OBJECTIVE

The objective of the research was to develop guidance for state and local transportation agencies on mitigating the risks from cyber-attacks on the field side of traffic management systems (including traffic signal systems, intelligent transportation systems, vehicle-to-infrastructure systems (V2I), and closed-circuit television systems) and, secondarily, on informing the agency’s response to an attack. The guidance will address the vulnerability of field devices (e.g., traffic signal controllers and cabinets, dynamic message signs, V2I roadside units, weigh-in-motion systems, road-weather information systems, remote processing and sensing units, and other IP-addressable devices), field communications networks, and field-to-center communications. It will not address vulnerabilities within a traffic management center, within center-to-center communications, or due to insider risk (accidental or intentional).

STATUS

The guidance is available at https:\\cyberguidance.transportationops.org as part of the National Operations Center of Excellence. After creating an account, users are led through a series of questions regarding their traffic management system field network. The user then receives a report with specific recommendations for improving their cybersecurity posture.

The project Summary Report is available here. Also available online are several task reports as following: 

      Task 1 Literature Review;

      Task 2 Risk Assessment of Typical TMS Design;

      Task 4 Web Guidance Tool User Guide; and

      Task 5 Cybersecurity Primer for Deployment of CAV Technologies. 

During the project, common field equipment were reviewed and penetration testing conducted. Vulnerabilities identified have been disclosed to the equipment vendors. 

BACKGROUND

With over 400,000 traffic signals deployed throughout the United States, traffic signal operations have a profound impact on the safety and efficiency of traffic flow for all road users. Recent threats in cybersecurity have made our industry more aware of potential damage that such threats can cause. Multiple researchers have found that our existing traffic signal systems, if not protected properly, can be easily hacked. For example, sometimes systems are used without any encryption for communication between a central traffic control management system and field traffic signal control units, allowing an attacker to directly change traffic signal indications. Another example involves wireless detectors that could be manipulated to feed traffic control systems with fake data and trigger incorrect options in their operations.

Connected vehicle technologies and applications have significant security requirements, not only for the applications themselves, but also as potential access points that could enable attackers to get inside an agency’s broader network and operations. Safety-critical messaging between vehicles and infrastructure (and vice versa) needs to be trusted as being from a valid source and not spoofed by a hacker or malevolent agency. These cybersecurity requirements and technologies exceed the experience levels of most current DOT and local agency staff responsible for intelligent transportation equipment. Agencies need to understand the implications of these technologies on the design of their communications networks, networking equipment configuration, field device security, and operations best practices.

It is still not clear whether these vulnerabilities can create a critical fault in the system operations, or primarily cause an inconvenience that will jam traffic for a few hours. Even such an “inconvenience” will result in increased crash risk for road users as the systems will be performing with non-optimal settings. It is not easy for agencies to detect potentially malicious actions (e.g., fake updating of firmware) and prevent them. Furthermore, this task is complicated by a variety of stakeholders with diverse skill sets and goals, including manufacturers and vendors of system hardware, software and control units; transportation management center staff; traffic engineers; and IT specialists with an increasing variety of specialties (e.g., fiber optics, wireless communications, database experts, software integrators, etc.). It is necessary to research potential cybersecurity threats on traffic management systems and recommend actions that agencies should follow to protect those systems and properly react in the cases of emergency.