of what we knew about cybersecurity thirty
years ago, and that would approximately be the level of security that exists in
many of the current trains that are in operation. The other thing is safety.
So to achieve this high level of safety and making trains the safest of
transport, you need to have a lot of constraints, and many times those
contraints constraints they come in conflict with security. So just an example, in
many countries, in order to patch a device on a train or a safety
critical network, you need the government to sign off the patch, and that
can take just months of approval from the time that you even have the patch
available, sometimes years. Sometimes you just don't touch it because it's so hard
to change and you don't want to go through this costly process of updating.
The other is that train manufacturers and the technology is used in trains. There
are many times really dedicated for the rail industry, so they're not used in
other industries. You have technologies has just have been developed for a single industry
and they know how in the industry doesn't necessarily contain a lot of cybersecurity.
It's mainly around safety and operations because these used to be the core values of
those systems. Other than that, you have passengers on those trains, so
although it's a critical infrastructure, it has high interfaces with the public and people
can be on trains there in stations. Trains are moving, so they're not
in a fixed location that you can kind of like protect or put walls just
to protect it, and all of those are quite significant challenges that the industry
works around in order to improve the security of those systems. So a clarifying
question, you know, you it sounds like you're saying, if you know,
when passengers come into a transit uh, you know car or you know,
a commuter car. It sounded like you're saying, some of the computers,
are they're exposed or are the networks exposed? In what sense is this
automat exposed to the public and how big a problem is at Indeed, of
course not in all cases. In many cases it isn't. Indeed, there
are cabinets that are exposed to the public, and I can give a few
examples, and some of them you can see them in train stations. They
use just a key that everyone can buy online and you can see them like
monitors on trains and as I mentioned, in the stations themselves that are like
that, and someone could potentially abuse. The other example, which is a
bit more let's call it exotic, was something that we signed some trains that
apparently the toilet computers or the systems that are responsible for mentioning the state of
the toilet to the passengers like whether they're occupied or not. They're connected to
the network of the train and they are just communicating in a bus with all
the other devices in the network. One interesting thing about it is that sometimes
either their controller or other controllers, there are architectures in which they are located
inside the toilet cabinet, for example, behind the mirror, and in such
cases, someone could potentially just go to the toilet a place that is not
monitored at all because they are not cameras, and of course inside the toilet
you cannot put them there and manipulate something inside the train network. So this
is actually a scenario that we've seen happening at least in some tax simulations,
and it will actually executed by the ones where similar to those attacks. Let
me give you just a little background. In my understanding, modern passenger trains
have not one network automating the train, but three of them. There is
obviously the control network where the positive train control happens, you know, and
other kinds of control functions on the on the vehicle. There is the entertainment
network. Because a lot of the modern trains have Wi Fi. They might
have an Internet connection. You know that you do or don't have to pay
for. They might have movies you can watch on on long rides. And
you know, of course people are connecting their cell phones and their laptops and
their tablets to these these entertainment networks. And there's what's called a comfort network
which is focused on you know, automation that involves the comfort of passengers,
like are the washrooms occupied, what's the temperature in the cabin? You know,
control the air conditioning, you know, control the I don't know the
if you've got on the truly modern cars, the you know, the opaqueness
of the windows so that the sun isn't blasting in on you, you know,
the lighting if it's if it's at night, this kind of thing.
So and these networks you generally want to see, you know, want you
want your passengers to be able to see where you are. And you know,
very small amount of information that's coming out of the control network that's tracking
location and other aspects. You know, how are we late? You generally
want passengers to at least be able to see what's going on comfort wise,
so they know, you know, which which restrooms are are available on how
many cars they got to hike down to find one. But you know,
you should at least have firewalls. If not, you know, uni directional
communications between the more critical networks and the and the less critical networks, certainly
and the entertainment network. Older, older systems, older rolling stock may not
have these distinctions, you know, they may have mixed up some of these
networks that are more separate on the newer stuff. It's it's a mixed bag
out there. The kinds of trains that I've had experience writing do not appear,
at least from the passenger perspective, to have all of these comforts and
amenities. Is this common? I believe it's common in the newer vehicles,
the newer rolling stock. But uh, you know, A, if it's
not there, you know, sorry for you. It would be nice to
have a movie on the ride, you know. B If it's not there,
it also means you don't have any of these risks because it's not there.
