On the relationship of hazards and threats in railway signaling

This paper discusses the relationship of hazards and threats in railway-related safety and security standards. It points out similarities but also gaps and proposes improvements. It is shown that, in particular, the approaches to risk analyses and the definition of safety and security differ substantially so that these processes should be treated separately. The general goal should be the separation of safety and security concerns as far as possible, which might help in the integration and maintainability of safety and security certificates. A particular goal could be to use certified COTS security components also in the railway signaling domain, instead of creating a new certification framework.