
The exposure
A signal fault stops the whole line.
Transit and port networks grew by bolting remote access onto field equipment spread across miles of right-of-way. Wayside cabinets, traffic controllers and crane PLCs often sit on flat networks reachable from the business side.
TSA SD-1582NIST SP 800-82IEC 62443
■Wayside and roadside cabinet access control
■Segmentation between operations and passenger or tenant networks
■Vendor remote access to signaling and terminal systems
Typical topologyExposed path
L3.5 · DMZOperations DMZ
VENDOR VPN
L2 · HMIControl center HMI
L2 · SCADATraffic / signal SCADA
L2 · HISTORIANEvent historian
L1 · PLCInterlocking PLC
L1 · RTUWayside RTU
L1 · SAFETYTrain protection
L0 · PROCESSSignals · switches · gates · cranes
Where we start
