Cybersecurity and trust boundaries

A maintenance account changes the service

Talbahn maintains group configurations remotely. A compromised maintenance account could change assignments so Niko reaches the wrong participants. Radio coverage and MCPTT software might continue working technically. Protection must therefore also cover management, identities and changes.

An asset to protect is something whose impairment should be prevented or limited. Here it is correct and available group assignment. A threat describes a possible harmful action, such as an unauthorised change. It identifies what could happen to the asset. A vulnerability is a characteristic that facilitates that action, for example a shared account without sufficient access restrictions. It gives an attacker an exploitable opportunity.

Risk connects the possible impact with an assessment of the conditions and probability of occurrence. This assessment depends on the system and its use. Talbahn therefore does not assign a generic risk level solely from a technology's name.

A chain of demonstrable measures

Least Privilege means giving an account only the rights needed for its task. A maintenance account intended to read measurements therefore does not automatically need permission to change groups. Zero Trust describes an approach that explicitly verifies access rather than granting it solely because of an apparently trusted network location. NIST SP 800-207 explains this supplementary approach; it does not replace a railway-specific assessment. [S34]

Frameworks address different subjects

CLC/TS 50701 places cybersecurity in the life cycle of railway applications. The IEC 62443 series provides foundations for risk assessment, system protection, components and secure development, among other things. Which parts apply depends on the system boundary and responsibilities. [S14, S26]

3GPP TS 33.180 addresses the security architecture of Mission Critical services. It is relevant to MCX, but alone does not cover every maintenance organisation and vehicle access point. EN 50159 addresses safety-related communication over transmission systems. S27 substantiates the published 2026 edition through the official EVS catalogue. Its validity date of 1 September 2026 concerns the Estonian adoption; it is not a general European application date. The project's applicable national edition and transition rules are checked separately. EN 50159 is therefore not a general substitute for cybersecurity requirements. EN 50126 connects the required RAMS assessment to the life cycle. [S25, S27, S15]

NIS2 concerns duties of certain entities under the European legal framework, including relevant transport actors. Applicability and specific duties must be determined by jurisdiction and national implementation. Mentioning NIS2 is neither a product certificate nor a technical test requirement for every individual FRMCS device. [S28]

Recovery is part of protection too

Authentication verifies a participant's claimed identity. For example, it establishes whether a login actually belongs to the stated maintenance account. Authorisation determines which actions that identity may perform. It restricts access to approved functions. A validly logged-in person therefore cannot automatically change every configuration.

In the case file, each measure receives an owner and a check. Talbahn also considers expired access rights, lost management connections and controlled return to an approved state. A protective mechanism that unintentionally blocks the intended service indefinitely also needs defined handling.

A trust boundary needs concrete data flows

A trust boundary separates areas with different access or administration assumptions. In FRMCS it may lie between application and gateway, between operator organisations or at public access. Talbahn draws the identities, configuration data, signalling and user data crossing it. A single box labelled “encrypted” does not explain who authenticates the counterpart or authorises a change.

Recovery specifies how current permissions and key states are established. Restoring old configuration must not silently reactivate withdrawn rights. The test therefore covers service use and correct protection state, not merely a powered-on platform. [S25]

Check your understanding

The supplier offers encryption as the complete answer to manipulated group assignments. What is missing?

Model answer

Encryption can protect content on a transmission path. It does not automatically prevent a change through an authorised or stolen management account. Identity verification, restricted change permissions, controlled approval, logging and recovery are needed, with appropriate tests. Evidence must include the management path and its effect on the service.

What to remember

A protective measure is assessed against a specific risk and its demonstrated effect.

Your Talbahn case file

Connect possible manipulation of group assignments to protective measures, owners and a recovery test.