So you know, it's a mixed it's a mixed blessing. It reminds
me that very recently we had a scenario in Poland where we saw a bunch
of trains, like twenty of them I think suffer emergency stops because of some
hacking attempt. Can you give us the details there what happened there? Yeah,
so, according to what's known to the public, what happened there was
that there is a legacy system that isn't used for train communications in Poland,
and this system is receiving or capable of receiving wireless signals and those signals are
effectively sub tones, and a specific sequence of those sub tones can make a
train stop and that's by definition, by design. So I want to talk
about a few points related to this case. One of them is the use
of wireless communication. It's not very trivial that Creek infrastructure uses wireless communication,
so heavily is rail and that's a uniquettack factor in rail network that should be
secured as much as possible, not necessarily. There's a lot of things you
can do in such a situation, but it's something to be considered here.
Specifically, it's a very old system. But even if it would be replaced
with a newer system, those systems also rely on wireless communication. And these
are also digital wireless communication, so it's even more susceptible to attacks because you
can do a much more other things. Many times those wireless communication links are
not properly encrypted or using all encryption or non encryption at all, and these
are indefence should definitely be looked at. And protocols like rTMS or CBTC,
they're different potential security challenges there. The other thing is more related to let's
say motivation, and that's something that we're seeing now along those geopolitical disputes.
But real systems are high quality target for FRED actors and the people within the
rail company, the operators, they are responsible for ensuring that the public is
secure in those systems. And what we are unfortunately seeing here is FRED actors
are increasing at sitting setting their sights on those rail systems and showing the motivation
to attack them, and in my opinion, should be a wake up call
to make people in the treated not necessarily looking at security, not necessarily in
discise. By the way, that's just an example of one company that got
targeted not necessarily even my cyber attacks, but over wireless radios. But in
general in the industry, I think that we should look at the fact that
threat actors are actually looking and internet inspecting those systems and they can be aware
of many of the specifications and these systems definitely should be treated with security in
mind. The latest numbers in the twenty twenty three Threat Report on OT cyber
incidents show that the threat environment has changed fundamentally. At the beginning of this
decade, OT cyber attacks with physical consequences have changed from a theoretical problem to
a very real problem, more than doubling every year. The new report is
focused on deliberate cyber attacks in the public record. These are attacks that cause
physical consequences and process industries and discrete manufacturing. Most of these attacks are ransomware,
though the fraction of activist attacks is growing, and the report's appendix includes
a complete list of all cyber attacks since Stuck's Net that meet these criteria.
