Rail Security – “Unsafe at any Speed”

A good discussion with a friend, something I am doing at a moment in time, or a memory from the past is usually what entices me to sit down and write a blog (aka social commentary). And an article is totally different than when I am writing a regulatory guidance, project plan, or solutions brief where everything must follow a focused direction to be done right.

This blog was spurred on as I was riding the train through the Nordic Region after some incredible partner meetings in Sweden and Finland. The past week I rode on more trains than I have in many years and the trains I was on were vastly different than the freight-hauling one currently dominating the news back stateside. The trains I was riding on had all the comforts of an office on rails with a restaurant, plush leather chairs, and even an area for the children to play. They also travel at speeds of 180 KPH or higher, which for those of us who live on the other side of the pond (and do not use the metric system) is more than 110MPH.

The freight train that crashed in Ohio, which did not include any of the above-mentioned comfort amenities but did include cars carrying chemicals such as vinyl chloride, butyl acrylate, ethylene glycol, isobutylene, and ethylhexyl acrylate was going one-half to one-third of that 110 MPH speed.
One common factor in both trains described above is that both trains have wheel bearings, and all wheel bearings are prone to fail in time, which is what happened to the freight train in East Palestine, Ohio.
The reason I am making this comparison is that any mode of transportation is prone to accidents that can have serious consequences for environmental safety and human life. Some of the ways to reduce the risk of accidents are preventive maintenance, safety and operational training, and monitoring/safety systems.
There are things in the physical world that can be implemented to reduce the risk of train accidents such as Positive Train Control (PTC), vibration control sensors, and electric brakes, but those brakes require electrical power and freight cars do not have such a luxury.

When we look at the cyber security aspect of rail, you will generally find agencies like ENISA (European Union Agency For Cybersecurity) or Rail Information Security Committee (RISC) in North America publish best practices for cyber risk management coupled with risk scenarios such as compromising a signal system or traffic supervising system or a leak of client personal or sensitive data.

What you do not generally see are combined physical and cyber scenarios of notifications for sensing when a train, track, or operator control has a deviation from baseline or how to alert and act if they deviate from an indicated pattern. To take this one step further, the derailment in Ohio has shown patterns of management telling operational staff to skip safety checks, staff ignoring wheel bearing warning alarms, and even inconsistent placement of wheel temperature sensors along the tracks to detect failures.

One area that needs to be explored deeply during this accident post-mortem is ways to improve the integration between the physical controls of rail, the strengthening of safety/auditing processes, and cyber monitoring systems to help to reduce accidents as it has in the airline, shipping, and other industries. And with this should come to a deeper alignment with cyber risk scenarios that are played out in tabletops, internal training, and incident response plans.

Ironically for the past decade in the United States, the Federal Railroad Administration has been toying with the notion of having freight trains traveling at speeds approaching what passenger bullet trains travel, which is just as fast or faster than the ones I rode in Europe.

This notion immediately jogged another memory of mine about a book written by Ralph Nader entitled “Unsafe At Any Speed” which dealt with car manufacturers resisting the introduction of safety features such as seatbelts, setting tire pressure for comfort, not safety and not installing stabilizer bars due to cost which would have prevented deadly rollovers.

Hopefully, this accident is a wake-up call to the world and we work globally to make rail systems around the globe safer.

Kevin Kumpf

Kevin Kumpf has more than 20 years of IT security and compliance experience, including over 10 years of cybersecurity, governance and critical infrastructure experience working in the energy, medical, manufacturing, transportation and FedRAMP realms. Kevin’s past roles include Director of OT Security (N.A.) for Iberdrola, where he oversaw the security, and regulatory compliance of multiple OpCo’s, and Principal Security and Regulatory Lead for interactions with the NY and NE ISO’s, NERC, ISAC’s as well as state and federal entities. He has also worked internally and as a vendor/consultant at multiple healthcare and manufacturing entities to mitigate the threats they were under in relation to ransomware, insider threats and malware infestation. Today Kevin works as the Chief OT Strategist at Cyolo.