July/August 2023 - 12

Cyber Attackers
are Coming for
Transit Agencies,
Here's How to
Strengthen Your
Security Posture
Protecting transit agency assets and those of
the riding public can be bolstered by following
cybersecurity best practices, setting response
plans in place and being proactive.
BY DAV I D AVE RY
T
he demand from riders for convenient, reliable and efficient public
transit systems has prompted transit agencies to implement
new and innovative technologies as a catalyst for smart cities.
Transit systems have continually implemented more and more
technology, especially during the height of the pandemic, with
riders pushing for contactless, mobile-based fare collection and
modernized systems. With this smart city boom, rapid development
and implementation of new technology into existing
transit systems and operations, a vast amount of data is collected.
Whenever sensitive data is collected and stored, there is an
increased cybersecurity risk.
A Recent Increase in Cyberattacks
Earlier this year, Washington Metropolitan Area Transit Authority's
(WMATA) cloud-based computer network was breached
by a personal computer in Russia. It was later discovered this
cyberattack was initiated by a former IT employee contracted
by WMATA. The WMATA Inspector General's Office found
the authority's increased reliance on technology had created
long-standing security issues and increased vulnerabilities that
could have included threats to train safety for a system that more
than 600,000 people rely on every day.
More recently, the U.S. Department of Transportation reported
a data breach in May that affected administrative systems
processing employee transportation benefits. This breach exposed
237,000 current and former employees' personal information.
While an investigation into this breach is underway, the transportation
benefit system has been frozen.
12 Mass Transit | JULY/AUGUST 2023
Given recent events, it's clear why cybersecurity
has become increasingly top
of mind in today's transit landscape. The
risk of a cyberattack is real, and it can be
extremely damaging. From riders' personal
information being leaked like payment
details and social security numbers to the
disruption of a transit system's operations
and widespread outages, the negative impact
is severe and can damage an agency's
reputation, creating doubt from customers
and having long-term effects.
While technology can bring cybersecurity
risks, it's also incredibly beneficial
and necessary for agencies to implement
to meet customer demands, stay competitive
and provide the best rider experience.
Being proactive, following best practices
and having plans in place in case of a
threat are all ways to utilize innovative
technologies while improving your cybersecurity
posture.
Strategies to Mitigate Risks
The Transportation Security Administration
requires freight railroads, passenger
rail and rail transit owners and operators
to " designate a cybersecurity coordinator,
Image: 312652667 | Adobe Stock
July/August 2023

Table of Contents for the Digital Edition of July/August 2023
