November 2022 - 19

Cybersecurity
* There are things she doesn't
know that she doesn't know
Like cybersecurity in transit
agencies, we celebrate the first, I
try to help her with the second, we
talk about the third, and the simple
awareness of the last is a win as she
works to discover the unknowns.
In much the same way that my
daughter faces an ever-more-challenging
world, APTA is concerned
with the need for better cybersecurity
preparedness in its member
transit agencies, large and small.
To help alleviate the problem,
one of APTA's many standards
working groups, the Control
and Communications Security
Working Group (CCSWG), has
been writing recommended practices
and white papers for the industry
for the past 14 years. The
CCSWG differentiates Control
and Communications Operational
Technology from IT Enterprise
Technology. Cyberattacks can
cause great harm in ICS areas.
Most recently, in response to
requests from APTA's membership,
the Transportation Security
Administration (TSA) and others,
the working group has developed
an Operational Technology - Cybersecurity
Maturity Framework
(OT-CMF) overview for launching
and maturing an OT program.
This framework enables and empowers
transit agencies to plan,
implement, measure, monitor,
and mature their OT cybersecurity
program, so they can respond
to the evolving cyber threats undermining
critical service delivery
and safety. Transit agencies
will be able to implement the
maturity framework to use what
" they know they know " to work
toward understanding the threats
presented from the unknown and
always with the goal of maturing
and reaching a high state of prepared
resilience.
The OT-CMF draws from existing
NIST standards like NIST
800-53 (Security and Privacy Controls
for Information Systems and
Organizations), and its overlay,
Physical security
Transit controls
and communications
cybersecurity
Logical/administrative security
Existing standards and
practices NERC/CIP,
NIST, IEEE and others
Collaboration
Transit agencies
Transit enterprise
cybersecurity
Consultants
Government
APTA standards
development
working groups
(DHS, TSA, Volpe, etc.)
Vendors
Recruitment and expertise
TRANSIT AGENCIES must ensure that their cybersecurity plans address both the
traditional information technology (IT) systems and the operational technology (OT)
or industrial control systems (ICS).
APTA Control and Communications Security Working Group
NIST 800-82 (Guide to Industrial
Control Systems (ICS) Security),
as well as NERC-CIP (National
Electrical Reliability Council -
Critical Infrastructure Protection)
and various IEEE standards.
At this point, there is a need
to differentiate the term requirements
from controls. Whereas
requirements are obligatory,
controls are selected according
to the organization. NIST 80053
describes controls as:
" Controls can be viewed as descriptions
of the safeguards and
protection capabilities appropriate
for achieving the particular
security and privacy objectives of
the organization and reflecting
the protection needs of organizational
stakeholders. Controls are
selected and implemented by the
organization in order to satisfy
the system requirements. "
The CCSWG distilled the 965
controls in NIST 800-53 and
800-82 into 134 controls for the
Cybersecurity Maturity Framework.
Each control is numbered
according to its topic.
Each agency is different in
size, talent and financial resourcing,
so the OT-CMF attempts to
help organizations move past
the " one-size-fits-all " approach
to security. Within these controls
lies the recipe for maturing individual
transit agencies.
With careful, thoughtful work
to build an agency-specific OT
cybersecurity program, transit
agencies can move their organizations
up through the maturity
levels. The goal is better identification
of incidents, detection of
anomalies, protection of systems,
faster response and an organized
approach to recovery.
NOVEMBER 2022 | MassTransitmag.com | Mass Transit | 19
http://www.MassTransitmag.com
November 2022

Table of Contents for the Digital Edition of November 2022
