Illinois Department of Transportation (IDoT) is to pilot a group-based cybersecurity vulnerability assessment across six small, and mid-size, rural Illinois transit agencies.
IDoT will work with transportation infrastructure cybersecurity firm Cybrbase with these local agencies, which often have relatively few staff and limited budgets, and are "routinely left out of the cybersecurity conversation".
The pilot will examine where security risks might be and help to mitigate them before they compromise public safety, transportation systems and municipal operations.
The idea is to do this at a "significantly lower" cost than traditional cybersecurity audits, using Cybrbase’s proprietary NIST-CRR-based platform, which is powered by AI.
Cybrbase says it "aims not only to bolster local defences but also to serve as a model, showcasing how state-level transportation agencies, insurance risk pools, and transit agencies can work collaboratively with their local transit agencies to create a more resilient transportation ecosystem".
A recent Mineta Transportation Institute (MTI) study - Does the Transit Industry Understand the Risks of Cybersecurity and are the Risks Being Appropriately Prioritised? - revealed persistent cybersecurity gaps in transit agencies in general, but particularly in small and rural transit agencies across the US.
It noted that "many of these agencies are challenged by outdated technology, and limited resources—making them particularly susceptible to cyberattacks".
Scott Belcher, senior advisor at Cybrbase, MTI research associate, and former CEO of ITS America, says: “As a transportation leader, IDoT is closely watched by other agencies around the nation who may not be aware that cybersecurity vulnerabilities exist among their transit agencies. This initiative is intended to close that gap.”
The local agencies in the pilot include Decatur Public Transit System, Piatt County Public Transportation, QC Metrolink, Reagan Mass Transit and Warren County Public Transportation.
Each of them will complete its assessment independently and confidentially, but is expected to share best practices across the cohort.
