Transportation Systems · Rail and transit · Airports · Highways

OT security for rail, transit, airports, and highway systems.

Traction power, signaling, baggage systems, people movers, airfield lighting, fuel farms, and traffic signals all run on control systems that were built to stay up, not to be patched every month. Red Tiger Security assesses them live, without stopping trains or flights. The walk starts where they touch business IT, tenants, vendors, and the Internet, and works down to the field devices. Then the team fixes the immediate need. If you want Red Tiger to stay, the close is 24x7 MSP + Metrics and Reports.

Request an assessment Airports

White passenger train at a bright, modern station platform

Oct. 2022TSA cyber security directive for designated passenger and freight railroads. [2]

March 2023TSA emergency amendment for certain airport and aircraft operators. [3]

Aug. 2024Ransomware at the Port of Seattle hinders baggage, kiosks, and display boards at SEA. [21]

Sept. 2025An attack on one common-use check-in provider disrupts several European airports. [20]

Three kinds of transportation, one method

CISA's Transportation Systems Sector covers aviation, highways, maritime, mass transit and passenger rail, pipelines, freight rail, and postal and shipping. [1] This page covers rail and transit, airports, and highways. Maritime and pipelines have their own pages.

Rail and transit

Traction power, signaling, and the OCC

Traction power SCADA and substations, interlocking and signaling, CBTC on transit lines, PTC on railroads, train radio, and the operations control center. Stations add fare systems, PA, CCTV, tunnel ventilation, and building management.

Train radio is a good example of why this matters. In August 2023, trains in Poland were brought to an emergency stop by broadcast "radio-stop" commands, because the radio system has no encryption or authentication for that command. [19]

Airports

A small city that never closes

Power and the central utility plant, airfield lighting, jet fuel, baggage, people movers, aviation IT, and life safety, all on one site and shared with airlines, tenants, and government agencies. The full breakdown is below.

Highways and ITS

Signals, signs, and traffic management

Traffic signal controllers, the traffic management center, ramp meters, dynamic message signs, tunnel and bridge systems, and tolling. Field cabinets sit on the roadside and talk back over agency networks, cellular, or radio. The U.S. DOT ITS Joint Program Office publishes cybersecurity resources for these systems. [10]

Pipelines

Pipelines are transportation too, under the TSA Pipeline Security Directives that followed the May 2021 Colonial Pipeline attack. [18] See Oil & Gas for pipeline SCADA and TSA VADR work with partner UTSI.

Ports, terminals, and ships

Ports and terminals fall under the Coast Guard cyber rule. See USCG Regulated Sector. For ships and fleets, see Cruise Lines and Maritime.

What runs a major airport

Most of what keeps an airport open is OT: power, cooling, fuel, baggage, people movers, and airfield lighting. It sits on the same site as the aviation IT systems and the tenant networks, and much of it is reached remotely by the makers that support it.

Simplified site plan. Layouts differ from airport to airport.

1Central utility plant: chilled water, heating, HVAC

2Substations and power distribution

3Backup generation and UPS

4Airfield lighting (AGL) and lighting vault

5Fuel farm: tanks, pumps, tank gauging

6Hydrant fueling system to the stands

7Fuel receipt pipeline and SCADA

8Terminal: CUPPS check-in, FIDS, PA

9Baggage handling (BHS) and EDS screening

10People mover (APM) and train control

11Jet bridges, 400Hz ground power, PCA

12Air traffic control interfaces

13Operations center: AODB, A-CDM, gates

14Perimeter intrusion, access control, CCTV

15Water and wastewater

16Parking, roadway signs, landside

17Data center, tenant and vendor remote access

Every critical system at the airport, and why it matters

12 groups and 39 systems that run around the clock. Open a group to see each system and where assessment, remediation, and monitoring apply. What fits depends on how each airport is built and connected.

ARM Core serviceARM Dashed: where it fits the system and the riskA Assess · R Remediate · M Monitor

Power and central utilities5 systems

Substations and power distribution. The airport's own medium-voltage network. Lose a feed and everything downstream goes with it: terminals, baggage, people movers, and airfield lighting.

ARM

Backup generation and UPS. Generators, transfer switches, and UPS keep critical loads up when the utility drops. The controllers that start and transfer them are networked.

ARM

Central utility plant (CUP). Chillers, boilers, cooling towers, and pumps run by a plant control system. Terminals and data rooms overheat fast without it.

ARM

Chilled water and HVAC. Air handlers and smoke control across the terminal, run from the building automation system.

