Cybersecurity in Transit: Still Not on Track

In 2020, the Mineta Transportation Institute (MTI) published Is the Transit Industry Prepared for the Cyber Revolution? Policy Recommendations to Enhance Surface Transit Cyber Preparedness, which found that the transit industry was ill-prepared for cybersecurity threats and attacks. After four years and the development of new cybersecurity requirements and resources, MTI has released an updated report, Does the Transit Industry Understand the Risks of Cybersecurity and are the Risks Being Appropriately Prioritized?, showing the cybersecurity preparedness of transit has not markedly improved.

Based on online surveys from 78 agencies, interviews with transit professionals, and a review of relevant literature, the study revealed three major findings:

• There is a lack of organizational knowledge about cybersecurity. Many executives do not appreciate the risks their organizations face, and if they do, many leaders do not know what their teams are doing to address these risks. 

• Many agencies lack important documented policies and procedures across a broad spectrum of requirements that are considered essential by most cybersecurity professionals. 

• Small agencies lag far behind. For the best practices discussed in the report, a bigger proportion of the larger agencies adhered than did smaller agencies.

The authors’ recommendations include:

• Agencies should develop a yearly updated individualized cybersecurity plan. 

• Agencies should conduct a cybersecurity assessment at least annually and address the shortcomings identified in that assessment in a timely manner.

• Agencies should ensure that they have documented cybersecurity policies and procedures in place and that the organization is following them.

• Transit agencies should have at least one person on staff with a cybersecurity certificate qualified to oversee the cybersecurity program and/or vendors.

“The increasing sophistication of cybercriminals, in combination with a greater reliance on technology within the transit industry, puts the industry at higher risk than in 2020,” explain the study’s authors. “Agencies are not conducting regular cybersecurity assessments or putting basic policies and procedures in place to minimize the likelihood of a cybersecurity breach and to recover from the harm when one occurs.”

Ultimately, only with a coordinated effort can this threat and its impact be mitigated and the nation’s critical systems be protected.

ABOUT THE MINETA TRANSPORTATION INSTITUTE

At the Mineta Transportation Institute (MTI) at San Jose State University (SJSU) our mission is to increase mobility for all by improving the safety, efficiency, accessibility, and convenience of our nations’ transportation system. Through research, education, workforce development and technology transfer, we help create a connected world. Founded in 1991, MTI is a university transportation center funded by the US Department of Transportation, the California Department of Transportation, and public and private grants, including those made available by the Road Repair and Accountability Act of 2017 (SB1). MTI is affiliated with SJSU’s Lucas College and Graduate School of Business.

ABOUT THE PRINCIPAL INVESTIGATOR

Scott Belcher is a Research Associate with the Mineta Transportation Institute and has 35 years of experience in Washington, D.C. with the federal government as a lawyer and as an executive with several trade associations. Scott has spent the majority of his career working on transportation technology issues. Andy Souders is a technology executive with over 35 years of experience in digital innovation and organizational transformation across industries such as Cloud, Cybersecurity, and Smart Cities.

Media Contact: