Rail industry gets new cyber directives from TSA

[UserNameRequired]

I suppose this will be something to keep Amtrak IT busier:

https://www.cyberscoop.com/rail-transportation-directives-dhs/

 

[John Santos]

The devil is in the details, but the claim is the TSA is simply requiring that rail companies adhere to computer industry best practices, and also establishes a standardized reporting system if and when computer security incidents occur. If they are already doing this, then it should be a matter or filling out a checklist confirming it and putting a post-it note on the wall in their computer operations centers with the phone number of the TSA.

On the other hand, sometimes new security requirements open enormous cans of worms and take years of administrative, programmer and user training time, force wholesale system changes and abandonment of perfectly secure and robust systems because they don't meet some arbitrary criteria (like they weren't manufactured in Redmond, WA), replacing them with far less secure and robust systems that, due to rushed implementation, attempts at cost cutting or incompetence, never work correctly. It could be a disaster.

I've seen both kinds of mandates (imposed both from within and without the company) in the communications and health care fields. Usually they are somewhere in between, and if the the requirements are developed by competent, up-to-date security experts, the goals are usually worthwhile, flexible and not extremely arduous to meet. However, unless this has been in the works for years and the railroads have been involved all along, the deadline is very soon. I hope this isn't a rush job, because those seldom work out well.

 

[neroden]

The dispatching center is *the* danger point for malicious attacks on the rail system, so for dispatching and signalling, this does make sense.

 

[west point]

I almost wonder that NS' s auto router i being subject to some kind of lack of security? There certainly seems to be something wrong into CHI and the NOL - ATL section.

 

[jis]

I almost wonder that NS' s auto router i being subject to some kind of lack of security? There certainly seems to be something wrong into CHI and the NOL - ATL section.

You'd know something is really wrong when all the Chicago trains land up in New Orleans