Transportation Cybersecurity

What is transportation cybersecurity?

Transportation cybersecurity is the practice of protecting connected vehicles, vessels, aircraft, rail systems, and their supporting infrastructure from cyberattacks. As transportation adopts connected and autonomous technologies, remote connectivity delivers efficiency gains but also exposes systems that were originally designed with no expectation of remote access, such as a vehicle’s CAN bus.

The transportation sector spans five interconnected domains — aviation, maritime, rail, vehicles, and autonomous systems — each with distinct architectures but shared risks: long equipment lifecycles, complex supplier chains, and safety-critical operations. A cybersecurity failure in any one component can cascade into supply-chain disruption, economic damage, or physical safety incidents.

____________________________________________________________________________

Why does connectivity increase cybersecurity risk in transportation?

Connectivity increases risk because it violates design principles that held true for decades. Systems like the vehicle CAN bus were engineered on the assumption that no remote access was possible. When manufacturers added connectivity for efficiency and features, they exposed these legacy systems to remote attackers they were never designed to withstand.

These technical risks carry outsized reputational consequences. Even when a security incident originates in a component made by a Tier 2 supplier, the reputational damage falls most heavily on the OEM or fleet operator whose name is on the product. This dynamic makes cybersecurity a board-level concern across the entire transportation supply chain, not just an engineering detail.

____________________________________________________________________________

What are the main domains of transportation cybersecurity?

Transportation cybersecurity covers five domains, each with its own attack surface and regulatory environment:

Each domain is examined in detail in the sections below.

____________________________________________________________________________

What are the cybersecurity risks in aviation?

Aviation cybersecurity risk stems from vulnerabilities in both Information Technology (IT) and Operational Technology (OT) systems across aircraft and airports. A single vulnerable component from a supplier can trigger a broader incident that degrades trust between vendors, OEMs, operators, and passengers — or even puts lives at risk — while also threatening supply chains and national security.

Documented research in aviation has identified vulnerabilities in in-flight entertainment systems and in the backend codebases and core networks of Boeing 787 Dreamliners. Penetration testing has also targeted cabin management systems and their mobile applications, which control aircraft functions such as temperature and lighting.

What are the cybersecurity challenges at airports?

Airport cyber-physical security (CPS) systems fall into three broad categories, each managed through network-connected digital controllers:

• OT systems — baggage handling, refueling systems, runway lights, building management, and SCADA/ICS
• IT systems — conventional data and network infrastructure
• Ground vehicles — networked vehicles operating airside

OT systems are less organized and rarely monitored as closely as conventional IT networks, which widens the attack surface. Persistent threats against the aviation sector have included malicious actors specifically targeting the U.S. aviation industry through interactions with known malicious IP addresses, phishing, brute-force attacks, and attempts to install network backdoors.

What is TSA Emergency Amendment 23-01 for aviation?

In March 2023, the Transportation Security Administration (TSA) issued Joint Emergency Amendment (EA) 23-01, “Cybersecurity – Performance-Based Measures,” in response to increased threats at airports and airlines. It applies to Category I and II airports worldwide and requires cybersecurity assessments of critical systems such as baggage handling and airport refueling systems, plus submission of identifying information to the TSA.

____________________________________________________________________________

What are the cybersecurity risks in the maritime industry?

Maritime cybersecurity risk arises from smart, connected technologies creating an attack surface that ship designers of past decades never anticipated. Satellite communications (SATCOM) keep logistics and operations running, but threats to these systems endanger not only economies but also national security, given the maritime industry’s central role in global trade.

Key maritime risks include remote hardware connectivity, insecure protocols, weak authentication and access controls, zero-day vulnerabilities in logistics systems, and exploits that tamper with vessel telematics. Additional challenges involve vulnerable onboard software, and GPS, GNSS, and obstacle-detection systems.

What are the three areas of the maritime cybersecurity ecosystem?

Maritime cybersecurity is organized around three ecosystem areas spanning both IT and OT:

• Vessel — SATCOM, IT/OT, navigation systems, and networks
• Ports — networks and facility warehouses
• Infrastructure — shore infrastructure interfaces

Assessment work in this space has included exploring very small aperture terminals (VSAT) and associated technologies, red team assessments of Security Operation Centers (SOCs), and penetration testing of intermodal terminal operating systems, core vessel information systems, and remotely operated vessels — as well as evaluating onboard crew awareness and incident response.

____________________________________________________________________________

What are the cybersecurity risks in rail transportation?

Rail cybersecurity risk is driven by long equipment lifecycles, complex supply chains and architectures, and the safety-critical nature of rail services. Rail operators serving major hubs are prime targets, and freight rail forms part of the intermodal network — alongside trucking, maritime shipping, ports, and warehousing — that underpins the global supply chain.

Four factors make rail cybersecurity an escalating concern: interconnectivity, state-of-the-art technology, the growing sophistication of cyberattacks, and the increasing value of rail assets. Breaches in this sector frequently lead to data theft, network compromise, and ransomware blackmail attempts, and the global supply chain faces rising kinetic and cyber threats from geopolitical pressures.

What rail systems require cybersecurity assessment?