To see how today's OT cyber threat environment has changed, I invite you to
download the report, a joint effort between Waterfall Security and the ICs drive OT
Incident Repository. You can download the report at Waterfall dash security dot com slash
twenty twenty three DASH Threat dash Report, or just go to the resources menu
at the Waterfall Security site and click on white papers and Ebooks. So,
NY, let's talk about wireless communications for just a minute. Most heavy industry
is deeply suspicious of wireless, any kind of wireless. You know why,
I'll you know it's because cell phones are walking wireless attack vectors, among other
reasons. You know, how does that work? Imagine that you know your
pizza delivery guy has downloaded a trojan game, delivers pizzas into a refinery or
a power plant, and the trojan game, while it's inside the power plant
is scanning for Wi Fi networks and reporting their geographic location to a commanded control
center. Now the bad guys decide they want to target a particular power plant
they know in their database. They've got I don't know six Wi Fi networks
in that plant. One of them has the name Control, the other one
has you know, suggestive names. They launch a phishing attack. They steal
the credentials to log into those Wi Fi networks. And now the next time
anybody carries the compromised game on their cell phone doesn't have to be the same
pizza delivery guy, can be anybody carries that a compromised cell phone into the
site. The bad guys can connect to the cell phone over the cellular network,
operate the trojan on the cell phone, give the credentials, connect to
the Wi Fi netw work in the sight and you know, work their will
upon it. So, you know, heavy industry is deeply suspicious of wireless
for this attack scenario and many others. The problem with the rail system is
that you have no choice. You have to use wireless communications to communicate with
these these locomotives that are traveling at three hundred kilometers an hour, you know,
all over the countryside. You have no choice. And so yes,
you have to encrypt everything. Yes, you need credentials everywhere, and you've
got to train your people not to leak these credentials because you know, there's
just so it's a hard problem. You have to use wireless, but nobody
wants to, you know, and so there's a lot of you know,
focus on on wireless security in the rail system. You know, that's a
distressing picture of sort of constraints and issues in you know, the security in
rail systems. Can you talk about sort of there, what's the response,
what's the industry doing to address these things? Of course, the topic of
security is quite broad. We know it from all other industries as well,
and there are a few motions there. One of them is securing the install
based the other is develop products that are trying to be secured by design,
and also in each one of them you can dig deeper and see the controls
that are being used in order to achieve those purposes. So there are some
controls that are harder to use many times, like for example, encryption is
unnecessarily being used in the industry for other reasons, can be about latency and
potential impacts on the operations. Other than that, you have methods of things
like segmentation in which we also cooperate with waterfall, and solutions like diodes of
firewalls as such. What we're doing is another thing, which is being non
intrusive and trying to be as much easy as possible to deploy. So,
as I mentioned before, the main constrained really environment is safety. So you're
trying to secure as much as possible without compromising safety and operations. And that's
not such an easy task because in order to secure optimally, you of course
need to make a lot of modifications. You would like to maybe change the
devices themselves, as I mentioned before, you might want to introduce encryption wherever
it's possible. But sometimes what we're seeing is that making those changes is much
more expensive it will will cost than just introducing an external solution that will give
you the right compass any control over the fact that those controls do not exist.
And when i's expensive, I'm mostly into the need of recertifying the systems,
passing them for safety approvals, upgrading the huge install base, et cetera.
And our approach in Sileswan was to help operators to be able to meet
the best security practices and follow the security frameworks in a way that is tailored
for their environment, as well as make sure that all of those processes are
indeed aligned with the safety processes and not introducing another risk or a challenge with
that regard. Okay, and you know, in terms of solutions in this
space, you know Silas is you folks, uh you know have services offerings,
You've also got technology. You're selling technology into this space. What are
you? What are you producing and how does it work? Our solution,
saluce one, which is the solution that the company develops, is what we
call a real tech security platform. So a rail tech security platform is a
comprehensive platform. It is capable of providing several benefits to operators. So the
most important thing about this type of a solution is the context that it has.
So we haven't invented the space of operation technology monitoring, but I think
that the major innovation that we bring in the rail industry and in so much
needed in the rail industry is the ability to put context around the information.
So our ability to provide operators with visibility which is precise and is tailored for
their environment. So the ability to differentiate between assets, whether they're safety critical
or not, whether they're interlocking light signals, point machines, or things on
the onboard such as breaking systems in dark trolley units. This ability helps them
to actually identify their environment, understand the exact status of their security poster,
and also remediate security issues as they're cure in a much faster pace because they
have this context. Think about it. If you could have a network of
hundreds of thousands of devices and you don't really know what's the role of each
device, it's very hard for you to prioritize whether an alert is severe or
not, understand who's the owner of a specific device and who should treat the
security issue, Understand the context of the device in the broader rail system,
and whether operations can continue as normal or not, and these are all things
that our solution brings. So roly speaking, our solution helps with visibility,
with detection, the response piece of it, which is very important because detection
is one nice thing that you can do by detecting various stories of tactiques,
techniques and procedures. But understanding how should you properly response under the constraint of
the rail environments is part of our secret sauce and part of the value that
we're bringing to the customers to make sure that they're not just lost and flooded
with lots of alerts. And also of course compliance because compliances paramount in the
industry, so the ability to comply with rail security frameworks as well as security
best practices while meeting the safety constraints. These are all things that you get
through our product and it helps you to also of course meet the requirements of
all the latest regulations such as the TSA Directive in the US and is too
directive in Europe and standards and best practices such as TSFTY seven to one and
i C six four five two that will be developed that will be released in
the future. Sorry, and the system of course will also help operators to
comply with it. Okay, So that's that's a lot of benefits. You
know, these are all important benefits of a solution, but you haven't really
said how it works. I mean, if you want to understand sort of
the purpose of each piece of equipment, do you enter its IP address by
hand and enter the data by hand and now you have it available when an
alert comes up? Or do you discover this stuff automatically? Or what I
mean? How how are you gathering this data and how much of it is
sort of manual? How much of it's automatic? Can you can you lift
the hood for us? Yeah, that's a great point to Andrew. Yeah,
I'm trying not to expose too much the tech inside of me. So
yeah, that's that's a great question. So there are several ways that it
works. First, as I mentioned, the purpose is to be as much
more interested as possible, and the way of doing it is, first like,
we collect information via network traffic. So we passively connect to the network
via tabs or spand forward or diote what is approved by the customer and collect
the information passively through a platform that's thrown network traffic. And we extract the
context that I mentioned through this row network traffic. So it starts by analyzing
the protocols, which is probably the easier part, but then it builds up
over our algorithms for as a database and anomally detection and compliance and helping actually
to make sense out of this data. So that's one source of data that
we treat. The other source of data comes from integrations. Integrations can be
through operational systems that exists in the environment, and these operational systems already gather
insights about the operational state of the real environment, which can be like maintenance
systems for example, and their system can seamlessly integrate with them, and by
collecting this information, users can get a single pane of glass over their operational
and security data in a sense that when security data is out there, we
can actually correlated with the operational info that you have on the environment, and
that usually helps you to spare false positives and have shorter investigation cycles. Other
sources of information can include asset management databases, risk management databases, other security
solutions that are used in the networks, whether in the end points or other
locations, and we collect information from all of those in order to put this
information into the context that I mentioned before. So with these capabilities of information
collection, you can actually get a very comprehensive view of your network and very
precise view of your environment, whether it's trick side, onboard, in the
operations center, or on the stations themselves. So listening to this, you
know, I think some of our listeners might ask, why the great focus
on, you know, detecting and responding to incidents. If cybersecurity is article
the safety, then do we need not need to to prevent the incidents?
And you know, I think I think the answer is, partly, we've
got a lot of legacy equipment out there. It's weaker than we want it
to be, and so one of the compensating measures we can put in place
is, you know, a strong detection. It's it's not as good as
changing the systems to prevent attacks, but you know, it's it's something that,
especially in a passive mode, it's something we can very quickly add after
the fact without without arising the the the eyre of the of the regulators,
the safety regulators. You know, you might also don't don't don't get me
wrong, you might you might also ask, you know, well, if
we were able to prevent these attacks, by applying security updates, by doing
better segmentation, by whatever. Could we you know, do we then still
need detect, respond to recover? And you know the answer is yes,
we need both. You know, the NIST Cybersecurity Framework has five pillars,
and you don't choose between them based on your industry. You might prioritize them
based on your industry, but a robust security program has all of them.
The most sophisticated intrusion detection, the most sophisticated you know, detect responder recover
programs that I've ever seen are at sites that also have the most sophisticated prevention
programs. They sort of go hand in hand. So you know, on
the one hand, it's a compensating measure. You can you can get some
of your assurance back with detect responder recovery. And on the other hand,
it's a long term investment. You know, we need it going forward.
Could I ask you to go maybe a little deeper on response playbooks. You
know, if there is something that might be an incident or definitely is an
incident, you know, it sounds like you have some support for dealing with
the ins and so can you speak to response playbooks and you've also mentioned compliance.