ARM

Water and wastewater. Potable water, fire water, lift stations, and deicing fluid collection, often with their own SCADA.

ARM

Airfield3 systems

Airfield lighting control (AGL). Runway and taxiway lights, stop bars, and the control system in the lighting vault. Without lights, night and low-visibility operations stop.

ARM

Constant current regulators. The regulators in the vault that drive each lighting circuit. Networked for monitoring and control.

ARM

Visual docking guidance. Stand guidance that brings the aircraft to the stop line at the gate.

ARM

Jet fuel3 systems

Fuel farm control and tank gauging. Tank levels, pumps, valves, and overfill protection on large volumes of jet fuel.

ARM

Hydrant fueling system. Underground lines, hydrant pits, pumps, and emergency fuel shutoff out to the stands. No fuel at the stand, no departure.

ARM

Pipeline receipt and SCADA. The pipeline or terminal that supplies the fuel farm, and the SCADA that meters it in. Pipelines also sit under TSA's pipeline directives.

ARM

People movers and vertical transport3 systems

Automated people mover (APM). Driverless trains between terminals and concourses. Train control is often CBTC. When the train stops, passengers cannot reach their gates in time.

ARM

APM traction power. The substations and rail power for the people mover.

ARM

Escalators, elevators, moving walkways. Controllers are increasingly networked and remotely monitored by the maker.

ARM

Baggage3 systems

Baggage handling system (BHS). PLCs, conveyors, sorters, and the BHS SCADA. When it stops, bags pile up at check-in.

ARM

EDS screening integration. The checked-bag screening machines and the network that ties them into the BHS.

ARM

Baggage messaging and reconciliation. The messages that tell the BHS where each bag goes, fed from airline and common-use systems.

ARM

Aviation operations IT6 systems

Airport operational database (AODB). The schedule and live flight data that feed gates, displays, billing, and the BHS.

ARM

Flight and baggage information displays (FIDS, BIDS). What passengers and staff see. Wrong or blank screens send people to the wrong place.

ARM

Gate and stand management. Resource management that assigns aircraft to gates and stands.

ARM

Common-use check-in (CUTE, CUPPS) and kiosks. Shared check-in, bag drop, and boarding pass systems used by many airlines at once.

ARM

A-CDM. Airport collaborative decision making: shared timing data between the airport, airlines, ground handlers, and air traffic control.

ARM

ATC interfaces. Data links between airport systems and the air navigation service provider. The airport owns its side of the interface.

ARM

Communications3 systems

PA and voice paging. Announcements, including emergency evacuation messages.

ARM

Radio and LMR. Land mobile radio for operations, police, fire, and maintenance crews.

ARM

Network core and fiber. The backbone every system above rides on, often shared by tenants.

ARM

Life safety and security4 systems

Fire alarm and suppression. Detection, sprinklers, and smoke control. Tied to the BMS and to door release.

ARM

Access control and badging. Doors into secure areas, airside gates, and the badge system behind them.

ARM

CCTV and video management (VMS). Cameras across the terminal and airfield, on the network, used by security and operations.

ARM

Perimeter intrusion detection. Fence sensors, radar, and analytics around the airfield.

ARM

Building management2 systems

Building automation (BMS, BAS). HVAC, lighting, and smoke control across terminals. Often reached remotely by the maintenance contractor.

ARM

Lighting control. Terminal and apron lighting.

ARM

Gate equipment3 systems

Passenger boarding bridges. Jet bridge drives and PLCs, networked for monitoring.

ARM

400Hz ground power. Power to parked aircraft so engines and APUs can stay off.

ARM

Preconditioned air (PCA). Cooling and heating for parked aircraft.

ARM

Landside2 systems

Parking guidance and revenue control. Gates, pay stations, and plate readers, many of them cloud-connected.

ARM

Roadway signs and curb management. Dynamic signs and traffic control at the terminal front.

ARM

Tenants and vendors2 systems

Tenant networks. Airlines, ground handlers, concessions, and government agencies on shared infrastructure.

ARM

Vendor and OEM remote access. BHS, APM, BMS, and fuel system makers often keep remote support paths. Each one is a path in.

ARM

IT and OT at an airport

Airport IT is email, finance, HR, and the website. Airport OT is the automation that moves bags, people, fuel, power, and air, and lights the airfield. The two were built by different people for different reasons, and today they often share the same network core and the same remote access paths.

When IT fails, the airport loses data. When OT fails, bags stop, trains stop, aircraft cannot fuel or board, or the airfield goes dark. That is why OT cannot run on the office patch cycle and scanning tools, and why the team stays passive on live systems.

