DIN VDE V 0831-104:2015-10

For electrical railway signalling systems, the aspect of IT security (security) has hitherto only been dealt with normatively in DIN EN 50159 (VDE 0831-159) and DIN VDE V 0831-102 (VDE V 0831-102), almost exclusively in that document from the point of view of communication security (for safety-relevant systems in terms of safety). The aspect of protection against "vandalism and unreasonable human actions" is completely omitted in DIN EN 50126 (VDE 0115-103), both in the current edition and in the scope of the revision. This pre-standard is applicable to electric, electronic and programmable electronic systems (E/E/PES including sub-systems and equipment) for railway signalling applications. This pre-standard provides recommendations that can be used to define requirements to ensure that the risk of IT security threats is generally acceptable in electric train signalling equipment. It presents the assumptions underlying these recommendations in a structured manner. The requirements refer to the development, operation and procurement of IT systems in electrical, electronic and programmable electronic railway signalling systems. In contrast to functional security, this pre-standard deals with risks due to malicious attacks. The IT security requirements are based on IEC 62443, in particular its definition of IT security levels and the specifications for describing the architecture of systems using zones and channels. These IT security requirements are derived and implemented according to DIN EN 50129 (VDE 0831-129). The responsible committee is Subcommittee DKE/UK 351.3 "Bahn-Signalanlagen" ("Signalling systems for railways") of the DKE (German Commission for Electrical, Electronic and Information Technologies) at DIN and VDE.