OT Security in Indian Transport and Logistics: Railways, Ports, and Sagarmala

Indian Railways moves 24 million passengers and 3 million tonnes of freight daily on an OT infrastructure that is simultaneously being modernised and increasingly targeted by cyber actors. The Indian Railways network - 68,000 route kilometres, 7,335 stations, and one of the world's largest employer organisations - runs on operational technology spanning signalling systems, Train Control Management Systems (TCMS), interlocking, traction power supply, and operations management. A successful OT attack on a critical railway OT system does not just disrupt schedules; it creates life-safety risks for passengers and freight. CERT-In issued its first railway sector cybersecurity advisory in 2023, reflecting growing recognition of the threat. (Indian Railways, 2025)

India's port and logistics infrastructure faces parallel OT security challenges. Sagarmala Programme investments in port modernisation, terminal automation, and logistics connectivity are creating OT environments - automated cranes, vessel traffic systems, port SCADA, and logistics tracking - that are increasingly connected and insufficiently secured. The nine major ports under the Ministry of Ports, Shipping and Waterways handle over 700 million metric tonnes of cargo annually, making port OT disruption economically significant at a national scale. (Ministry of Ports, 2025)

Key Takeaways

• Indian Railways OT spans signalling, TCMS, interlocking, and traction power - all life-safety critical systems.
• Sagarmala Programme port modernisation is creating automated, connected port OT without consistent security standards.
• The 2022 Indian Railways data breach illustrated that railway IT/OT boundary security needs urgent attention.
• Metro rail systems in 18+ Indian cities operate independent OT environments with varying security maturity.
• NCIIPC designates transport as critical infrastructure; sector-specific OT security requirements are developing.

OT threat landscape India 2026

What Makes Indian Railways OT Security Uniquely Complex?

Indian Railways' OT environment is uniquely complex for three reasons. Scale: a network spanning the entire subcontinent, with systems from multiple technology generations operating simultaneously. Criticality: signalling and interlocking systems are directly responsible for preventing train collisions - a compromised interlocking is a safety emergency, not just an IT incident. Modernisation velocity: Kavach (Train Collision Avoidance System), automatic train protection, and communication-based train control (CBTC) on metro lines are being deployed rapidly, creating new OT environments before security frameworks for old systems have been fully implemented.

Kavach, India's indigenous ATP system being deployed across the Indian Railways network, uses radio communication between trains and trackside transponders to provide collision avoidance. The cybersecurity of Kavach's communication protocols and control systems is a national safety issue: if Kavach can be manipulated to disable collision warnings or inject false track occupation signals, the safety system becomes the attack vector. Railway Research Design and Standards Organisation (RDSO) cybersecurity standards for Kavach and other signalling systems are critical national infrastructure requirements. (RDSO, 2025)

[CHART: Indian Railways OT stack - signalling, TCMS, traction, operations - and security zones - Source: Opsio]

How Is Port OT Being Modernised Under Sagarmala?

Sagarmala Programme's port modernisation investments include terminal automation (automated cranes, straddle carriers, AGVs), Vessel Traffic Management Systems (VTMS), port community systems integrating customs and logistics, and cargo tracking systems. Each of these introduces OT or OT-adjacent systems that control physical infrastructure. Automated cranes at JNPT (Jawaharlal Nehru Port Trust) and Mundra use PLC-controlled systems that, if compromised, can create physical safety risks. VTMS at major ports guides vessel movements in restricted channels where a false navigational instruction could cause a grounding or collision. (Sagarmala, 2025)

Indian port OT security is complicated by the multi-operator environment of most major ports. JNPT hosts multiple terminal operators (APM Terminals, DP World, Maersk-APMT Gateway) alongside the port authority itself. Each operator runs independent OT systems that must interoperate at the port community level. Security governance across this multi-stakeholder environment requires formal agreements, shared standards, and coordination mechanisms that most Indian ports are still developing.

Cyber Incidents Affecting Indian Transport

The 2022 data breach at South Western Railway zone of Indian Railways, which exposed data from millions of passenger records, illustrated the inadequacy of IT security at Indian Railways. While that incident was primarily an IT breach, it demonstrated the network access that attackers can achieve in railway systems - network access that, without adequate segmentation, could reach OT systems including operations management and potentially signalling support systems. The 2021 attack on Jawaharlal Nehru Port Trust's IT systems caused significant disruption to port operations for two days, affecting cargo throughput and demonstrating the dependencies between IT and OT in port operations. (CERT-In, 2022)