It sounds like you can compare what you're seeing to what needs to be
their compliance wise, So can you talk about sort of response playbooks and compliance?
How do you do that? What does that you know, what does
that look like under the hood. That's fact we response playbooks. So in
response playbooks, our goal is to have the operator capable of handing our alerts
in a way that fits their environment. So it starts actually by helping the
operator to get all the relevant context over a specific alert. So it's the
ability of identifying similar alerts very quickly and correlating it with them. It's the
ability of understanding whether maintenance activities took part of a specific over specific asset.
It's the ability to see what other things this asset has experienced prior to this
alert. And it's basically this and others that create the context that helps the
operator to first understand whether this alert should be either or not, whether it's
expected maybe, and it also afterwards helps them to adjust it accordingly, so
adjustice and nativity of the system and ensure that they will see more or less
of those alerts in the future. Other than that, there is the part
of by identifying the context of the alert, the context of the asset,
the context of the operations understanding how do you actually should respond to this event,
and by responding you can take several actions. Some actions will be hard
to take over specific type of systems, some are more possible. Generally speaking,
the industry is just starting in terms of like the active responsibibility, so
the ability to actually like microsipment to do something similar over assets. It hasn't
been the case until now, but we see more and more sparks of it
specific and specific systems that are inside the industry. And this general ability of
like providing the operator context, it spares a lot of time. It's something
that you can effectively measure by the time that you're sock team or your operations
team needs to take when it analyzes alerts. And I think that's an important
metric to look at when you're having some sort of a sock and rail company
or you're setting up this monitoring or detection program inside your company, and that's
where context is mostly useful. So that's about the response piece in a nutshell,
if we're going to compliance. So compliance is a very broad topic,
and especially in rail, it has a lot of tailwind coming from the different
standards that are being developed and the suppliers themselves, because the industry is used
to develop things that are certified to something and that's the standard the industry provides
to their components. So the general, let's say, major capability of the
major rail suppliers is the ability to have a high level of safety and certification
and that's very hard to achieve. So what we're saying more and more the
trend in the industry is to have a similar approach with security, so to
ensure that there is a baseline of security it is by design in those devices,
and ensure that is being enforced over those devices. And this baseline of
security can be a standard like i C six to four free LASH free Family,
which is more of the system integrator side, and it can be something
around isis free dash too sorry that is coming more of the asset on their
side. And all of those together are being embedded into this new set of
frameworks that is developing the industry. And what our solution helps with is the
ability to first understand your compliance status to some of the requirements, as those
that are related to controls. Because many of the requirements of the relative processes
which are not necessarily things that are visible through just monitoring of traffic or analysis
of data, and other than that, it helps you to understand like your
general level of compliance with specific framework where the system helps you to achieve the
goals that you have on specific requirements, and that's something that can also serve
to Actually it's a compass and control for requirements that you don't have because the
truth is it's very hard to apply security to especially legacy systems. But the
term legacy is really stretching the real domain because it's thirty years So even if
system was developed like five years ago, it's already legacy and doesn't necessarily close
security by design, and with our products you can actually look at the different
parts that you're not compliant with and see what coverage you can actually achieve through
using the solution. So, for example, if you have an unencrypted link,
that's bad, like that's not something that you would like to have,
but let's say the second best of like encrypting it or authenticating it would be
probably to ensure that there is no abnormal communication over the link that could potentially
compromise you. Because it's one thing to know that you have a risk.
The other thing is to actually be able to mitigate it or identify whether this
vulnerability is being exploited. And that's something that we can definitely help with to
the operators that are trying to meet those frameworks, even with partial ability to
implement controls. So I'm still a little confused on the compliance side. Can
you give me a couple of examples, what kind of things can you detect
on the compliance side and report on, maybe just to go back to the
previous question and start from there. So, another important aspect of compliance is
what happens the day after a system is being handed over. So most of
the compliance of most of the frameworks are focused in complying at a certain point
of time, which is usually the hand over time from the system integrator to
the asset owner to the rail operator, and from that point it's under the
responsibility of the operator. But it's very hard to enforce it over time.
