Railroad Cybersecurity: A Systematic Bibliometric Review

1. Introduction

The railroad industry, a crucial backbone of the global supply chain, has been grappling with complex security issues. These complexities are related to the physical infrastructure, human resources, and the intricacies of modern technologies that support modern rail operations. These include Internet-of-Things (IoT) devices, global positioning systems (GPS), and intelligent sensors. For instance, the recent addition of a positive train control (PTC) system has been a critical achievement toward improving safety in this industry [1]. However, these technologies have also opened new vulnerabilities for potential cyberthreats [2]. Cybersecurity in rail freight transportation has become crucial because of the industry’s growing dependence on digitalization, connected systems, and automation. For example, malware attacks in the railroad industry have increased by more than 200% globally in the last five years [3]. Although extant studies have explored several areas of railroad cybersecurity, including signaling [4] and cryptographic protocols [5], most of these studies fail to provide a comprehensive perspective on technological, human, and operational risks in railroad cybersecurity. Several of these studies also fail to provide practical mitigation strategies for holistic adaptation. This study aims to bridge this gap by synthesizing findings and recommendations across various domains by offering a comprehensive framework while providing a practical strategy for the growing discourse. Advancing technology in the rail industry heightens the need for robust cybersecurity measures to ensure continuous operations [6]. In addressing these issues, studies focused on various aspects of cybersecurity practices for the rail freight industry, including sustainability [7,8], risk assessment and management [9], cybersecurity framework [3], and technology innovation [10]. The Transportation Security Administration (TSA) recently implemented a new rule for cybersecurity evaluation of the major modes of transportation, including rail freight [11]. Although this regulation aims to enhance cyber resilience, some industry stakeholders have raised concerns about its implementation and the associated compliance costs [12].

In the past, transportation security risks mostly stemmed from physical attacks. After 9/11, there was a notable change in focus toward securing transportation systems from potential terrorist threats, leading to comprehensive policies implemented at both national and international levels. This age saw notable advancements in transportation security due to incorporating digital technologies, which brought new vulnerabilities [13]. The railway industry has encountered difficulties in modifying current safety protocols to effectively manage these cybersecurity threats [14]. The literature has identified signaling and communication networks in railway systems as being susceptible to a range of cyberthreats. Other studies highlight vulnerabilities in the sector, including malware, wireless attacks, and unauthorized system access [15]. Initiatives like Shift2Rail [14] and standards developed by international bodies like the International Organization for Standardization [16,17] and National Institute of Standards and Technology [17,18] have aimed to enhance cybersecurity resilience in railroad operations. These efforts emphasize the importance of digital security in sustaining operational efficiency and environmental compliance [19]. Demiridis and Pyrgidis (2022) highlighted the significance of cybersecurity in the rail freight sector for sustainable development [20]. The study shows the importance of improving essential services in this industry, such as ensuring high reliability and punctuality to increase competitiveness with other modes of transportation. Aminzadegan et al. (2022) highlighted the environmental friendliness of rail as compared with other modes of transportation [21], making it a priority for government and other policymakers. Rail freight transportation is advancing by integrating digital platforms such as online exchanges [22], making cybersecurity crucial for protecting data and transactions.

This research provides a comprehensive overview of current cybersecurity practices in the rail freight industry through a combined systematic literature review (SLR) and a bibliometric analysis. This contribution highlights existing gaps and offers new insights to bridge these gaps. These insights will strengthen the rail freight sector’s defenses against current and emerging cyber hazards and open new research opportunities to enhance the industry’s cybersecurity. Given the continuous increase in cybersecurity issues in rail freight transportation, this review provides a multifaceted exploration by answering the following four research questions:

• Challenges: What are the primary cybersecurity threats and vulnerabilities identified in rail freight transportation systems?
• Measures: How do existing cybersecurity measures address the risks associated with rail freight transportation?
• Emerging Trends: What are the emerging trends in cybersecurity technologies and practices for enhancing the safety and security of rail freight transportation?
• Innovation: How effective are current cybersecurity practices in mitigating the risk of cyberattacks in rail transportation networks?

The subsequent sections of this paper are as follows. Section 2 describes the SLR methodology. Section 3 offers answers to the research questions based on the reviewed literature. Section 4 discusses the results while offering implications. Section 5 concludes the SLR, highlighting the gaps identified, limitations, and recommendations for future research.

