> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.
# Transport Networks (TN)
- URL: https://www.ostering.com/taxonomies/critical-infrastructure/bks-transport-networks/
- Published: 2026-11-05T21:00:00.000Z
- Updated: 2026-11-05T20:45:28.765Z
- Description: Rail signalling, traffic control, airports and shipping: 13 threats with mitigation principles, design measures and ATT&CK for ICS mappings.
- Author: Brett Crawley
[Taxonomies](https://ostering.com/taxonomies/) › [Critical Infrastructure](https://ostering.com/taxonomies/critical-infrastructure/) › TN · Transport Networks
How people and goods move: rail signalling, level crossings, road tunnels, traffic control, airports, shipping lanes and the information that travellers act on. Part of The Estate deck, ranked Ace to 2 by severity in the game. This page is part of the [Critical Infrastructure (Cyberwarfare) Threat Taxonomy](https://ostering.com/taxonomies/critical-infrastructure/), the reference for the Black Start card game.
## Mappings at a glance
STRIDE, CAPEC 3.9, CWE 5.0, ATT&CK for ICS v20.0, the Cyber-Informed Engineering principles (main one first) and standards, entry by entry. The same mappings are in each entry below and in the [Excel, SKOS and STIX downloads](https://ostering.com/taxonomies/critical-infrastructure/#downloads).
## Entries
BKS-TN-A · Signalling obeys any well-formed command †
Interlockings, radio block centres and metro train control accept commands and movement authorities from their networks without checking where they came from. Anyone who reaches those networks, or the trackside points, can set routes, release locks or grant authorities the safety logic would refuse, and trains move on false permission.
*Case:* Łódź tram points, 2008.
**Principle.** Every command that moves points, sets routes or grants movement authority must be authenticated and must pass the interlocking's safety logic.
**Design measures.**
1. Authenticate and integrity-protect every message between control centre, interlocking, radio block centre and train.
2. Keep route-setting and locking logic in the vital interlocking, so no network command can bypass it.
3. Zone signalling networks per CLC/TS 50701, with no path from business, passenger or maintenance networks.
*Mappings:* STRIDE S, T, E · [CAPEC-151](https://capec.mitre.org/data/definitions/151.html) · [CWE-306](https://cwe.mitre.org/data/definitions/306.html), [CWE-940](https://cwe.mitre.org/data/definitions/940.html) · ATT&CK for ICS [T1692.001](https://attack.mitre.org/techniques/T1692/001/), [T0831](https://attack.mitre.org/techniques/T0831/), [T0880](https://attack.mitre.org/techniques/T0880/) · CIE 2, 3, 1 · CLC/TS 50701, IEC 62443
BKS-TN-K · Level crossings fail open †
Barriers, warning lights and the train detection that closes them are increasingly monitored and controlled remotely. If the controller can be told the line is clear, or fails with barriers raised, road traffic crosses in front of an approaching train.
**Principle.** A level crossing must fail closed, and its closing must depend only on local train detection.
**Design measures.**
1. Close barriers and stop road traffic on any loss of detection, power or communication.
2. Keep the closing logic local and vital, with remote links able to monitor but not to raise barriers.
3. Alarm the signaller and stop approaching trains when a crossing reports a fault or an unexpected state.
*Mappings:* STRIDE T, D · [CWE-636](https://cwe.mitre.org/data/definitions/636.html), [CWE-306](https://cwe.mitre.org/data/definitions/306.html) · ATT&CK for ICS [T0880](https://attack.mitre.org/techniques/T0880/), [T0837](https://attack.mitre.org/techniques/T0837/), [T0836](https://attack.mitre.org/techniques/T0836/) · CIE 2, 1 · CLC/TS 50701
BKS-TN-Q · Tunnel safety systems on the network †
Road and rail tunnel ventilation, fire suppression, emergency lighting, barriers and evacuation signs are run by a tunnel control system linked to a remote centre. Changing them during a fire turns smoke towards people, closes exits or opens the tunnel to traffic that should be held outside.
**Principle.** Tunnel life-safety functions must keep working, and stay in safe modes, whatever happens to the control network.
**Design measures.**
1. Pre-program fire scenarios in the local controllers, started by local detection, and locked against remote change.
2. Give firefighters a local panel at each portal that overrides remote control.
3. Separate life-safety control from traffic management and monitoring networks, and alarm any remote change to safety modes.