So even if there is a configuration that took place initially in a good way,
over the lifespan of thirty years, that could be changed. So,
for example, I mentioned before the idea of vulnerabilities and patches, and one
of the things that you can potentially do is to actually, like through your
vulmerability management and patch management program, you can track the vulnerabilities of their devices
and ensure that the patches that needed to be installed based on your patch manage
or program which is adjusted to your environment, adjusted to the safety constraints,
are actually being installed. And that's something that is essential because you're probably not
going to end up installing all the patches, but you're going to end up
installing at least part of the patches that are needed in order to meet your
objectives. And that's something that we can actually track automatically, So the vulnerability
side and also the installation of patches and the software versions of the devices.
That's one thing. The other thing is actually more more exotic examples of like
systems that haven't been properly segmented at large systems, and one of the challenges
the operator had that they wanted to kind of like divide the system into security
zones and conduits like in the c S four free terminology. So this requires
you effectively to install, of course, some segmentation appliances inside the network,
and they had them in several occations, but several ocasions didn't have. So
one of the things that we could help with through our virtual segmentation capability was
actually to divide automatically or provide suggestion automatically to security zones and conduits over the
environment of that operator and then have the operator kind of enforcing policies or policies
can be enforced for a product in a way that if there is a normal
communication in one of the real application productols between security zones that should not take
place, the system will automatically alert on that and help the operator to fix
this misconfiguration. And that's something that helped them in order to achieve a sort
of a composing and control over lack of segmentation and specific location and later on
to properly segment their system using those insights and accommodations. Thanks for that.
And you know, on the topic of compliance still you've mentioned a few times
there are standards that are out there for cybersecurity in rail systems. There are
standards that are under development. There are standards that are still a gleam in
the eye. You can you survey for us what does the regulatory landscape look
like for cybersecurity and rail systems. I think there are a few things to
look at, like a few dimensions to look at. One is frameworks versus
regulations. The other is the geographical dimension because different countries have their own regulations,
so if we start from the regultary landscape, So in the us PSA,
with the help of csis published a few security directors that are basically used
as regulations and from what we know, more expected to come. In Europe.
The regulations are mostly derived from NISS and niss TO that cover critical infrastructure
in general and realist part of it. But part of it is also for
the member nations to identify their operations operations operators of essential services and kind of
identify how can they comply with the overall directives. And this trend of having
the regulation part of the creetical infrastructure regulation stuff that we've see in rail because
almost every rail operator is part of creetical infrastructure in their country. Other than
that, there is the landscape of standards. So the most comprehensive standard that
is currently available only for rail is called Technical Specification five oh seven oh one
developed by sen Alec and it was published in the end of FLOE twenty one
and this standard is part of an initiative by both operators and suppliers, mostly
from Europe that have taken the IS six two free series and try to identify
how rail is different or where rail is different and developed a sort of like
a paper or technical specification that includes the different phases in the life cycle of
rail systems and how they should be handled in terms of security. One of
the interesting parts, or the unique parts, I think, is the interface
between safety and security, which is the topic that is generally intention So this
tiny specification, it was released in the end of tween twenty one, served
as a basis for another group I'm actually part of part of and it's a
group of IC, which is a global standard organization, and this group took
PS fifty seven to one as well as IC six to four free series,
and it's currently working together to establish this de facto global standard that can be
used by each individual country to align their security within rail systems. Other than
that, you have groups like UATP and app time in the US that are
developing lots of useful papers about things like how should you run a tendering process,
about maturity programs for railway and transit operators, about OT visibility, detection
within rail and all sorts of very interesting topics that I really recommend for anyone
wants to go and dig deeper into the topic to read them and gain more
understanding of how the real environment works and what are the best practices to protect
it. Okay, well, you know this has been good. Thank you
Mickey, thank you for joining us. Before I let you go, you
know, can you sum up for us what should we take away from what
you've been telling us here? So thank you, Andrew. So if I
could summarize it to a few takeaways of first is that it's important to notice
that rail environments they have unique nature and they're very evolving in terms of technologies
that are being used within them. So that's one thing. The second thing
is that in order to operate effectory security within the rail environment, you should
really understand how operations in rail work and the different principles around safety, because
without that, like I feel like it's very hard to get to proper solutions
in securing those environments. And I really recommend to every one of you trying
to secure them to really talk to your operations people and get more understanding of
what's on their mind and what are the risk that they're seeing. The other
thing is that a real tech security platform can really ease your way into securing
your environment, and the changes that you need to make in order to secure
your environment are not as bad as you might think. And other than that,
I just encourage you to visit our website at Silos or at silos dot
com and we'll be happy to assist you with your journey within real cybersecurity.
