Cyber ‘Kavach': Railways plans Rs 600 cr war-room against attacks

India Today

15-05-2025

India is establishing a state-of-the-art Cyber Security Operations Centre (CSOC) for its railway system at the national transporter's headquarters Rail Bhawan in New Delhi to fend off cyber threats to the Indian Railways' vast and increasingly digitised installations.With an outlay of around Rs 600 crore, this will be the first such centralised defence system against digital intrusions for one of the world's largest rail networks.advertisementThe step reflects a growing sense within the government of nationwide vulnerability of critical infrastructure, particularly transportation systems, to cyber attacks. The upcoming facility is seen as a nerve-centre for threat assessment, risk mitigation and ensuring effective cyber security, incident response, knowledge management and information-sharing across the railway network, encompassing the passenger reservation systems, freight operations information systems, operating systems and communication systems.'Almost every aspect of train operations and all ticketing and freight charging systems are computerised. Cyber security is very critical for such a system. The fact that there are many sub-systems within the IT landscape could help in isolating the attacks, although securing each one is a difficult task,' said R. Badri Narayan, consultant to railway's IT arm CRIS (Centre for Railway Information Systems) and a retired Indian Railway Traffic Service officer.advertisement'Indian Railways has been successfully thwarting attempts to hack the systems, but cyber security is also about the best responses in case multiple systems are breached,' he explained. Mock drills should be a routine feature to ensure the railways can get things under control in the unfortunate event of a successful cyber attack, said Narayan, who has been at the helm of the railway ministry's IT vertical.Five leading tech companies—Tata Consultancy Services (TCS), TCL, Bharti Airtel, Sterlite Technologies and Larsen & Tubro (L&T)—have emerged as successful bidders in the technical qualification round of the tender. Industry sources say the financial bids are likely to be completed within weeks and the purchase order in a month or so.'This is much-needed infrastructure for an organisation that increasingly runs on digital systems—from ticket sales to asset monitoring,' said an industry source in the know of the project plan. 'Once the cyber security centre is up and running, India's ability to envision, contain and neutralise cyber threats in real time will take a major leap.'Indian Railways, over the last decade, has embraced dozens of digital platforms to modernise operations, cut waste in its haystack and improve customer experience. Ashwini Vaishnaw, the Union minister for railways and electronics and IT, has frequently stressed that technology has a key role to play in addressing operational pain-points.advertisementThe railways has also made an effort to remain in step with the tech curve, which includes deployment of new-age technologies, such as the Kavach anti-train collision system and high-speed trains.From the web and mobile portals of IRCTC (Indian Railway Catering and Tourism Corporation), which process over 1 million bookings a day, to real-time GPS tracking of trains and electronic interlocking of train movements, the backbone of the network is no longer only steel and concrete but also software and servers.But some risks are inherent. Industry experts say the railways' fragmented, and often, obsolete digital systems are susceptible to ransomware, phishing and foreign-state actors. Beyond financial losses or stolen data, a successful cyber attack could result in disruptions of rail traffic, putting passenger safety and national security at risk.These are not vague threat assessments. Last year, a ransomware attack hit CSX, one of the biggest freight railroad operators in the United States, putting its systems offline, disrupting operations and inflicting a major financial blow. Back in 2018, the UK's rail network had intercepted an attempt to break its ticketing system, leading to a national audit.advertisementOver the years, transportation systems globally—be it rail, road, air or sea—have adopted securer communications that are no longer 'nice to have' but a strategic requirement.The CSOC of the Indian Railways will have real-time, 24x7 cyber-monitoring using a tracking system, Artificial Intelligence (AI)-based threat analytics, cyber threat intelligence and information-sharing practices, intrusion and anomaly detection system, and an incident response system based on inputs fed from various sources. It will operate in coordination with the National Critical Information Infrastructure Protection Centre (NCIIPC) of the National Technical Research Organisation (NTRO) and CERT-In (Indian Computer Emergency Response Team).The CSOC will also be developed as a centre of training and simulation for the railways' cyber workforce, enhancing indigenous capability to respond to zero-day vulnerabilities and persistent threats.Railways across the world are investing heavily in cyber security. Germany's national railway Deutsche Bahn has only one central cyber operations centre in operation. It is connected to the country's national cyber authority. Japan Railways had built an AI firewall framework to protect its train control/command IT systems ahead of the 2020 Tokyo Olympics. Brazil and Indonesia, considered as emerging economies, are also aligning cyber security of transport infrastructure with international systems such as ISO/IEC 27001.advertisementIndia's move is in line with global best practices, although some experts believe the country is playing catch-up. With around 70,000 km of tracks, thousands of networked devices and a growing customer base, Indian Railways are up against digital threats that traditional firewalls cannot handle.As the CSOC takes shape, insiders say the project's success will depend on how swiftly the selected vendor picks up the ropes of the railway system, the level of coordination between government bodies, and how rapidly technology can be deployed. The value of the IT bidders—all giants in their domains—will be tested as well.Subscribe to India Today Magazine