*Mappings:* STRIDE T, D, E · [CWE-306](https://cwe.mitre.org/data/definitions/306.html), [CWE-15](https://cwe.mitre.org/data/definitions/15.html) · ATT&CK for ICS [T0880](https://attack.mitre.org/techniques/T0880/), [T0831](https://attack.mitre.org/techniques/T0831/), [T0836](https://attack.mitre.org/techniques/T0836/) · CIE 1, 2, 3 · IEC 62443
BKS-TN-J · Traction power switched off remotely †
Substations that feed rail and metro lines are switched from a remote control room. Cutting traction power strands trains between stations and in tunnels, stops ventilation fed from the same supply, and can leave passengers walking along the track in the dark.
**Principle.** Losing traction power must leave trains and passengers safe, and restoring it must not depend on the control network alone.
**Design measures.**
1. Require local confirmation for switching that would de-energise sections with trains in tunnels.
2. Supply tunnel ventilation, lighting and communications from a source independent of traction power.
3. Rehearse local, manual restoration of traction power at each substation.
*Mappings:* STRIDE D, T · [CWE-306](https://cwe.mitre.org/data/definitions/306.html) · ATT&CK for ICS [T0816](https://attack.mitre.org/techniques/T0816/), [T0831](https://attack.mitre.org/techniques/T0831/), [T0827](https://attack.mitre.org/techniques/T0827/) · CIE 1, 10, 7 · CLC/TS 50701, IEC 62443
BKS-TN-10 · Signal cables share one route
Fibre and copper for signalling, points motors, train detection and line telecoms run in the same trackside conduits, for long distances, with little monitoring. Fire or cutting at a few points stops a line for days, because each cable must be found and repaired by hand.
*Case:* French high-speed rail arson, 2024.
**Principle.** No single cut or fire should take signalling, detection and communications off a whole line.
**Design measures.**
1. Route critical signalling and telecom cables on separate paths where the line allows, or protect shared conduits.
2. Monitor conduits and cable integrity, and alarm on intrusion, heat or loss of continuity.
3. Keep repair kits, spare cable and degraded working rules ready for each line, and rehearse them.
*Mappings:* STRIDE D · [CAPEC-547](https://capec.mitre.org/data/definitions/547.html) · ATT&CK for ICS [T0826](https://attack.mitre.org/techniques/T0826/), [T0828](https://attack.mitre.org/techniques/T0828/) · CIE 7, 10, 1 · CLC/TS 50701
BKS-TN-9 · One centre times every junction †
Urban traffic control centres push signal timings, priorities and plans to thousands of junction controllers, which also accept local maintenance access. A changed plan can gridlock a city, block emergency routes or, where safety checks are in software, show conflicting greens.
**Principle.** Junction safety must be enforced locally in hardware, and central changes must be limited in scope and reversible.
**Design measures.**
1. Keep conflicting-green protection in an independent hardware monitor at every junction, not in the timing plan.
2. Sign and approve timing plans before they reach controllers, and stage changes area by area.
3. Let controllers fall back to safe fixed timings when central control is lost or untrusted.
*Mappings:* STRIDE T, D · [CWE-1220](https://cwe.mitre.org/data/definitions/1220.html), [CWE-306](https://cwe.mitre.org/data/definitions/306.html) · ATT&CK for ICS [T0836](https://attack.mitre.org/techniques/T0836/), [T0831](https://attack.mitre.org/techniques/T0831/), [T0813](https://attack.mitre.org/techniques/T0813/) · CIE 2, 4, 10 · IEC 62443
BKS-TN-8 · Motorway signs and lanes lie †
Lane signals, speed limits, variable message signs and ramp meters are set from a regional control centre. False closures send traffic into incidents or onto unsuitable roads, false messages cause panic, and open lanes can be shown where a crash or roadworks lie ahead.
**Principle.** What drivers are told must come from authorised operators and match what the roadside detects.
**Design measures.**
1. Authenticate every setting sent to roadside equipment, and log who set what.
2. Cross-check signals against incident detection, and alarm when signs and detected conditions disagree.
3. Limit sign messages to approved templates, with free text needing a second approver.
*Mappings:* STRIDE S, T · [CAPEC-148](https://capec.mitre.org/data/definitions/148.html) · [CWE-306](https://cwe.mitre.org/data/definitions/306.html), [CWE-1293](https://cwe.mitre.org/data/definitions/1293.html) · ATT&CK for ICS [T0831](https://attack.mitre.org/techniques/T0831/), [T0832](https://attack.mitre.org/techniques/T0832/) · CIE 2, 6
BKS-TN-7 · Airports share one passenger platform
Check-in, bag drop, boarding and baggage systems at many airports run on shared platforms from a few vendors. One compromise stops processing at all of them at once, and manual fallback handles only a fraction of normal traffic.
*Case:* Collins Aerospace MUSE, 2025.