2. Methodology

Undertaking a literature review is a complex process, with many methods available to compare and contrast the knowledge and gaps in existing literature for a particular set of research questions. These methods range from a traditional literature search, forward or snowball sampling of systematic reviews, and meta-analysis to distill trends. However, the most common contemporary guideline used is the “preferred reporting items for systematic reviews and meta-analyses” (PRISMA), which provides a degree of standardization as compared with others [23]. The authors chose the SLR method over others like narrative, critical, and theoretical reviews for its ability to minimize bias and limitations [24]. The SLR methodology along with the PRISMA checklist systematically identifies research gaps and provides a comprehensive and transparent review approach to evidence synthesis [25]. The PRISMA method comprises 27 items across seven sections, which this study divides into four stages: the pre-literature collection, literature (publication) selection, systematic review, and data analysis. The authors selected PRISMA to ensure rigor and minimize biases in synthesizing a comprehensive analysis of existing studies. By following the structured stages, the study identifies critical gaps in railroad cybersecurity literature by integrating a comprehensive overview of relevant studies and narrowing it down to the ones that address the above research questions.

2.1. SLR Workflow

Figure 1 illustrates the framework developed in this study for the SLR.

The main stages were as follows:

Pre-literature collection: Define the research questions, and their aim and scope. State the specific methodology or tools incorporated. This stage followed the PRISMA framework, which uses combinations of keywords and search phrases to produce potentially relevant results.

5.

Literature selection: Conduct an electronic search of different databases using the defined search phrases that focus on the scope of the study. Screen the search results to eliminate irrelevant literature based on titles, abstracts, publication dates, language, keywords, and other criteria.47

6.

Systematic review: Analyze the full text of relevant studies and classify the corpus based on the research questions and themes for further analysis.

7.

Data analysis: Interpret the analysis by comparing and contrasting the literature analyzed.

2.2. Pre-literature Collection Stage

This stage focused on identifying literature that addresses the four core research questions: challenges, protective measures, emerging trends, and innovations in cybersecurity within rail transportation. The research questions were critical in shaping the scope, emphasizing cybersecurity in the rail freight industry. The literature search included only journal and conference papers to ensure an elevated level of rigor.

Following the PRISMA framework, this stage carefully selected keywords and search phrases to target literature directly aligned with the study’s scope. The search strategy aimed to encompass a broad range of relevant studies while systematically narrowing the results to those that best addressed the research questions. The authors then evaluated each identified source for its contribution to understanding the unique cybersecurity concerns in rail freight, as well as the industry’s adaptation to emerging threats and technologies. This approach ensured a focused and comprehensive set of literature for the analysis, emphasizing both breadth and depth in addressing the complexities of rail freight cybersecurity.

2.3. Literature Selection

Guided by the research questions, the authors developed Boolean search commands to narrow the literature search and focus on relevant publications. The central premise for selecting relevant literature was to include scope for both rail freight transportation and the implementation of cybersecurity practices. Hence, the selected keywords and Boolean operators were (“rail freight” OR “railway security” OR “train transportation”) AND (“cybersecurity” OR “cyberattacks” OR “cyber resilience” OR “cybersecurity practices”). The authors also considered regional variations of key words. For example, “train transportation” and “rail transportation” refer to the same scope reviewed in this study. The searches utilized the Google Scholar search engine and two databases: Web of Science and Science Direct. The authors selected these databases because they encompass a broad spectrum of interdisciplinary studies.

Table 1 summarizes the Boolean search commands and results from each tool. Search criteria included language, publication year, accessibility to text, uniqueness, and publication type. Table 2 summarizes the categories and criteria considered for the selected publications. The authors excluded reports that did not address the research questions.

2.4. Bibliometric Assessment

The bibliometric analysis assessed the temporal and geographic distribution of the selected body of literature to gain insights into the trends of discourse in railroad cybersecurity. The authors also utilized the NVivo software (version 14) [26] to categorize articles by analyzing their full text for relevance to the research questions, and to provide visualizations by a word cloud. The software provided a visualization of key terms, emphasizing gaps in extant studies. The authors also utilized the VOSviewer software (version 1.6.20) to visualize co-occurrence networks of important terms and concepts extracted from the selected body of literature [27]. The visualizations included term co-occurrence from the titles and abstracts to highlight the bibliographic coupling of key themes and concepts. Hence, the bibliographic networks provided a qualitative assessment and validation of the subject matter focus in the selected literature, highlighting the effectiveness of the SLR workflow and screening.