	Airport IT	Airport OT
What matters most	Protect the data: confidentiality first	Keep the airport running safely: availability and safety first
Examples	Email, HR, finance, the airport website	BHS, people movers, fuel, airfield lighting, CUP, fire and life safety
Life span	3 to 5 years, then replace	Often the life of the terminal; replaced with major projects
Patching	Monthly, often automatic	Needs the maker's approval and a maintenance window, overnight or in a slow season
Who owns it	IT department	Facilities, maintenance, airside operations, and contractors or the maker
When it fails	Data loss, outage, fines	Bags stop, trains stop, aircraft cannot fuel or board, the airfield goes dark
Remote access	Corporate VPN	Maker and contractor support links, often set up years ago

Operations control center with operators at consoles in front of a large wall display — An operations center sees the whole system. Its connections to business IT and vendors are where the assessment starts.

These systems have to work all the time, and one failure spreads

An airport does not close at night. Fuel, power, people movers, baggage, airfield lighting, flight information, and the safety systems have to run every hour of every day. They also depend on each other. Lose power or the central utility plant and the baggage system, the people movers, the jet bridges, and the flight displays go with it. Lose the hydrant fueling SCADA and departures wait. Lose the baggage system and check-in backs up into the terminal. That is why the cybersecurity of these systems cannot be an afterthought.

How one failure spreads. Red lines: power and fuel, the two dependencies almost everything else needs.

It has already happened

Three of these were physical failures, not cyberattacks. They show how far one failure travels across an airport. A cyber incident on the same systems travels the same way.

Physical failure

Atlanta, December 2017: one fire, main and backup power both lost

A fire in an underground electrical facility damaged the cables and switches for both the main and the redundant service. Power went out to the main terminal, the concourses, the trains, the control tower, and the north airfield lighting vault. The airport was dark for nearly 11 hours, and more than 1,000 flights were canceled. [22,24,23]

Physical failure

Heathrow, March 2025: one of three supply points lost, airport closed most of a day

A fire at the North Hyde substation cut one of Heathrow's three supply points. The review found that the airport's internal network design meant losing that one supply point took power from some operationally critical systems, and reconfiguring took an estimated 10 to 12 hours. Heathrow closed for most of March 21 and was fully operational on March 22. [25]

Physical failure

Auckland, September 2017: the only jet fuel line ruptures

The pipeline that is the only supply of jet fuel to Auckland Airport ruptured and was shut for 10 days. Airlines were limited to 30% of their normal fuel. Flights were canceled, delayed, and sent elsewhere to refuel. [26,27]

Cyberattack

Seattle-Tacoma, August 2024: ransomware hits baggage, kiosks, and display boards

The Port of Seattle disconnected its systems from the Internet to stop a Rhysida ransomware attack. The encryption and the response hindered baggage, check-in kiosks, ticketing, Wi-Fi, passenger display boards, the flySEA app, and reserved parking. Most systems were back within the week. [21]

Cyberattack

Europe, September 2025: one common-use provider, many airports

A cyberattack on Collins Aerospace's MUSE common-use software took down electronic check-in, bag drop, and boarding pass printing at several European airports. Airlines went to manual check-in. Brussels Airport canceled dozens of flights, and Heathrow and Berlin Brandenburg saw long delays. [20]

What applies, and what each one asks for

The short version. Which ones apply depends on the mode, the operator, and the country.

Oct. 18, 2022

TSA Security Directive, rail

Designated passenger and freight railroads

Performance-based. Network segmentation so OT can keep running safely if IT is compromised, access control for critical cyber systems, continuous monitoring and detection, and timely patching. Operators also have to assess how well the measures work. [2,4]

March 7, 2023

TSA emergency amendment, aviation

Certain TSA-regulated airport and aircraft operators

The same outcomes as rail: segmentation between IT and OT, access control, continuous monitoring and detection, patching of critical cyber systems, and proactive assessment of those measures. [3]

Proposed Nov. 7, 2024

TSA proposed rule, surface

Pipelines, freight rail, passenger rail, and rail transit

Enhancing Surface Cyber Risk Management would turn the surface directives into a standing rule, with a Cybersecurity Operational Implementation Plan and an annual Cybersecurity Assessment Plan. The comment period closed Feb. 5, 2025. Until a final rule takes effect, the security directives set the requirements. [5,6]

49 CFR 236 Subpart I

FRA Positive Train Control

Railroads required to run PTC

PTC is a safety system that can stop a train. The federal rules cover the safety plans and the systems behind it, so any security work on PTC starts with the people who own the safety case. [7]

