Protection of Transportation Infrastructure from Cyber Attacks EXECUTIVE BRIEFING

Road Map for Today Why cybersecurity is important Consequences of inaction Common myths Strategic best practices What can be done 2

Today’s transit systems are cyber 3 Fare

Today’s highways are going cyber 4

Consequences can be significant 5 Reputational DamageEconomic Impact Political RepercussionsSafety Impact

Myth Buster: “It won’t happen to us.” There have been many reported cyber incidents in transit already. 6

Myth Buster: “It won’t happen to us.” There have been many reported cyber incidents in transportation already. 7

Myth Buster: “It's possible to eliminate all vulnerabilities in systems.” It is impossible to achieve perfect security. Cybersecurity today is CYBER RESILIENCE. According to a recent Cisco Security Report, all of the organizations examined showed evidence of suspicious traffic and that networks had been breached. Known issues are growing: 50,000+ recorded vulnerabilities with more added hourly; 86,000 new malware reported each day. Breaches are hard to detect: 229 days average time to detect breach More effective strategy is to assume that cybersecurity incidents will happen and focus on mitigating the consequences. 8

Cybersecurity Risk Management: Information and Decision Flows 9

Myth Buster: “It’s all about IT.” People, processes & technology are key to cybersecurity. Fostering a CYBERSECURITY CULTURE goes a long way towards preventing and mitigating cyber incidents. There are parallels to safety. A cybersecurity culture is an environment in which cybersecurity best practices are a way of life. Awareness and training along with established security policies and procedures are important aspects of building cybersecurity culture. Requires active management support in a visible manner. 10

To create a Cybersecurity Culture Establish policies and procedures Allocate resources for training, awareness and implementation Support and champion good practices Security Awareness Cybersecurity Essentials Role-Based Training Education &/or Experience  Increasing Knowledge and Skills  

Myth Buster: “Control system cybersecurity is the same as IT cybersecurity.” Critical to facilitate discussion and interaction between IT, engineering and operational groups. Cybersecurity is generally the responsibility of IT personnel. Control systems are usually the responsibility of engineering and operations personnel. Implementing cybersecurity for transportation control systems requires having a good understanding of security AND the controls systems and the operational environments. 12 CONTROL SYSTEMS Monitor/control PHYSICAL WORLD with emphasis on SAFETY & AVAILABILITY. Risks loss of life or equipment destruction. IT SYSTEMS Collect/process DATA or INFORMATION with emphasis on INTEGRITY & CONFIDENTIALITY. Risk loss of services or confidential information.

Control System Security Challenges SECURITY TOPICINFORMATION TECHNOLOGYCONTROL SYSTEMS Anti-virus & Mobile Code Common & widely usedUncommon and can be difficult to deploy Support Technology Lifetime 3-5 yearsUp to 20 years OutsourcingCommon/widely usedRarely used (vendor only) Application of PatchesRegular/scheduledSlow (vendor specific) Change ManagementRegular/scheduledLegacy based – unsuitable for modern security Time Critical ContentDelays are usually acceptedCritical due to safety AvailabilityDelays are usually accepted24 x 7 x 365 x forever Security AwarenessGood in private and public sectorGenerally poor regarding cybersecurity Security Testing/AuditScheduled and mandatedOccasional testing for outages / audit Physical SecuritySecureRemote and unmanned 13 Source: Volpe

Disparate institutional, cultural and organizational domains collide Cybersecurity Professionals Cybersecurity Professionals Transportation Professionals Transportation Professionals 14

Expert resources & guidance exist 15 Industry Textbooks & Technical Papers DHS, FHWA & APTA Resources APTA Recommended Practices NIST Framework NIST ICS Guide COBIT & SANS

Strategic best practices Incorporate cyber risks into existing risk management and governance processes. Elevate cyber risk management discussions to the C-suite. Implement industry standards and best practices. Evaluate and manage your organization’s specific cyber risks. Provide executive oversight and review. Develop and test incident response plans and procedures. Coordinate cyber incident response planning across the enterprise. Maintain situational awareness of cyber threats. 16

CEO role in cybersecurity Set the tone from the top Expand organizational risk decision-making and mission priorities to include cyber security Advocate for cyber “secure” policies in procurement rules, HR policies, and state/regional systems and processes. 17