3. Results

The subsections that follow present the results of the literature screening, the bibliometric analysis to visualize and validate the screening results, and an assessment of the findings with respect to addressing the four research questions, and an evaluation of current industry practices.

3.1. Literature Screening

Figure 2 shows the results of the PRISMA workflow. The initial search yielded 5,223 studies across Google Scholar, Science Direct, and Web of Science. This result included peer-reviewed journal articles and conference papers from January 2017 to November 2024. To streamline the search for all the databases, the authors utilized the “refine function” for each database to limit the literature search to only journal and conference articles. Applying the inclusion and exclusion criteria in Table 2 reduced the relevant studies to 253 for further scrutiny. The initial screening phase identified and removed 2,251 duplicates and excluded an additional 2,701 studies that focused solely on either cybersecurity or rail freight transportation, without addressing both areas.

The authors removed an additional 18 studies because the abstracts and keywords did not align with the research area. Of the 253 articles screened, 99 studies lacked comprehensive data on cybersecurity framework in rail freight transportation, leaving 154 articles for further analysis. There were additional exclusions based on full text unavailability—some of the studies had only their abstracts in English with the full text in other languages, and some studies were not journal or conference papers. The final review yielded 70 articles.

3.2. Bibliometric Analysis

Figure 3 shows the temporal distribution of the publications. The number of publications steadily increased throughout the years, peaking in 2023. This reflects a growing trend in the integration of digital systems and autonomous operations in transportation, which has in turn increased vulnerability to cyber threats. Figure 4 shows the publication distributions by country. Sweden and France had the most publications on the topic, followed by Italy, the United States, and China. This reflects Sweden and France taking a lead role in railway cybersecurity research, stemming from Europe’s continual investments in projects like Shift2Rail [14]. The Shift2Rail initiative is essential as it employs blockchain technology to ensure the security of data communication within rail systems. Nonetheless, the initiative does not adequately represent other regions like Africa and various areas in Asia, even as they increasingly embrace railroad infrastructure. This geographical disparity results in a significant oversight for these areas, largely attributed to limited resources, ineffective regulatory structures, or a deficit in understanding how to address intricate cybersecurity challenges within the railroad industry. In order to bridge this gap, there is a need for information that highlights a comprehensive approach to integrating technological innovation with operational strategies for effective policy implementations. Relevant studies highlighted in this study, therefore, aim to address advanced cybersecurity practices across diverse economies and infrastructure.

Figure 5 shows a word cloud of the most frequently used terms in the selected corpus where the font size reflects their relative count. This word cloud validates the quality of the literature selection with the most frequent words being “railway,” “train,” “system,” “safety,” “attacks,” “cybersecurity,” and “security.”

Figure 6 shows the term co-occurrence network. The size of the circles represents the relative frequency of the term in the corpus. The thickness of the lines connecting terms represents the relative frequency of their co-occurrence in the corpus. The distinct colors represent cluster terms based on their co-occurrence and relationship within document subsets.

These clusters represent thematic areas in the field. The largest cluster in red color, centered on “technology,” emphasizes the pervasive role of technological advancements in addressing cybersecurity issues in rail freight systems. The other prominent cluster in green color focus on “threat,” “attack,” and “vulnerability,” indicating concentrated research on vulnerabilities, cyberattacks, and operational impacts. Terms in the blue cluster like “transportation,” “framework,” and “implementation” reflect ongoing efforts to develop strategic and analytical approaches to mitigate risks in transportation systems. The connections among clusters demonstrate the interdisciplinary nature of cybersecurity, linking technological innovation with operational and strategic measures. This visualization highlights critical research areas and interdependencies, offering insights into emerging trends and gaps in the field. Table 3 classifies representative studies into the five categories and 12 themes shown.

3.3. Types of Cyberattacks in the Rail Industry

There were 23 articles that focused on the types of cyberattacks common in the rail freight industry. The authors categorized them into five main types: anomaly detection, phishing, software vulnerability, malware, and denial of service, as shown in Table 4. Identifying the type of cyberattack is the first step in fully understanding the mitigation strategy to implement. All the studies asserted that these types of cyberattacks pose vulnerability to railroad operations. Even though various organizations have implemented numerous mitigation strategies, attackers often find other ways to disrupt operations [17]. Even though all these attacks increase vulnerability in the rail freight industry, their severity level differs [37].

