Cybersecurity for Transit & Transportation
Cybersecurity for Transit and Transportation Agencies
Security programs for agencies that run signals, train control, fare payment, and public services without taking any of it offline.
A transit agency or transportation department runs technology that cannot stop. Traffic signals hold intersections, train control keeps separation between vehicles, fare gates open, and the arrival prediction on a rider's phone has to be right. Much of that equipment was specified by engineering or operations rather than by IT, sits in roadside cabinets and equipment rooms rather than a data center, and is expected to last for decades. Around it sits ordinary enterprise IT: email, finance, human resources, maintenance management, and a public website. The two worlds are connected, usually in more places than anyone has documented.
Security work here is less about buying tools than about deciding where controls belong. A measure that is routine on the business network can be unacceptable on a signal network, and a fare payment environment carries obligations that have little to do with either. At the same time the agency answers to a board, to the federal agencies that fund it, and, in the case of ports and airports, to security regulators whose expectations now include cybersecurity.
What these environments look like
- Traffic signal controllers, ramp meters, cameras, and other field devices connected over agency fiber, leased circuits, cellular, or radio, on long replacement cycles
- Rail and bus operations systems: train control, SCADA for traction power and tunnel ventilation, vehicle location, dispatch, and radio, all under vendor change control
- Fare collection moving toward account-based and mobile payment, which places cardholder data and PCI DSS obligations inside a transit agency
- Port and airport systems including badging and physical access control, terminal and gate systems, cargo and terminal operating systems, and camera networks shared with tenants, carriers, and other agencies
- Public-facing services: trip planning, real-time arrival feeds, service alerts, permit portals, and open data
- Standing vendor and integrator remote access into operational systems, frequently created during construction and rarely reviewed since
- A small security staff inside IT, while the operational systems belong to departments that do not report to the IT director
Where HQT helps
- Assessments against the NIST Cybersecurity Framework and the CIS Controls, with operational technology scoped separately using guidance such as NIST SP 800-82, so that findings distinguish the business network from the systems that move vehicles
- Asset inventory and segmentation design separating operational technology, fare and payment systems, business systems, and public Wi-Fi, which also reduces the footprint subject to PCI DSS
- Zero Trust applied where it fits: identity consolidation, multi-factor authentication on email and remote access, and brokered, time-limited, logged vendor sessions in place of standing connections, with a plain statement of which legacy field devices cannot participate and what compensates for them
- Vulnerability management built around maintenance windows and service hours, including a defensible approach for devices that cannot be patched, and testing methods chosen so that nothing active runs against a control network without operations leading
- Monitoring and incident response: passive detection on operational networks, log collection from business and payment systems, response plans that include manual operating procedures and public communication, and tabletop exercises with operations, safety, communications, and executive staff in the room
- Compliance support for the obligations that apply to a particular agency, which may include federal transportation security directives covering certain higher-risk rail and transit operators, Coast Guard maritime security requirements at regulated port facilities, PCI DSS for fare payment, and conditions attached to federal grant funding
- Security awareness built for the workforce that actually exists, including operators, maintenance technicians, and customer service staff who do not sit at a desk, with attention to vendor impersonation and payment fraud
How an engagement usually starts
The trigger is rarely an incident at the agency itself. More often it is an incident at a peer agency that a board member read about, an insurance renewal questionnaire asking about controls nobody has inventoried, a new federal requirement or grant condition, or a capital project about to add connectivity to a system that has been isolated for its entire life. Fare system replacements are a common starting point, because the procurement forces someone to answer what happens to card data and who is responsible for it.
The first step is a scoped assessment with an agreed boundary. In practice that means walking a signal cabinet, a station, or a terminal with the people who maintain it, collecting inventory by read-only means, interviewing operations staff and vendors, and reviewing how remote access is granted today rather than how the policy says it should be. The output is a prioritized set of findings, costed well enough to enter a budget cycle, and separated into what IT can do on its own, what requires the system integrator, and what belongs in the scope of the next capital project. Work of this kind proceeds with operations leading any change to systems that carry vehicles or passengers.