We have a lot of experience that I really prefer from others to kind of
for others to kind of experre the mistakes that we've seen happening in various places
and try to take the shortcut, and we have to have you for the
journey and help you with our solutions. And of course please feel free to
connect me on linked connect with me on LinkedIn. I'll be happy to chat
with any of you on the topic and having interesting discussions about it. And
of course, thank you very much, Andrew. It was a pleasure chatting
with you to day, and I really look forward to morowpis as our podcast.
Thank you, so, Andrew, that was your interview with Mickey.
Do you have any final thoughts to take us out with today? Yeah,
I mean one of the one of the insights I got from from Mickey was
that this industry is much more heavily regulated than I realized. Yeah, you
know, sorry I didn't interrupt you, but it does bring me back to
a point that we had thought about earlier in the episode. I think he
mentioned that the government has to approve like every patch in this industry, which
correct me if I'm wrong that that that kind of sounds crazy, right in
a sense, it does. But you know, it's all about safety.
I mean, this industry from the very beginning we're talking, you know,
I don't know, the mid eighteen hundreds or something. In my understanding,
this industry has been focused on safety from the very beginning. You know,
to my understanding, the telegraph was invented in large part because or was deployed,
you know, continent wide, in large part because of the needs of
rail systems. You know, if and I don't know what Europe, but
in North America, most of the track that crossed the continent was single track.
You could put one train on it. There wasn't a parallel set of
tracks except at stations where you know, trains had to get by each other
or switch yards, and so one of the inn you know, in my
understanding the history, one of the jobs of the engineer, the person who
ran the engine in the freight trains crossing the continent or passenger trains. If,
for example, the train was not scheduled to stop at a station,
I was taking the track beside the station, blasting on by not even stopping.
One of the functions of the engineer. One of the roles was to
stick their arm out. There was a boom that swung out with a piece
of paper on it. Grab that piece of paper and read it. This
is a telegram telling the engineer whether it's safe to continue on the next section
of track or not, or if there's been a delay and you know there's
or if there's been a derailment or something. Safety has been job one in
this industry since the very beginning, and you know, it persists to this
day. To me, the real challenge that it sounds like is the the
industry is facing is is the dilemma between safety and cybersecurity. In the modern
world, cybersecurity is essential to safety. The threat environment is deteriorating. We
urgently need to make cybersecurity changes to these these you know, safety critical systems
that are the rolling stock in our rail systems. You know, this is
the dilemma that the entire industry it sounds like they're struggling with. And you
know, the good news is not all bad news. The good news is
that folks like Silas are rising to the challenge and they're coming in with technology
and you know, not just a set of technology, but they continue to
to develop and innovate as they're participating in these these industry forums too, you
know, develop solutions that can be deployed against systems both old and new.
Okay, then with that, thank you to Mickey Schiffman for speaking with you.
Andrew, and Andrew, thank you as always for speaking with me.
It's always a pleasure. Thank you. Nick. This has been the Industrial
Security Podcast from Waterfall. Thanks to everybody out there listening.