Based on an analysis of 1,496 security breaches within a railway infrastructure from January to April 2021, the authors concluded that denial-of-service, phishing, and malware were the most frequent attack types, accounting for over 40% of incidents. Malware and denial-of-service attacks affected operational systems, leading to delays [76]. For instance, in 2016, the San Francisco rail system experienced a ransomware attack where passengers could ride for free [77]. In October 2017, a distributed denial of service (DDoS) attack targeted Sweden's transportation network, causing a system failure to track rail locations, which led to disruptions in road traffic maps [78]. These incidents underscore the importance of implementing layered defense strategies that include anomaly detection and training programs for employees to reduce these risks effectively. Phishing was by far the most common type of cyberattack in the rail freight industry [79], with five of the 23 papers discussing it. Such attacks involve sending deceptive emails to employees to gain unauthorized access to sensitive information within the business or sector. Some articles also highlighted other attack types, such as SQL injection, watering holes, cross-site scripting, malware, and brute force [17]. Despite phishing being the predominate type of attack in the railroad industry, affecting more of the recorded incidents in the sector [76], most of the suggested mitigation strategies focus on attack detection and network vulnerabilities rather than a layered strategy that combines real-time anomaly detection and awareness tailored to bridge the gap of human contribution to those risks. This disparity highlights a critical gap the study seeks to address.

3.4. Challenges of Cybersecurity in the Rail Industry

Research question 1 focused on different themes for the types of cyberattacks commonly reported in the rail freight industry, the vulnerability of the railway systems, and the risk assessment methodologies currently implemented to mitigate these challenges. The increase in automation across the transportation industry hinges on the reliance on digitalization and connectivity. While this initiative offers to increase efficiency and reduce cost, these systems become more vulnerable to cyberattacks. With the constant evolution of technology, the rail industry has evolved significantly from using coal-powered steam locomotives to integrating sophisticated technologies like PTC, reflecting significant technological advancements [1].

Seventeen of the relevant papers focused on network vulnerabilities in the rail freight industry. The studies asserted that the use of wireless communications makes these systems vulnerable to cyberattacks [5,28,82]. For example, Kiviharju et al. (2022) highlighted the need for an extensive evaluation of the communication systems in the European Rail Traffic Management System [5]. In addressing the issue of vulnerabilities in this industry, the authors identified three broad categories of vulnerabilities: (1) operational, (2) technical, and (3) interconnected. Table 5 characterizes the distinct types of vulnerabilities with their corresponding relevant studies. For example, while acknowledging the railway systems as a critical infrastructure in the transportation industry, Chan (2022) discussed the operational vulnerabilities within the sector [83]. On the other hand, Gaggero et al. (2024) highlighted the technical vulnerability within the industry, focusing on infrastructure attacks, especially the communication network [29]. The authors concluded by highlighting the gaps within the wireless communication industry. Soderi et al. (2023) highlighted that some of the vulnerabilities exist due to the industry’s lack of a safety and security mindset during the manufacturing process [4]. Kour et al. (2020) highlighted the importance of becoming aware of attacks and vulnerabilities when evaluating cybersecurity programs in the rail freight industry [17].

Many relevant studies have presented steps for implementing risk assessment in the rail freight industry. Rekik et al. (2018) presented critical steps in assessing risks for train control and monitoring systems: (1) identification of critical assets, (2) assessing their vulnerabilities to cyberattacks, and (3) evaluating their likelihood and consequences of an attack [2]. The industry has also utilized tools like simulation and predictive models to assess potential cyberattack scenarios. For example, Kour et al. (2020) adopted the cyber kill chain model in a simulation scenario to assess potential cyberattacks [76]. The authors iterated the seven stages of this model developed by Lockheed Martin (2009), focusing more on the initial stages. Most studies asserted that the assessment should consider the cyber-physical nature of the constant evolution of technological advancements in rail freight systems to address the need for a cross-domain threat.

