Guide · Security & Architecture

Rail Signalling Cybersecurity: Zones, Conduits and a Read-Only Monitoring Overlay

Signalling networks that spent decades physically isolated are now IP-based, remotely accessed, and increasingly regulated as critical infrastructure. The same connectivity that makes remote diagnostics and condition monitoring possible also opens an attack surface into safety-related equipment. This guide covers how to secure a signalling network the way the standards intend — segmenting it into zones and conduits, matching protection to consequence, and bolting a monitoring overlay onto it without ever creating an inbound path to the vital layer.

Why signalling is now a cybersecurity problem

For most of their history, signalling systems were secure largely by accident. Relay interlockings had no network to attack, and even early computer-based interlockings ran on dedicated, physically separated links. Security was a by-product of isolation.

That isolation has quietly disappeared. Interlockings and wayside controllers now speak over IP. Control centres aggregate data from hundreds of sites. Maintainers expect to diagnose a location case from a depot rather than a two-hour drive away. And condition-monitoring systems — the kind that read point-machine drive current or track-circuit health — deliberately tap into the signalling network to get their data out. Every one of those links is useful, and every one of them is a path an attacker could travel. Regulators have noticed: in the European Union the NIS2 Directive, applied by member states from late 2024, treats railway infrastructure managers and operators as essential entities and extends their obligations explicitly to operational-technology (OT) and signalling networks, not just corporate IT.

The point of signalling cybersecurity is not to slam the door on connectivity — the operational benefits are real. It is to make every connection a deliberate, defended, and documented one, and to make sure that the systems you add for visibility do not quietly become the weakest link.

The boundary: vital signalling versus the monitoring overlay

The single most important distinction in this whole subject is between the vital layer — the interlockings, controllers, and circuits that actually hold trains apart and carry a safety case under EN 50126 — and the monitoring overlay that watches those assets and reports on their condition. They are different systems with different jobs, and they deserve different security treatment.

The overlay's superpower is that it only needs to read. A well-designed condition monitoring system senses signals non-intrusively and never issues a command to the signalling. That read-only nature is not just a safety property; it is a security property, because it means the conduit between the overlay and the vital layer can be built to allow data out and nothing in. Keeping that boundary clean — advisory overlay on one side, vital signalling on the other — is what lets you gain visibility without widening the attack surface of the equipment that matters most.

Zones and conduits: the core structuring idea

Modern OT security is built on a simple, powerful pattern borrowed from the IEC 62443 series and applied to rail by CLC/TS 50701: divide the system into zones and connect them only through conduits.

A zone is a group of assets that share the same security requirements — for example, all the vital interlocking equipment at a site, or the whole condition-monitoring overlay. A conduit is a controlled communication channel between zones: the link from the signalling zone to the monitoring zone, or from a site up to the control centre. The discipline is that traffic only ever flows through a defined conduit, every conduit is defended and documented, and anything without a conduit simply cannot communicate. Segmenting a network this way is what stops a foothold in one place — a compromised maintenance laptop, say — from turning into free movement across the whole railway.

Security levels: match protection to consequence

Not every zone deserves the same defences. IEC 62443 captures this with four security levels (SL), each describing how capable an attacker the zone is designed to withstand. Under CLC/TS 50701 you assign each zone a target security level from the consequence of its compromise, so effort concentrates where the risk is highest.

Level	Designed to resist	Typical rail interpretation
SL 1	Casual or coincidental violation, including non-malicious human error	Baseline hygiene on low-consequence zones
SL 2	Intentional attack using simple means and low resources	General OT and monitoring zones
SL 3	Sophisticated attack, moderate resources, rail-specific knowledge	Zones whose compromise touches safety or availability
SL 4	Advanced attack with extended resources (well-funded or state-sponsored)	The most safety-critical vital zones

The practical consequence is that a monitoring overlay and a vital interlocking are held to different bars — and the conduit between them is defended to the level of the stronger zone. That is why a read-only link out of a high-SL signalling zone is such an attractive design: it lets the lower-SL monitoring zone receive data without the signalling zone ever having to accept an inbound connection.

One-way by default: data diodes and read-only conduits

When a zone only needs to send data — which is exactly the case for telemetry leaving the signalling layer for a monitoring platform — the strongest conduit you can build is a one-way one. A data diode (or unidirectional gateway) enforces one-way flow in hardware: light or signal physically travels in a single direction, so telemetry can leave the signalling zone but no command, update, or probe can travel back in.

