Securing a railway control system

This paper describes the key aspects of implementing a cybersecurity management system (CSMS) for a software-based railway signal control system (RCS). It highlights the difficulties encountered during the delivery of a secured RCS and offers possible strategies for ensuring that a systematic and yet practical approach to cybersecurity risk management is followed and can be effectively sustained throughout the whole life of the system. The observations herein were derived from several urban rail signal control system projects in London the author has participated in over the past twenty years.