How Prepared Is Transit for a Cyber Attack?

New Mineta Transportation Institute (MTI) research assesses the readiness of agencies to understand, mitigate, and respond to the growing threat of cybersecurity. Is the Transit Industry Prepared for the Cyber Revolution? Policy Recommendation to Enhance Surface Transit Cyber Preparedness surveyed 90 transit agency technology leaders and found over 80% of agencies reported feeling prepared for a cybersecurity threat, yet only 60% have a cybersecurity program in place.

Despite the U.S. Department of Homeland Security designating the Transportation System Sector as one of 16 critical infrastructure sectors whose disruption would have a debilitating effect on our nation’s security, the report found that most transit agencies, which fall within this sector, do not have many of the basic policies or personnel in place to respond to a cyber incident.

Other key findings include:

• While 73% of respondents feel they have access to information to help implement a cybersecurity preparedness program, only 60% have a cybersecurity response plan in place and 43% do not find their plan sufficient;
• 47% of agencies reported auditing their cybersecurity program at least once a year;
• Over 50% of agencies do not keep a log for longer than a year– one of the most basic cybersecurity preparedness requirements;
• 36% do not have a cyber disaster recovery plan; and
• 67% do not have a cyber crisis communications plan.

“Fortunately, there is an abundance of information and tools, such as the Transportation Systems Sector (TSS) Cybersecurity Framework Implementation Guidance and accompanying workbook, available to public transit agencies to support a cybersecurity program,” says the report Principal Investigator Scott Belcher. He goes on to describe how agencies that have become aware of the imminent threat have taken action to protect themselves from cyber attacks, including seeking technical leadership from outside the transit industry and contracting out the management of personally identifiable information (PII). 

For the majority of transit agencies, resources for cybersecurity will remain scarce and thus there needs to be a collaborative effort from the federal government, the industry, and agency leadership to establish, maintain, and refine cybersecurity programs. The research team emphasizes that the Federal Transit Administration (FTA) should require transit organizations to adopt and implement minimum cybersecurity standards prior to receiving federal funding.

The team also recommends federal funds be allocated for the development of  comprehensive cybersecurity preparedness plans and their implementation. Industry trade associations should continue to develop, refine, and improve existing cybersecurity guidance to enable transit agencies to adequately prepare for the inevitable cyber disruption and maintain a ready approach in the event of an attack.

ABOUT THE MINETA TRANSPORTATION INSTITUTE

At the Mineta Transportation Institute (MTI) at San Jose State University (SJSU) our mission is to increase mobility for all by improving the safety, efficiency, accessibility, and convenience of our nations’ transportation system. Through research, education, workforce development and technology transfer, we help create a connected world. MTI was founded in 1991 and is funded through the US Departments of Transportation and Homeland Security, the California Department of Transportation, and public and private grants. MTI is affiliated with SJSU’s Lucas College and Graduate School of Business.

ABOUT THE AUTHORS
Scott Belcher is an MTI Research Associate and the President and CEO of SFB Consulting, LLC. Terri Belcher is a writer and analyst for SFB Consulting, LLC. Eric Greenwald is General Counsel of Redacted, a cyber security firm, and former Special Assistant to the President and Senior Director for Cybersecurity on the National Security Council (NSC). Brandon Thomas is a Partner at Grayline Group, and a Managing Partner of Blockview Partners.

Media Contact:

Irma Garcia,

MTI Communications and Operations Manager

O: 408-924-7560

E: Irma.garcia@sjsu.edu