Security assessments in rail cover a wide range of locomotive and network systems, including:

• Event recorders and train door control systems
• Remote control and distributed power networks
• Dispatch setups and locomotive monitoring software
• Positive Train Control (PTC) systems
• Web-based and cloud-based systems
• Wireless and RF locomotive systems

What are the TSA rail cybersecurity directives?

In October 2023, the TSA updated three security directives to strengthen cybersecurity preparedness and resilience for the nation’s critical railroad operations:

1. Enhancing Rail Cybersecurity
2. Enhancing Public Transportation and Passenger Railroad Cybersecurity
3. Rail Cybersecurity Mitigation Actions and Testing

These directives aim to reduce the risk that cybersecurity threats pose to critical railroad operations and facilities.

____________________________________________________________________________

What are the cybersecurity risks for connected vehicles?

Connected-vehicle cybersecurity risk comes from modern network architectures, internet-connected hardware, and sophisticated firmware that make vehicles attractive targets for attackers. Electric vehicles, autonomous functions, smart sensors, infotainment, and mobile connectivity improve user experience and logistics but each introduces a new entry point for compromise.

The Software-Defined Vehicle (SDV) now dominates the automotive market. SDVs use hypervisors, networking, and smart technologies to deliver advanced safety features such as mapping, automation, and driver assistance — and their complexity is set to grow with next-generation machine learning and AI. Documented vehicle research spans local and remote CAN bus attacks, the widely recognized 2014 Jeep hack, commercial truck testing, EV supply equipment (EVSE), Electronic Brake Control Modules (EBCMs), infotainment systems, and vehicle motion and position sensors.

What is a Threat Analysis and Risk Assessment (TARA) for vehicles?

A Threat Analysis and Risk Assessment (TARA) is a structured method for identifying threats to a vehicle and determining the most appropriate security controls to protect vehicles and their components. TARA supports secure design goals from the earliest stages and is performed in compliance with the ISO/SAE 21434 standard to ensure high levels of cyber resilience.

Which cybersecurity standards apply to connected vehicles?

Connected-vehicle security work aligns with several international standards and regulations:

____________________________________________________________________________

What are the cybersecurity risks for autonomous vehicles?

Autonomous vehicle cybersecurity risk centers on the AI and machine learning systems that let vehicles interpret road conditions, identify objects, predict traffic, and make real-time decisions. Because connectivity enables these capabilities, it simultaneously exposes autonomous and remote-controlled systems to attacks that can affect functional safety.

The first successful remote attack on a vehicle through its telematics unit was launched in 2015, demonstrating that a moving car could be accessed and controlled remotely. Autonomous and remote-controlled technologies now extend across automobiles, commercial trucks, and agricultural equipment, and securing them requires assuming the posture of a real-world attacker attempting to bypass controls and reach connected systems or the vehicle itself.

Why do telematics and EV charging equipment increase autonomous vehicle risk?

Telematics systems (used in automobiles, commercial trucks, agriculture and mining vehicles, and sea cranes) and Electric Vehicle Supply Equipment (EVSE) both rely on remote cloud infrastructure, which raises their exposure. Their most common risks are:

• Weak or unencrypted communications
• Over-the-air (OTA) firmware attacks
• Insecure APIs
• Weak or vulnerable cloud services

How is AI/ML security assessed in autonomous vehicles?

AI/ML security for autonomous systems is assessed through proven methodologies that cover every facet of the AI/ML stack:

• Threat modeling and architecture review
• AI/ML code review and vulnerability assessment
• Application and device penetration testing
• AI infrastructure security

____________________________________________________________________________

How do transportation cybersecurity risks connect across domains?

Transportation cybersecurity risks are interconnected because aviation, maritime, rail, vehicle, and autonomous systems share the same underlying weaknesses: legacy designs never built for connectivity, complex multi-tier supplier chains, safety-critical functions, and reliance on cloud and wireless infrastructure. A vulnerability in one domain frequently mirrors vulnerabilities in the others.

Freight rail, trucking, maritime shipping, ports, and warehousing together form the intermodal transportation network that underpins the global economy. Because these systems are physically and digitally linked, a compromise in one mode can propagate across the supply chain — which is why transportation cybersecurity is increasingly treated as a matter of economic stability and national security rather than an isolated technical problem.

____________________________________________________________________________

Frequently asked questions

Is transportation cybersecurity only about vehicles? No. It spans five domains — aviation, maritime, rail, vehicles, and autonomous systems — plus the ports, airports, and infrastructure that connect them.

What is the CAN bus and why is it a security concern? The CAN bus is the internal network connecting a vehicle’s electronic components. It was designed with no expectation of remote access, so added connectivity exposes it to remote attacks it was never built to resist.

Who is responsible when a supplier’s component causes a breach? Reputationally, the OEM or fleet operator absorbs most of the impact, even if the vulnerable component came from a Tier 2 supplier.

What regulations govern transportation cybersecurity? Key frameworks include TSA Emergency Amendment 23-01 (aviation), the 2023 TSA rail directives, and ISO/SAE 21434, ISO 24089, and UNECE R155/R156 for vehicles.

What is the difference between IT and OT security in transportation? IT security protects data and networks; OT security protects the hardware and software that monitor or control physical processes such as pumps, valves, baggage systems, and signaling. OT systems are often less monitored, widening the attack surface.