Recommended practices

APTA control and communications security

Rail transit

APTA's SS-CCS series defines a security zone architecture for rail transit and how to protect the most critical zones. RP-006-23 adds an OT cybersecurity maturity framework. [8,9]

2019 onward

ICAO and EASA

International aviation

ICAO's Aviation Cybersecurity Strategy (2019) and Cybersecurity Action Plan. In Europe, Part-IS: Delegated Regulation (EU) 2022/1645, which covers aerodrome operators, applied from Oct. 16, 2025, and Implementing Regulation (EU) 2023/203 from Feb. 22, 2026. [11,12,13]

Series

ISA/IEC 62443

Industrial automation and control systems

Zones and conduits, security levels, and requirements for asset owners, integrators, and suppliers. Good language for BHS, APM, and fuel system contracts. [15]

Frameworks

NIST CSF 2.0 and CISA CPGs

Voluntary, any sector

The NIST CSF gives the program and board reporting a structure. CISA's Cross-Sector Cybersecurity Performance Goals are the baseline CISA points transportation owners to. [16,17,1]

The ACRP Guidebook on Best Practices for Airport Cybersecurity is a good plain-language starting point for airport leadership. [14]

Assess, fix the immediate need, then stay

The same steps for a transit agency, a railroad, an airport, or a traffic management center. Start with one site or one system group.

Step 1

Assess

Plant-safe OT assessment of the operations center, field sites, and the systems in the breakdown
Network architecture review, from the business network and vendors down to the field devices
OT / ICS penetration testing only on staging systems or in approved windows
Gap review against the TSA directives, APTA, IEC 62443, and NIST CSF

The plant-safe assessment →

Step 2

Remediate

Fix the immediate need first, ranked by safety and operations impact
Segmentation between business IT, tenants, and OT
Secure remote access for makers and contractors
OT cybersecurity roadmap tied to capital and terminal projects
Policy, procedures, and corporate guidance
Staff training through CambiOS Academy

Fix the immediate need →

Step 3

Monitor and maintain

24x7 MSP + Metrics and Reports on the assets the team assessed
ICS / OT incident response planning and support
Tabletop exercises with operations, maintenance, and IT
Reassessment after major projects

24x7 MSP + Metrics and Reports →

Where each service fits

	Assess				Remediate			Monitor
System group	OT assessment	Architecture review	Pen testing (staging)	Standards gap	Segmentation, hardening	Secure remote access	Roadmap, policy	24x7 monitoring	IR, tabletops
Traction powerSubstations, rail SCADA
Signaling and train controlInterlocking, CBTC, PTC
Operations control centerOCC, SCADA, radio
Airport power and CUPSubstations, generators, chillers
Airfield lightingAGL control, vault
Jet fuelFuel farm, hydrant, pipeline
Baggage and screeningBHS, EDS integration
People moversAPM, CBTC, vertical transport
Aviation operations ITAODB, FIDS, CUPPS, A-CDM
Life safety and securityFire, access, CCTV, perimeter
Highways and ITSSignal controllers, ATMS, signs
Vendors and tenantsRemote access, shared networks

Core service for this group Where it fits the system and the riskBlank: rarely appropriate

Why pen testing is limited

Active testing on live fuel, airfield lighting, or train control can trip them. Test on staging systems or in approved windows. Stay passive in operation.

Why vendors get a row

BHS, people mover, BMS, and fuel system makers often hold remote access. Their access is part of the risk.

Why safety systems are handled carefully

PTC, fire alarm, and fuel shutoff are safety systems. The owner of the safety case is in the room before anyone touches them.

Two major international hub airports

For two major international hub airports in the Middle East, Red Tiger Security performed security assessments, a remediation plan, strategy and security roadmap, including corporate guidance that positively shaped the security posture of both airports.

Security assessments

Remediation plan

Strategy and security roadmap

Corporate guidance

References

Numbers match the bracketed citations on this page. Sources checked Oct. 4, 2026.