The reason this matters is that the restriction is physical, not a rule. A firewall can be misconfigured, have a rule relaxed "temporarily", or be exploited through a flaw; a hardware data diode cannot pass traffic the wrong way because there is no return path for it to use. That property is why data diodes are among the few controls credible at the higher security levels, and why they suit safety-related networks so well. For a condition-monitoring overlay whose only requirement is to observe, a one-way conduit is close to an ideal fit: full visibility, zero inbound exposure.

Where a strict diode is impractical, the same intent is approximated in software — a monitoring gateway that pushes data outward on a standards-based protocol and accepts no inbound control — but the principle is unchanged: the overlay reads, and the conduit is built so it can only read.

Securing remote access — the highest-risk conduit

Remote access is where good intentions most often undo good architecture. The convenience of reaching any wayside asset from a desk is precisely what an attacker wants too, so remote access has to be treated as the most dangerous conduit on the network and granted as narrowly as possible.

The pattern that holds up is brokered, scoped, and logged access rather than a standing tunnel:

• Broker through a jump host — route access via a controlled access gateway in a demilitarised zone, never straight into the OT network.
• Strong, per-user identity — multi-factor authentication and named accounts, so every session is attributable to a person, not a shared credential.
• Scope and time-box each session — grant access to a single asset for a single task for a limited window, then revoke it, rather than leaving a permanent path open.
• Separate read from write — monitoring (read) access and engineering (write) access are different privileges with different approval paths; most people only ever need to look.
• Log the session, not just the login — full session recording on the conduit turns remote access from a blind spot into an auditable event.

And the strongest position of all: where a site only needs to export telemetry, provision no inbound remote path at all. Push the data out over a one-way or store-and-forward link and there is simply nothing there to attack.

Defence in depth across the wayside

No single control secures a signalling network; the standards assume layers, so that a failure of any one does not expose the assets behind it. A practical layered posture for a monitored wayside estate looks like this:

Layer	Control
Segmentation	Zones and conduits per CLC/TS 50701; vital and monitoring zones kept separate
Boundary	One-way data diode or read-only gateway on the conduit out of the vital zone
Identity	Per-device authentication and per-device certificates so every endpoint is known
Access control	Brokered, MFA-protected, time-boxed remote access; read and write separated
Integrity	Signed firmware and configuration, with proof of what is actually running on each device
Monitoring	Passive OT monitoring of the network itself — unexpected flows, new devices, protocol anomalies
Physical	Location-case door and tamper sensing, tied into the same alarm stream
Governance	Risk assessment and lifecycle aligned to EN 50126, so security is reassessed like safety

Notice how much of this a monitoring overlay contributes rather than threatens. Per-device identity, tamper sensing, and passive network monitoring are all security controls in their own right — a properly built visibility layer doesn't just avoid adding risk, it becomes one of the layers.

The standards and regulation you'll be measured against

Three reference points frame almost every conversation about rail signalling security, and it helps to know how they fit together rather than treating them as competing checklists.

• IEC 62443 — the cross-industry foundation for securing industrial automation and control systems. Zones, conduits, and security levels all originate here.
• CLC/TS 50701 — the CENELEC technical specification that adapts IEC 62443 to railways (first published 2021, updated 2023). It deliberately dovetails with the EN 50126 RAMS lifecycle, so cybersecurity risk is assessed alongside safety rather than bolted on afterwards.
• Regional regulation — in the EU, NIS2 makes appropriate OT security a legal obligation for rail and points operators toward exactly these standards; other jurisdictions have their own regulators and directives, but the trend toward mandatory, auditable OT security for rail is broadly universal.

The reassuring part is that these all pull in the same direction. Segment into zones and conduits, assign security levels by consequence, defend the boundaries, keep the safety lifecycle and the security lifecycle joined up — do that, and you are simultaneously satisfying the standard, the regulator, and plain engineering sense.

What to demand before you buy

If you are specifying a monitoring, diagnostics, or data-acquisition system that will attach to a signalling network, the security questions are as important as the functional ones. Insist on:

• A clear zone model — the vendor can show you which zone their equipment lives in and every conduit it needs, before installation.
• Read-only by design — the system can be deployed so it only ever reads the signalling network, with a one-way or verifiably outbound-only conduit.
• Per-device identity — every field device authenticates and can be uniquely identified and revoked.
• No standing inbound access — remote support works through brokered, logged, time-boxed sessions, not a permanent tunnel into the OT network.
• Alignment with CLC/TS 50701 and IEC 62443 — the supplier can speak to security levels and show how their product supports, rather than undermines, your target SL for each zone.

Frequently asked questions