Cybersecurity of Traffic Management Systems

The NCHRP Project 03-127 continuation request identified four areas for further study:  (1) Update of the Cybersecurity Risk Assessment Web Guidance [$100,000]. As the Web Guidance is used, possible improvements will be identified by users. There will also be a need to keep the information current and an initial investment of NCHRP funds will allow a process to be developed. (2) Additional Penetration Testing of TMS Devices [$300,000]. The original project spent $400,000 on penetration testing of 13 devices (3 traffic signal controllers, 3 conflict monitors, 1 changeable message sign controller, 2 V2I roadside units, 4 cameras). Feedback from agencies and vendors indicate that further testing would be valuable in identifying vulnerabilities. This could include more devices (both types of devices and from different vendors) and different configurations (including cabinets). (3) Best Practice Guide for Cybersecurity Resilience [$250,000]. This would summarize information gained during the current project and curating best practices (inside and outside of transportation) to produce actionable guidance for agencies and equipment vendors. This may include items such as recommendations for workforce development, development of a controls assessment checklist, recommendations for ways to integrate cybersecurity into equipment designs, methods for hardening legacy systems, and specification recommendations. (4) Expansion of the CAV Primer [$100,000]. This would document privacy- and cybersecurity-related lessons learned by the pilot deployments and provide more detailed information on topics such as deploying the Security Credential Management System (SCMS).  However, based on discussions with the NCHRP Project 03-127 project research team, no adequate user feedbacks were effectively collected since the launch of the Cybersecurity Risk Assessment Web Guidance. Therefore, the task of Updating the Cybersecurity Risk Assessment Web Guidance has no ground to perform. Moreover, the Additional Penetration Testing of TMS Devices task requires specific product evaluation, which is not in line with TRB’s business and may not generate publishable research results by TRB. Therefore, more than half of the originally scoped tasks are deemed infeasible based on our preliminary assessment. Large deviation from the approved problem statement by the AASHTO Special Committee on Research and Innovation seems to be inevitable. Furthermore, due to the sensitivity nature of the research results,  the Cybersecurity Risk Assessment Web Guidance is presented as a “black box” tool and in lack of creditable information for interested agencies to action upon, which limited the usefulness of the developed tool. Moreover, during a web conference conducted on June 6th, 2022, between NCHRP staff and FHWA representatives, the FHWA representatives expressed deep concerns and objection on the continuation of NCHRP Project 03-127.  After further deliberations and based on the above information, it was recommended that Project 03-127(01), FY 2021 be cancelled and the funds allocated to this project ($750,000) be returned to Program funds for use by the AASHTO Special Committee on Research and Innovation as appropriate.

• Record URL:
  http://apps.trb.org/cmsfeed/TRBNetProjectDisplay.asp?ProjectID=5354
• Supplemental Notes:
  • Project cancelled.

Language

• English

Project

• Status: Terminated
• Contract Numbers:

  Project 03-127(01)

• Sponsor Organizations:

  National Cooperative Highway Research Program

  Transportation Research Board
  500 Fifth Street, NW
  Washington, DC  United States  20001

  American Association of State Highway and Transportation Officials (AASHTO)

  444 North Capitol Street, NW
  Washington, DC  United States  20001

  Federal Highway Administration

  1200 New Jersey Avenue, SE
  Washington, DC  United States  20590
• Project Managers:

  Deng, Zuxuan

• Start Date: 20221024
• Expected Completion Date: 0
• Actual Completion Date: 20221024

Subject/Index Terms

• TRT Terms: Best practices; Computer security; Disaster resilience; Highway safety; Intelligent transportation systems; Risk assessment; Traffic signal control systems
• Subject Areas: Data and Information Technology; Highways; Operations and Traffic Management; Safety and Human Factors; Security and Emergencies;

Filing Info

• Accession Number: 01845600
• Record Type: Research project
• Source Agency: Transportation Research Board
• Contract Numbers: Project 03-127(01)
• Files: TRB, RIP
• Created Date: May 18 2022 11:33AM