Image
Product Cybersecurity at Wabtec
The rail industry is undergoing further regulation of its Operational Technology security, and its leadership is gaining insights into related risks. The rail industry is at a pivotal point in its security journey. There is a unique opportunity to achieve material operational efficiencies in its Operational Technology programs through leveraging “design in” and “design out” methods. Long-term, by viewing rail security through these two planning lenses, (“design in” and “design out”) rail companies can balance security requirements and costs, better identify areas of inefficiencies, and improve the likelihood security will be both successfully deployed and regularly operationally maintained.
Our Commitment
Cybersecurity is an important part of the resilience and reliability of products and industries Wabtec services. Wabtec applies secure development practices throughout the product lifecycle, including risk assessment, vulnerability management, and incident response, to strengthen product resilience. Led by Wabtec’s Chief Product Security Officer, our product cybersecurity program supports the resilience of products used across freight, transit, mining, industrial, and marine environments
NEWS & EVENTS
Product Cybersecurity
Our Approach
Wabtec integrates cybersecurity practices throughout the product development lifecycle, including engineering training and awareness, risk assessment and threat modeling, security requirements, secure design and development, security verification, vulnerability management, and post-release monitoring.
IEC 62443-4-1 Certified
Wabtec’s IEC 62443-4-1 certified product cybersecurity program provides well-defined benchmarks throughout the development lifecycle. This standards-driven approach enables a common cybersecurity baseline for Wabtec products.
Resilience
Wabtec’s product cybersecurity team supports the security and resilience of products throughout their lifecycle. Our activities include identifying and assessing cybersecurity risks, supporting product readiness, monitoring relevant vulnerabilities and threats, and coordinating the response to reported product security vulnerabilities.
Product security capabilities, including authentication, encryption, access control, secure communications, and software integrity, are considered throughout the product lifecycle to strengthen cybersecurity across Wabtec products.
Wabtec’s Product Security Incident Response Team (PSIRT) coordinates product vulnerability reporting, triage, assessment, remediation activities, and disclosure in collaboration with product teams.
Vulnerability Management
Learn more about product cybersecurity vulnerability management and reporting:
- Report a Product Cybersecurity Vulnerability
Security researchers, customers, vendors, industry partners, government agencies and other parties can report potential cybersecurity vulnerabilities affecting Wabtec products to Wabtec’s Product Security Incident Response Team in accordance with Wabtec’s Product Cybersecurity Vulnerability Reporting Policy.
- Report Cybersecurity Advisories (Customer Portal)
Wabtec provides potentially impacted customers with product cybersecurity advisories and related security information through Wabtec’s secure customer portal. Access is limited to authorized customers.
Collaboration
Wabtec collaborates in industry efforts that bolster resilience in critical infrastructure. Wabtec actively participates in industry and standards groups like CENELEC (TS 5701), IEC TC9/PT 63452, and UNIFE, to support cybersecurity in digital rail innovation. We seek opportunities for ongoing engagements with customers to bolster security and resilience in the industries we serve. As industry standards and customer needs change, this external engagement allows Wabtec’s product cybersecurity to evolve with industry.