CISA, Transportation Systems Sector. https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/transportation-systems-sector
TSA, "TSA issues new cybersecurity requirements for passenger and freight railroad carriers," Oct. 18, 2022. https://www.tsa.gov/news/press/releases/2022/10/18/tsa-issues-new-cybersecurity-requirements-for-passenger-and-freight
TSA, "TSA issues new cybersecurity requirements for airport and aircraft operators," March 7, 2023. https://www.tsa.gov/news/press/releases/2023/03/07/tsa-issues-new-cybersecurity-requirements-for-airport-and-aircraft
TSA, Security Directives and Emergency Amendments. https://www.tsa.gov/sd-and-ea
Federal Register, 89 FR 88480, "Enhancing Surface Cyber Risk Management," proposed rule, Nov. 7, 2024. https://www.federalregister.gov/documents/2024/11/07/2024-24704/enhancing-surface-cyber-risk-management
Reginfo.gov, Unified Agenda, RIN 1652-AA74, Enhancing Surface Cyber Risk Management (timetable). https://www.reginfo.gov/public/do/eAgendaViewRule?RIN=1652-AA74&pubId=202410
eCFR, 49 CFR Part 236 Subpart I, Positive Train Control Systems. https://www.ecfr.gov/current/title-49/subtitle-B/chapter-II/part-236/subpart-I
APTA, SS-CCS-RP-002-13, Securing Control and Communications Systems in Rail Transit Environments, Part II: Defining a Security Zone Architecture for Rail Transit and Protecting Critical Zones. https://www.apta.com/standard/apta-ss-ccs-rp-002-13/
APTA, SS-CCS-RP-006-23, Operational Technology Cybersecurity Maturity Framework (OT-CMF) Overview. https://www.apta.com/standard/apta-ss-ccs-rp-006-23/
U.S. DOT ITS Joint Program Office, Cybersecurity. https://www.its.dot.gov/research_areas/cybersecurity/index.htm
ICAO, Aviation Cybersecurity Strategy (October 2019). https://www.icao.int/aviation-cybersecurity/strategy
ICAO, Cybersecurity Action Plan (first edition November 2020, second edition January 2022). https://www.icao.int/aviation-cybersecurity/action-plan
EASA, FAQs on Part-IS (Delegated Regulation (EU) 2022/1645 and Implementing Regulation (EU) 2023/203). https://www.easa.europa.eu/en/the-agency/faqs/information-security-part
Transportation Research Board, ACRP, Guidebook on Best Practices for Airport Cybersecurity. https://nap.nationalacademies.org/catalog/22116
ISA, ISA/IEC 62443 series of standards. https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
NIST, Cybersecurity Framework. https://www.nist.gov/cyberframework
CISA, Cross-Sector Cybersecurity Performance Goals. https://www.cisa.gov/cross-sector-cybersecurity-performance-goals
CISA, "The Attack on Colonial Pipeline: What We've Learned and What We've Done Over the Past Two Years". https://www.cisa.gov/news-events/news/attack-colonial-pipeline-what-weve-learned-what-weve-done-over-past-two-years
WIRED, "The Cheap Radio Hack That Disrupted Poland's Railway System," Aug. 2023. https://www.wired.com/story/poland-train-radio-stop-attack/
CSO Online, "European airports continue to crawl after a cyberattack on Collins MUSE systems," Sept. 2025. https://www.csoonline.com/article/4060804/european-airports-continue-to-crawl-after-a-cyberattack-on-collins-muse-systems.html
Port of Seattle, Port cyberattack archive. https://www.portseattle.org/news/port-cyberattack-archive
Georgia Power via PR Newswire, "Power restored for all essential activities at Hartsfield-Jackson International Airport," Dec. 18, 2017. https://www.prnewswire.com/news-releases/power-restored-for-all-essential-activities-at-hartsfield-jackson-international-airport-300572422.html
CNN, "Atlanta's Hartsfield-Jackson airport restores power after crippling outage," Dec. 17, 2017. https://www.cnn.com/2017/12/17/us/atlanta-airport-power-outage/index.html
Atlanta Journal-Constitution, "Georgia Power responds to PSC on Hartsfield outage". https://www.ajc.com/business/root-cause-for-airport-outage-still-mystery-for-georgia-power/FfM3v9wFF5IH1qbtzsukzJ/
National Energy System Operator (NESO), "Final report from the review into the North Hyde Substation outage," July 2, 2025. https://www.neso.energy/news/final-report-review-north-hyde-substation-outage
New Zealand Department of Internal Affairs, Auckland Fuel Line Government Inquiry, Final Report. https://www.dia.govt.nz/Auckland-Fuel-Line---Final-Report
Associated Press, "Repairs to New Zealand pipeline ease airport fuel shortage," Sept. 2017. https://apnews.com/general-news-a7d8525ef87b4fb9b045f80dc90f255d

Request an assessment

Start with one site or one system group, plant-safe, with operations and maintenance in the room. +1.877.387.7733 · info@redtigersecurity.com

Request an assessment

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.