3.5. Risk Management in the Rail Industry

Research question 2 focused on existing cybersecurity measures in the rail freight industry through the lens of security frameworks and their components. The studies analyzed presented a broad range of mitigation methodologies for addressing risks in the rail freight industry. Each method presented a different approach to distinct types of cyberattacks. Each measure attempted to address an existing cyber security issue or to simulate a cyberattack. The authors delineated these measures into soft and hard strategies to reflect prevalent strategies implemented in the field. Soft strategies encompass measures that do not necessitate infrastructural changes but involve alterations in human training and operational methodologies within the rail freight industry. These strategies include training programs, adopting operational practices, and implementing regulations and standards. An example of a soft strategy is the new TSA regulation [11] implemented to help safeguard the transportation sector, including the railroad industry, against cyber-related disruptions. Conversely, hard strategies involve measures that require modifications to the physical infrastructure, such as upgrading security systems, enhancing network infrastructure, and implementing real-time monitoring systems and robust cyber-physical systems.

More than half of the studies suggested a soft strategy approach to address various rail freight industry risks. A significant body of literature highlighted the importance of continuous employee training as a cornerstone of cybersecurity. Thaduri et al. (2019) highlighted the shift toward digitalization in the rail freight industry [7]. They hinted at various soft strategies such as human factor training, policy development and compliance, information sharing and collaboration, incident response and management, and continuous auditing to protect sensitive information within the railway freight industry. Thron et al. (2024) recommended a dynamic strategy for educating employees on cybersecurity [36]. Rekik et al. (2018) implied undertaking a comprehensive threat landscape assessment like the one proposed in the ROLL2RAIL project to determine unmitigated cyber risks [2]. The other half of the studies adopted the hard strategies approach. The most common strategy was an improved firewall and intrusion detection system, which is essential for early detection within the systems [28,82,83]. Overall, the rail freight industry can enhance its defenses against cyberattacks by conducting cyber-physical security risk assessments and implementing customized security measures.

3.6. Emerging Trends in the Rail Freight Industry

This section focuses on research question 3 to explore trends in network security management and future directions in rail cybersecurity. This industry is evolving rapidly by integrating modern technologies and methods to improve safety and cybersecurity. For example, electric-powered trains are emerging to establish greener, more energy-efficient rail freight systems [86]. Enhancing cybersecurity awareness and providing training is crucial for increasing the reliability and robustness of railway systems, emphasizing the beneficial influence of a cybersecurity culture in businesses [17]. The emergence of Industry 4.0 has also assisted in the convergence of information technology in the railway industry, resulting in reliability and operational efficiency [57]. The evolution of technology in the rail freight industry has warranted constant reliance on communication systems for signaling, thereby creating growing concerns due to system vulnerabilities [87]. Therefore, in ensuring rail freight transportation safety, there should be comprehensive traffic management within the networks in addition to infrastructure management [88]. Another emerging technology is the use of blockchains to provide a decentralized security framework in managing transactions, improving reliability and data distribution across various networks and components [45]. Adopting a zero-trust architecture (ZTA) is another emerging model in the rail freight industry to ensure strict access and continuous authentication to minimize inside threats and cyberattacks [89]. There has been a significant shift toward predictive strategies where systems are proactive to threats and provide mitigation strategies based on patterns and modern technology [17]. Overall, the future of rail freight transportation should incorporate sustainable practices and advanced technologies while simultaneously adopting relevant cybersecurity measures.

3.7. Current Practices in the Rail Freight Industry

This section explores research question 4 in terms of the extent that current cybersecurity practices mitigate cyberattack risks in rail transportation and research gaps. As a recurring theme, the reviewed studies described the constant evolution of technology as a significant contributing factor to cyber vulnerability in the rail freight industry. For example, Kour et al. (2019) asserted that the increased vulnerability of railroads to cyberattacks stems from the integration of advanced technologies during maintenance processes [57]. Falahati and Shafiee (2022) discussed the use of machine learning algorithms and fuzzy logic systems in detecting and responding to cyberattacks in rail freight transportation [60]. Likewise, Singh et al. (2021) highlighted the implementation of advanced cybersecurity measures in autonomous rail operations to safeguard communication systems and operational data [30]. Thaduri et al. (2019) shed light on the importance of comprehensive training programs as a risk mitigation tool [7].

4. Discussion

The subsections that follow link the original research questions to the themes exposed in the results for a comprehensive understanding of cybersecurity in the rail freight industry.

