REGISTER

John Boss

BE(Elec), MBA, MSc(Cybersecurity), FIRSE, Member ITC

John Boss Consulting B.V.

The Netherlands is rolling out the European Rail Traffic Management System (ERTMS) across the national network. The government created a Programme Directorate to manage the rollout. Cyber security for both ERTMS as well as the transportation system into which it is to be delivered is a major concern.

Cyber security relies on a comprehensive portfolio of measures, implemented across a company (and its suppliers, customers and partners). Creating the characteristic of “cyber secure” for the signalling system requires action from beyond the traditional boundaries of the signalling system. The situation is further complicated when multiple projects across several companies all need to come together as a secure integrated whole.

In the middle of all this are the people that must deliver the projects. Although there has been much work done on cyber security, it is often presented as a dark art. The approach taken to managing cyber security by the Programme Directorate has had a focus of removing mystery from cyber security by using clear frameworks for delivery with explicit references to relevant company policies. It is focused on facilitating the human contribution.

This paper explains the approach to managing cyber security that is being taken by the Dutch ERTMS Programme Directorate. Examples from the programme are then discussed to highlight issues that have compromised the human contribution.

Cyber security is people work. This paper concludes that it is not just about getting the policies and procedures right, but also taking into consideration the characteristics of being human that influence who we are and how we think. These include: training, studies, language, culture, the corporate culture in which we work and underlying paradigms with which we view the world.