CLC/TS 50701:2023
(Main)Railway applications - Cybersecurity
Railway applications - Cybersecurity
This document provides railway operators, system integrators and product suppliers, with guidance and specifications on how cybersecurity will be managed in the context of EN 50126 1 RAMS lifecycle process. This document aims at the implementation of a consistent approach to the management of the security of the railway systems. This document can also be applied to the security assurance of systems and components/equipment developed independently of EN 50126 1:2017. This document applies to Communications, Signalling and Processing domain, to Rolling Stock and to Fixed Installations domains. It provides references to models and concepts from which requirements and recommendations can be derived and that are suitable to ensure that the residual risk from security threats is identified, supervised and managed to an acceptable level by the railway system duty holder. It presents the underlying security assumptions in a structured manner. This document does not address functional safety requirements for railway systems but rather additional requirements arising from threats and related security vulnerabilities and for which specific measures and activities need to be taken and managed throughout the lifecycle. The aim of this document is to ensure that the RAMS characteristics of railway systems / subsystems / equipment cannot be reduced, lost or compromised in the case of cyber attacks. The security models, the concepts and the risk assessment process described in this document are based on or derived from the IEC/EN IEC 62443 series. This document is consistent with the application of security management requirements contained within IEC 62443 2 1, which in turn are based on EN ISO/IEC 27001 and EN ISO 27002.
Bahnanwendungen - Cybersecurity
Applications ferroviaires - Cybersécurité
Železniške naprave - Kibernetska varnost
Ta dokument podaja smernice in specifikacije za upravljavce železniških naprav, integratorje sistemov in dobavitelje izdelkov v zvezi z upravljanjem kibernetske varnosti v kontekstu procesa življenjskega cikla RAMS iz standarda EN 50126-1. Cilj tega dokumenta je uvedba doslednega pristopa k upravljanju varnosti železniških sistemov. Uporabiti ga je mogoče tudi za zagotavljanje varnosti sistemov, komponent in opreme, razvitih neodvisno od standarda EN 50126.
Ta dokument se uporablja za komunikacijo, signaliziranje in obdelavo signalov, železniška vozna sredstva ter fiksne postroje. Vsebuje sklice na modele in koncepte, iz katerih je mogoče izpeljati zahteve oziroma priporočila in ki so primerni za zagotovitev, da oseba, ki je odgovorna za železniški sistem, zmore ustrezno prepoznati, nadzirati in upravljati preostalo tveganje zaradi varnostnih groženj. Osnovne varnostne predpostavke so v tem dokumentu strukturirano predstavljene.
Ta dokument ne obravnava zahtev glede funkcionalne varnosti za železniške sisteme, temveč dodatne zahteve, ki izhajajo iz varnostnih groženj in povezanih ranljivosti ter za katere je treba sprejeti posebne ukrepe in dejavnosti ter jih upravljati skozi celoten življenjski cikel. Namen te tehnične specifikacije je zagotoviti, da značilnosti RAMS železniških sistemov, podsistemov in opreme v primeru namernih napadov ni mogoče zmanjšati, izgubiti ali ogroziti.
Modeli varnosti, koncepti in postopek ocenjevanja tveganja, opisani v tem dokumentu, temeljijo na skupini standardov IEC 62443 oziroma iz nje izhajajo. Ta dokument je zlasti skladen z uporabo zahtev za upravljanje varnosti, ki jih vsebuje standard IEC 62443-2-1 ter ki temeljijo na standardih EN ISO 27001 in EN ISO 27002.
General Information
Relations
Standards Content (Sample)
SLOVENSKI STANDARD
01-januar-2024
Železniške naprave - Kibernetska varnost
Railway applications - Cybersecurity
Bahnanwendungen - IT-Sicherheit
Applications ferroviaires - Cybersécurité
Ta slovenski standard je istoveten z: CLC/TS 50701:2023
ICS:
35.030 Informacijska varnost IT Security
45.020 Železniška tehnika na Railway engineering in
splošno general
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
TECHNICAL SPECIFICATION CLC/TS 50701
SPÉCIFICATION TECHNIQUE
TECHNISCHE SPEZIFIKATION August 2023
ICS 35.030; 45.020 Supersedes CLC/TS 50701:2021
English Version
Railway applications - Cybersecurity
Applications ferroviaires - Cybersécurité Bahnanwendungen - Cybersecurity
This Technical Specification was approved by CENELEC on 2023-06-19.
CENELEC members are required to announce the existence of this TS in the same way as for an EN and to make the TS available promptly
at national level in an appropriate form. It is permissible to keep conflicting national standards in force.
CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Croatia, Cyprus, the Czech Republic,
Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the
Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Türkiye and the United Kingdom.
European Committee for Electrotechnical Standardization
Comité Européen de Normalisation Electrotechnique
Europäisches Komitee für Elektrotechnische Normung
CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2023 CENELEC All rights of exploitation in any form and by any means reserved worldwide for CENELEC Members.