4.1. Assessment of Rail Freight Mitigation Strategies

Numerous studies argued that due to the constant evolution of technology within the railway industry, a continuous and adaptive cyber mitigation strategy is essential. This suggests the need to cross-integrate some cyber assessment strategies from other sectors to tackle the issue within the railway industry. Stakeholders within the railway industry must explore benchmark practices within adjacent industries such as aviation and connected vehicles using vehicle-to-anything communications and adapt their strategies. This adoption becomes especially crucial with a greater reliance on automation, control, and communications technology to improve safety and security. Using a robust quantitative approach such as predictive models for multi-stage cyberattack simulation can be effective [76]. Another key strategy is cybersecurity awareness and training. Railroads can cultivate a cyber hygiene culture [32], especially where employees maintain the security and integrity of digital systems and data [90]. This practice has been in the healthcare sector and other areas, and it has been beneficial in safeguarding sensitive electronic information [91,92]. Additionally, stakeholders within the railway sector should leverage technologies such as blockchains to enhance the security and integrity of their transactions [93].

4.2. Technological Adaptation in the Rail Industry

It is evident that technological evolution is crucial in streamlining processes in the rail industry. These technological solutions will require continuous human improvement and education, organizational measures and methodologies, and improved digitalization with advanced networks. Human improvement should emphasize dynamic, scenario-based programs that replicate real-world issues, promoting a proactive cybersecurity culture within the workforce. The rail freight industry has begun adopting a ZTA to build a reliable system that combats ambiguous security boundaries within a complex network. For instance, Feng et al. (2023) proposed a theoretical use of blockchains and the Merkle tree [89]. ZTA has demonstrated its effectiveness in implementing stringent authentication measures and restricting unauthorized access to a network by continuously verifying access requests. However, the practical implementation of this approach may result in significant challenges, including regulatory compliance, human factors, inherent security concerns, and interoperability. To effectively implement ZTA, the industry must develop targeted strategies to minimize potential risks. There will be a need for constant skills development, hands-on training, and real-life experiences through optimal training delivery methods. This research highlights the need to expand the use of the ZTA to more effectively align with predictive models, including AI-based real-time threat assessment and blockchain-supported decentralized data exchange. These improvements would bolster the resilience of rail systems, especially in tackling emerging threats within interconnected networks.

4.3. Mitigating Cybersecurity Gaps in Rail Freight

This section highlights plausible recommendations to fill strategic gaps within the rail freight industry regarding cybersecurity. A permanent solution in cybersecurity is impossible because threats continuously evolve. Hence, implementing fewer targeted strategies to enhance cybersecurity measures may improve efficiencies. In addressing the issue of human errors, the deployment of autonomous trains could be a significant step in improving safety in the rail industry [30]. However, this also comes with a significant risk as autonomous systems possess different vulnerabilities within the rail network due to their interconnectedness for real-time information access. This may require advanced encrypted techniques to mitigate potential threats. Combining advanced technological strategies and taking a proactive organizational approach can significantly enhance the industry’s resilience against cyber threats.

4.4. Enhancing Cybersecurity Resilience in Rail Freight

Existing works on cybersecurity in the rail freight industry have focused on balancing operating efficiency and incorporating advanced technology. This review highlights the significance of maintaining a robust security framework to accommodate technological changes that avoid operation disruptions [29,35,60,83]. The theoretical work of Thron et al. (2024) highlighted the balance between human factors and cybersecurity risks [36]. The study highlighted that many industries, including the aviation sector, also face similar challenges in balancing automation and human error [94]. In particular, ongoing human resource training and development initiatives are necessary to reduce human error, which is a severe cybersecurity vulnerability. Furthermore, utilizing advanced technology for threat detection and response, such as machine learning and artificial intelligence, can aid in addressing changing cybersecurity issues [60]. Current research indicates that collaboration and information sharing among stakeholders significantly improves cybersecurity in the rail industry [93]. International cooperation and public-private partnerships can enhance the exchange of threat intelligence and best practices.

While soft strategies like human training may provide a more economical approach, their potential for scalability and long-term effectiveness has yet to be evaluated. On the other hand, hard strategies, such as firewalls and anomaly detection systems, tackle technical risks but do not provide solutions for mitigating human-centric threats like phishing. The railroad industry needs to learn from related sectors that emphasize the use of predictive analytics. For optimal effectiveness, blockchain-enabled decentralized data sharing should support these frameworks to improve resilience across interconnected networks while responding to ongoing technological advancements.