**Principle.** Passenger and baggage processing must keep running, at reduced scale, without the shared platform.
**Design measures.**
1. Rehearse manual check-in, boarding and baggage handling at full shift scale, with printed materials ready.
2. Segment the airport's own systems from the vendor platform so one compromise does not reach both.
3. Agree recovery priorities and support capacity with the vendor for incidents that hit many airports at once.
*Mappings:* STRIDE D · [CWE-1357](https://cwe.mitre.org/data/definitions/1357.html) · ATT&CK for ICS [T0862](https://attack.mitre.org/techniques/T0862/), [T0826](https://attack.mitre.org/techniques/T0826/), [T0828](https://attack.mitre.org/techniques/T0828/) · CIE 9, 10, 7
BKS-TN-6 · Supplier app failure stops trains
Crew, dispatch and maintenance systems from suppliers carry speed restrictions, work zones and safety notices to drivers and conductors. When the supplier is attacked, staff cannot run trains safely, so the operator stops the network even though signalling is untouched.
*Case:* DSB trains and Supeo, 2022.
**Principle.** Safety-critical operating information must reach crews by a fallback path when a supplier's system is lost.
**Design measures.**
1. Identify supplier systems that carry safety information, and treat them as critical in contracts and testing.
2. Keep a fallback channel, such as printed notices or radio, for speed restrictions and work zones.
3. Hold current copies of rosters and restrictions so services can restart without the supplier.
*Mappings:* STRIDE D · [CWE-1357](https://cwe.mitre.org/data/definitions/1357.html) · ATT&CK for ICS [T0862](https://attack.mitre.org/techniques/T0862/), [T0828](https://attack.mitre.org/techniques/T0828/) · CIE 9, 7, 10 · CLC/TS 50701
BKS-TN-5 · Vessel traffic trusts what ships report †
Vessel traffic services and ships rely on the Automatic Identification System, which carries unauthenticated position and identity reports. False tracks can hide a ship, invent one, or show vessels where they are not, so traffic is closed, routed wrongly or put at risk of collision.
**Principle.** Traffic decisions must not rest on unauthenticated reports alone.
**Design measures.**
1. Fuse AIS with radar and other sensors, and alarm when a reported track has no radar match.
2. Flag tracks with impossible movements, duplicate identities or sudden jumps for operator review.
3. Train operators to treat AIS as a claim, and give them procedures for when it cannot be trusted.
*Mappings:* STRIDE S, T · [CAPEC-194](https://capec.mitre.org/data/definitions/194.html) · [CWE-290](https://cwe.mitre.org/data/definitions/290.html), [CWE-1293](https://cwe.mitre.org/data/definitions/1293.html) · ATT&CK for ICS [T0832](https://attack.mitre.org/techniques/T0832/) · CIE 2, 6
BKS-TN-4 · Navigation data sends traffic astray
Navigation apps, ride-hailing platforms and live traffic feeds steer thousands of vehicles at once. False congestion, false closures or mass bookings can send traffic into one street, block emergency routes or empty the roads an evacuation needs.
*Case:* Yandex Taxi gridlock, Moscow, 2022.
**Principle.** Platforms that steer traffic must detect and limit coordinated, implausible demand or data.
**Design measures.**
1. Rate-limit bookings and route changes that converge on one place, and alarm on sudden concentrations.
2. Authenticate official closure and incident data feeds, and cross-check them against observed traffic.
3. Agree with road authorities how routing is constrained during emergencies and evacuations.
*Mappings:* STRIDE T, D · [CAPEC-153](https://capec.mitre.org/data/definitions/153.html) · [CWE-807](https://cwe.mitre.org/data/definitions/807.html) · CIE 6, 7
BKS-TN-3 · Station boards speak for the attacker †
Passenger information displays, apps and public address are fed from central systems with weak access control. False delays, cancellations or evacuation messages send crowds the wrong way, overload stations and staff, and make passengers doubt real instructions.
*Case:* Iran railway, 2021.
**Principle.** Only authorised staff can publish to passengers, and emergency messages need a protected path.
**Design measures.**
1. Restrict who and what can publish, and require approval for messages beyond routine updates.
2. Give emergency and evacuation messages a separate, authenticated path that staff can verify.
3. Let station staff override or blank displays locally when content cannot be trusted.
*Mappings:* STRIDE S, T · [CAPEC-148](https://capec.mitre.org/data/definitions/148.html) · [CWE-862](https://cwe.mitre.org/data/definitions/862.html) · ATT&CK for ICS [T0832](https://attack.mitre.org/techniques/T0832/) · CIE 3, 6
BKS-TN-2 · Ticketing and gates fail badly
Ticket gates, validators and the back-office systems that settle fares depend on central services. When those fail, gates either lock passengers in or out or are left open, refunds and passes stop, and revenue and passenger data are exposed.
*Case:* Transport for London, 2024.
**Principle.** Gates must fail safely for people, and travel must continue when back-office systems are lost.
**Design measures.**
1. Make gates fail open for evacuation, with local staff control, whatever the back office does.
2. Let validators keep working offline for a set period, with fares settled later.
3. Separate ticketing back offices from operational networks, and protect customer data in them.
*Mappings:* STRIDE D, I · [CWE-636](https://cwe.mitre.org/data/definitions/636.html) · ATT&CK for ICS [T0828](https://attack.mitre.org/techniques/T0828/) · CIE 10, 3
## Public cases cited in this suit
- **Łódź tram points, 2008.** In January 2008 a 14-year-old in Łódź, Poland, used a modified television remote control to switch tram points by infrared; four trams derailed and passengers were injured. *Attribution:* A local teenager, charged before a juvenile court; no state involvement. *Sources:* [Dark Reading: teenage hacker takes over Polish tram system](https://www.darkreading.com/perimeter/teenage-hacker-takes-over-polish-tram-system)
- **French high-speed rail arson, 2024.** On the night of 25 to 26 July 2024, hours before the Paris Olympics opened, fires were set in trackside conduits carrying fibre-optic cables for signalling and points on the Atlantic, northern and eastern high-speed lines; about half of services were cancelled and some 800,000 passengers affected, and cables had to be repaired one by one. *Attribution:* Unattributed; the Paris prosecutor opened an inquiry into an attack on fundamental national interests. *Sources:* [The Local: sabotage on French rail network before Olympics, what we know](https://www.thelocal.fr/20240726/sabotage-on-french-rail-network-before-olympics-what-we-know)
- **Collins Aerospace MUSE, 2025.** From 19 September 2025 ransomware on Collins Aerospace's MUSE check-in and bag-drop platform disrupted Heathrow, Brussels, Berlin and other European airports, forcing manual check-in and cancellations. *Attribution:* Criminal ransomware, confirmed by RTX; the UK National Crime Agency arrested a suspect; no state attribution. *Sources:* [Security Affairs: cyberattack on Collins Aerospace disrupted major European airports](https://securityaffairs.com/?p=182363); [BleepingComputer: UK arrests suspect for RTX ransomware attack causing airport disruptions](https://www.bleepingcomputer.com/news/security/uk-arrests-suspect-for-rtx-ransomware-attack-causing-airport-disruptions/)
- **DSB trains and Supeo, 2022.** On 29 October 2022 an attack on Supeo, a supplier whose app gives Danish State Railways' crews speed restrictions and safety notices, took its servers down; DSB stopped its trains because they could not be run safely without it. *Attribution:* Unattributed; DSB said the supplier reported criminal hackers. *Sources:* [Bitdefender: Denmark's train network frozen due to cyberattack on subcontractor](https://www.bitdefender.com/blog/hotforsecurity/denmarks-train-network-frozen-due-to-cyberattack-on-subcontractor); [Security Affairs: a cyberattack blocked the trains in Denmark](https://securityaffairs.com/138127/cyber-crime/cyberattack-blocked-trains-denmark.html)
- **Yandex Taxi gridlock, Moscow, 2022.** On 1 September 2022 attackers sent bulk orders through the Yandex Taxi app so that dozens of cabs converged on one address in Moscow, jamming Kutuzovsky Prospekt for close to an hour. *Attribution:* Unattributed. *Sources:* [The Register: Moscow taxi jam](https://www.theregister.com/2022/09/02/russia_taxi_jam_prank/)
- **Iran railway, 2021.** On 9 July 2021 display boards at stations across Iran showed false messages of long delays and cancellations because of a cyberattack, urging passengers to call a number that belonged to the Supreme Leader's office. *Attribution:* Claimed by Predatory Sparrow. *Sources:* [Dawn: hackers disrupt Iran's rail service with fake delay messages](https://www.dawn.com/news/1634287); [Wikipedia: Predatory Sparrow](https://en.wikipedia.org/wiki/Predatory_Sparrow)
- **Transport for London, 2024.** In September 2024 attackers broke into Transport for London's network; services such as Oyster refunds and photocard applications were disrupted for weeks and data in the refund system was exposed. *Attribution:* Criminal; two members of the Scattered Spider group pleaded guilty in 2026. *Sources:* [The Record: guilty pleas in TfL cyberattack](https://therecord.media/guilty-plea-tfl-cyberattack-scattered-spider-members)
---
*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [overview](https://ostering.com/taxonomies/critical-infrastructure/#licence). † marks a physical-safety consequence.*