Ref. No. CLC/TS 50701:2023 E
Contents Page
European foreword . 6
Introduction . 7
1 Scope . 8
2 Normative references . 8
3 Terms, definitions and abbreviations . 8
3.1 Terms and definitions . 8
3.2 Abbreviations . 24
4 Railway system overview . 27
4.1 Introduction 27
4.2 Railway asset model 28
4.3 Railway physical architecture model 29
4.4 High-level railway zone model 30
5 Cybersecurity within a railway application lifecycle . 32
5.1 Introduction 32
5.2 Railway application and product lifecycles 32
5.3 Activities, synchronization, and deliverables 32
5.4 Cybersecurity context and cybersecurity management plan 36
5.5 Relationship between cybersecurity and essential functions 36
5.5.1 General . 36
5.5.2 Defence in depth . 36
5.5.3 Security-related application conditions . 37
5.5.4 Interfaces between cybersecurity and design team. 38
5.5.5 Interfaces between the safety and the cybersecurity processes . 38
5.6 Cybersecurity assurance process 41
6 System definition and initial risk assessment . 42
6.1 Introduction 42
6.2 Identification of the system under consideration 43
6.2.1 Definition of the SuC . 43
6.2.2 Overall functional description . 43
6.2.3 Access to the SuC . 43
6.2.4 Essential functions . 44
6.2.5 Assets supporting the essential functions . 44
6.2.6 Threat landscape . 44
6.3 Initial risk assessment 45
6.3.1 Impact assessment . 45
6.3.2 Likelihood assessment . 46
6.3.3 Risk evaluation . 47
6.4 Partitioning of the SuC 47
6.4.1 Criteria for zones and conduits breakdown . 47
6.4.2 Process for zones and conduits breakdown . 48
6.5 Output and documentation 49
6.5.1 Description of the system under consideration . 49
6.5.2 Documentation of the initial risk assessment . 49
6.5.3 Definition of zones and conduits . 49
7 Detailed risk assessment. 49
7.1 General aspects 49
7.2 Establishment of cybersecurity requirements 51
7.2.1 General . 51
7.2.2 Threat identification and vulnerability identification . 52
7.2.3 Vulnerability identification . 54
7.2.4 Risk acceptance principles . 55
7.2.5 Derivation of SL-T by explicit risk evaluation . 56
7.2.6 Determine initial SL . 58
7.2.7 Determine countermeasures from EN IEC 62443-3-3. 59
7.2.8 Risk estimation and evaluation . 60
7.2.9 Determine security level target . 61
7.2.10 Cybersecurity requirements specification for zones and conduits . 62
8 Cybersecurity requirements . 63
8.1 Objectives 63
8.2 System security requirements 63
8.3 Apportionment of cybersecurity requirements 79
8.3.1 Objectives . 79
8.3.2 Break down of system requirements to subsystem level . 80
8.3.3 System requirement allocation at component level . 80
8.3.4 Specific consideration for implementation of cybersecurity requirement on components . 81
8.3.5 Requirement breakdown structure as verification . 81
8.3.6 Compensating countermeasures . 81
9 Cybersecurity assurance and system acceptance for operation . 83
9.1 Overview 83
9.2 Cybersecurity case 84
9.3 Cybersecurity verification 85
9.3.1 General . 85
9.3.2 Cybersecurity integration and verification . 85
9.3.3 Assessment of results . 87
9.4 Cybersecurity validation 87
9.5 Cybersecurity system acceptance 88
9.5.1 Independence . 88
9.5.2 Objectives . 88
9.5.3 Activities . 88
9.5.4 Cybersecurity handover . 88
10 Operational, maintenance and disposal requirements . 89
10.1 Introduction 89
10.2 Vulnerability management 89
10.3 Security patch management 90
10.3.1 General . 90
10.3.2 Patching systems while ensuring operational requirements . 91
Annex A (informative) Handling conduits . 94
Annex B (informative) Handling legacy systems . 97
Annex C (informative) Cybersecurity design principles . 103
Annex D (informative) Safety and security . 132
Annex E (informative) Risk acceptance methods . 136
Annex F (informative) Railway architecture and zoning . 144
Annex G (informative) Cybersecurity deliverables content . 161
Bibliography . 164
Figures
Figure 1 — Segregation of IT and OT . 27
Figure 2 — Railway asset model (example) . 28
Figure 3 — Railway physical architecture model (example) . 29
Figure 4 — Generic high-level railway zone model (example) . 31
Figure 5 — Defence in depth with example of measures . 37
Figure 6 — Synchronisation between cybersecurity team and other stakeholders . 40
Figure 7 — Relationship Threat Risk Assessment and Security Assurance . 41
Figure 8 — Initial risk assessment flowchart . 42
Figure 9 — Detailed risk assessment flowchart . 52
Figure 10 — Explicit risk evaluation flowchart . 58
Figure 11 — Handling of SL-C . 82
Figure 12 — Cybersecurity assurance . 83
Figure 13 — Cybersecurity case concept . 84
Figure 14 — Cybersecurity assurance during integration and validation activities . 86
Figure 15 — General vulnerability handling flowchart . 90
Figure 16 — Vulnerability and outage time during system update (maintenance phase) [example] . 92
Figure 17 — Vulnerability and outage time during system update with observation phases [example] . 93
Figure A.1 — Zones and conduits example . 95
Figure D.1 — Security as an environmental condition for safety . 133
Figure F.1 — Adopted generic high-level railway zone model (example) . 151
Figure F.2 — Example of a railway system zone model . 152
Tables
Table 1 — Security-related activities within a railway application lifecy
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.