Recommendations for Policymakers

Improving cybersecurity measures in the railroad sector demands specific approaches that involve all parties, including policymakers and industry practitioners. They are essential in developing the regulatory framework and securing the funding to tackle various issues, such as cyber threats. As a result, governance must implement compulsory cybersecurity regulations while ensuring that current policies are adhered to. Frameworks such as ISO 27001 or NIST should be adopted in countries with a limited understanding of railroad cybersecurity. This will help maintain consistency among operators and ensure adherence to international best practices [18,49]. As mentioned earlier, incorporating Zero Trust Architecture (ZTA) [60,89] is essential for improving overall authentication and access management while reducing the likelihood of security breaches.

Public-private partnership between rail operators, cybersecurity firms, and academicians can foster innovation. The Shift2Rail initiative [14,40] serves as a successful example of how collaboration can effectively tackle cybersecurity issues in the railway sector, demonstrating its ability to address vulnerabilities within rail systems. In order for all the proposed strategies to be successful, policymakers must also budget for innovation in this area. Innovative technologies like AI-driven predictive analytics [76] and blockchain data structures [45] have demonstrated effectiveness in tackling cybersecurity issues, so it is essential to allocate specific funds for their implementation.

The authors accounted for both scalability and collaboration to guarantee the effective execution of these recommendations. The strategies proposed in this study are flexible for rail operators of different sizes and they are also combinable with other models to tackle the challenge of interoperability. Given that the railroad industry consists of interconnected systems, many of the proposed strategies and recommendations are relevant for achieving unified global standards and minimizing regional disparities.

5. Conclusions

This work summarized the research on cybersecurity practices in the rail freight industry by focusing on the growing literature published in peer-reviewed journals and conference papers. To focus the review, the authors posed four research questions within the following categories: (1) challenges, (2) measures, (3) emerging trends, and (4) cybersecurity practices. The study collated findings from 70 relevant peer-reviewed articles and conference papers. In addressing the first research question, the study highlighted that technological evolution and human error significantly impact cybersecurity practices. Technological evolution in the rail freight industry revolves around the increasing utilization of advanced digital systems to improve operational efficiency and safety. On the other hand, the literature attributes human error to insufficient training, a lack of situational awareness, and the complexities of managing recent technologies.

The review identified common threats such as anomaly detection, phishing, software vulnerabilities, malware, and denial-of-service categorized into operational, technical, and interconnectedness vulnerabilities. The second research question focused on measures implemented to enhance cybersecurity, differentiating between hard strategies, which involve physical infrastructure changes, and soft strategies focusing on operational and training adjustments. The third research question addressed emerging trends, including automation, zero-trust architecture, blockchain, and machine learning, highlighting concerns over system vulnerabilities due to technological advancements. The research emphasized current cybersecurity practices and their effectiveness in risk reduction.

The authors identified obstacles and recommendations for future research, including the need for standardized cybersecurity protocols, investment in human resources, and stakeholder collaboration for sharing best practices and threat intelligence. Despite these strategies, uncertainty remains about whether specific strategies will effectively address ongoing cybersecurity challenges in the rail freight industry and how to best coordinate these strategies with technological functions.

Despite these developments, research must fill substantial gaps. For example, there is a need for additional investigation into integrating cybersecurity measures with existing operational technology and information technology systems while maintaining seamless functionality. Additionally, establishing a unified defense mechanism necessitates the development of standardized cybersecurity protocols specifically designed to meet the unique requirements of the rail industry.

This study also emphasized the importance of taking a proactive and unified approach to cybersecurity in the railroad sector, highlighting the need to address technical and human-related vulnerabilities. The swift development of technology and changing industry trends present substantial opportunities and challenges for cybersecurity within the rail freight industry. This research highlights various potential areas for future investigation that aim to fill existing gaps in the literature and prepare for anticipated emerging threats. Future research should aim to create adaptable frameworks that blend AI-powered predictive tools, which are gradually becoming the foundation of cybersecurity mitigation strategies across industries, with established cybersecurity standards, especially in regions often underrepresented. Policymakers and industry stakeholders should make these initiatives a priority to protect global rail systems from emerging cyber threats, ensuring the safety of critical supply chains, and promoting sustainable development around the world.