Aecom Limited, which has a managed services framework agreement with Network Rail.
September 2019 – January 2020
A severe, yet plausible cyber-attack against the US power-grid alone would result in a mega costly ‘business blackout’.
In the first quarter of 2021 the UK Government Cyber Security Survey reported 4 in 10 businesses suffered cyber attacks.
Chemicals, Civil Nuclear, Communications, Defence, Emergency Services, Energy, Finance, Food, Government, Health, Space, Transport and Water.
Under contract to Network Rail (NR) via Aecom and Egis Rail, we were asked to review and update a set of CAF (Cyber Assessment Framework) assessments and recommend practical remediations where necessary to the Signalling and E&P (Electrification and Plant) Systems.
Each of the identified critical systems within the Signalling and E&P (Electrification and Plant) groups was assessed for CAF (Cyber Assessment Framework) objectives, using the following sources of information:
The approach to the CAF assessments was to provide a technical document-based review of each system, based on available documentation, policies and procedures, which was then supplemented by input from operational staff who have working knowledge of the system ‘as operated’. This provides valuable insight into the system and a more realistic view of the system’s vulnerability to cyber threats. It also provides valuable insight into organisational and cultural factors that can be critical factors in the effectiveness of human defences against cyber threats.
We produced a detailed report covering our assessment of critical E&P (Electrification and Plant) and Signalling systems against the Department for Transport CAF (Cyber Assessment framework). The report also included remediation recommendations resulting from the assessment.
Alongside detailed system-specific remediation recommendations, the final report identified a number of general themes which provided insights into suitable approaches and activities which could further increase the effectiveness of Network Rail’s defences against cyber-attack and ransomware. These common themes provided an opportunity to implement a more central solution to provide compliance benefits across multiple systems.
We provided both general remediations and system-specific remediations in the final report. The remediation plans focus on the following aspects:
