In our 2024 paper, The Challenge of Obsolescence in UK Critical Infrastructure, we highlighted an area of growing concern; the intersection of cybersecurity and obsolescence.

The UK’s National Cyber Security Centre (NCSC) wrote that 2023 has seen the addition of state-aligned actors to the ongoing threat from state actors, as a new and emerging cyber threat to Critical National Infrastructure (CNI). While the cyber activity of these groups often focuses on DDoS attacks, website defacements and/or the spread of misinformation, some have stated a desire to achieve a more disruptive and destructive impact against western CNI, including in the UK.  In fact, the UK is the third most targeted country in the world for cyber attacks

The convergence of outdated infrastructure and the rapidly evolving cyber threat landscape presents significant challenges for the UK's CNI. Recent reports and legislative initiatives highlight the urgent need to modernise these legacy systems and implement comprehensive cybersecurity measures to protect against current and future threats.

But what exactly are the risks? Are lives at stake? And how can cybersecurity be better managed in ageing software systems?

Zircon’s panel of experts explores the key risks associated with cybersecurity and obsolescence in this article, with key insights from our Principal Software Engineer, Matt Endicott – joined by Mark Parsons from our Board of Directors, and Nadia Hutchings, our Marketing Manager.

Obsolescence is an inevitable byproduct of long-term infrastructure and technology investments.

Systems like railway signalling, ticketing platforms, electronic road signage, and industrial control mechanisms were all designed to last decades – mostly without considering modern cybersecurity threats. This is understandable; the shapeshifting technological landscape means that, while educated predictions can be made, future threats can’t be known in advance.

As, these systems age, they are less likely to receive updates or patches, leaving them exposed to vulnerabilities.

Historically, critical systems were built to operate autonomously and disconnected from wider networks. While this limited external attacks, modern demands for connectivity have introduced new risks.  Key examples being the 2015 Jeep hack, 2016’s Mirai Botnet, 2021’s Verkada Hack and of course the now infamous Stuxnet (an event we cover below).

Mark introduces the risks with interconnected systems that have known (or unknown) vulnerabilities – and why they might be exploited;

As for motives? Mark adds;

In sectors like energy, defence, road, and rail, connectivity introduces serious cybersecurity vulnerabilities. But exactly how big are the risks?

The risks associated with outdated systems can impact safety. But the risk to life is actually quite low.

As Nadia explains;

The key risks are financial and operational. Disruption is usually the key goal of cyber attacks, along with ransom – but state-sponsored actors are also a threat.

1. Operational disruption

Hackers targeting critical infrastructure can cause significant delays and inefficiencies. For example, disabling ticketing systems or luggage tracking at an airport can lead to cascading disruptions across the entire network.

As an example, in September 2024, a major cyber attack targeted 20 railway stations across the United Kingdom – disrupting services and highlighting vulnerabilities within the transport network's digital systems.

This came shortly after a separate attack on TfL, which exposed sensitive consumer data and prompted a wave of attacks in its wake. The incident is ongoing.

2. Ransomware attacks

As famously seen with the NHS cyber attack, an event that cost the NHS approximately £92m, ransomware exploits outdated systems to encrypt critical files, demanding payment to restore access.

3. State-sponsored attacks

Countries may target critical infrastructure in “enemy states”, not for financial gain, but to cause embarrassment, disruption, or chaos. These attacks can provide a political or tactical advantage, be used as a show of strength – or a demonstration of opponents’ weaknesses.

Matt adds;

Stuxnet was a sophisticated digital weapon, and one of the most prominent cyberwarfare moments in history. It is known to have attacked several nuclear weapons programmes, with varying levels of success –  as well as telecoms systems. Stuxnet highlighted to the world that CNI  networks we all depend on are more vulnerable than we like to think, and arguably could be said to have provided the catalyst for the approaches we have developed to secure these critical infrastructures today.

Critical systems are designed to fail safely. They tend to be highly isolated from wider networks, to mitigate risk – and have layered subsystems that prevent catastrophic failure.

While some disruptions can pose indirect safety risks, attacks that target critical safety systems – like the railway’s interlocking system – would require an “inside job” of considerable effort to pull off. And such an effort wouldn’t go unnoticed.

That said, any successful attack would be highly localised, and human intervention at the point of failure would provide an additional layer of security.

Mark adds that to sabotage a safe system would require intricate knowledge of how it works and how it's configured – as well as direct access to it;

Cyberattacks on railway systems have increased by 220% in the last five years, with incidents increasing worldwide over the last decade.

Attacks on road infrastructure are rarer – but as Mark explains;

Again, human intervention will add another layer to reduce the risk.

In the industrial sector, the UK government’s Cyber security breaches survey 2024 reveals that;

“Half of businesses (50%) and around a third of charities (32%) report having experienced some form of cyber security breach or attack in the last 12 months.”

“This is much higher for medium businesses (70%), large businesses (74%) and high-income charities with £500,000 or more in annual income (66%).”

Attacks are increasing across the board. So – why can’t we just update these systems?

Updating ageing systems is easier said than done.

Many were not designed with regular updates in mind, and the environments they operate in – like railways or nuclear power stations – pose significant logistical challenges.

Matt says that because of these challenges, many systems have simply been ignored;

These overlooked systems now represent a massive risk, as they weren’t designed to handle today’s demands for connectivity.

That being said, some systems are not connected to broader networks at all, making remote updates impossible. These require engineers on-site, to manually install updates – but even this may not be possible due to ageing hardware, unsupported software, and everything else that can arise with legacy systems.

Shutting down infrastructure for updates is also hugely disruptive to operations, and can potentially cost millions. UK railways, for example, have to carefully coordinate any operational downtime to reduce disruption. Highways face a similar issue, although to a lesser extent.

How can industries rise to these challenges – and make sure that critical infrastructure is kept as secure as possible?

The solution combines proactive testing, robust system design, and continuous monitoring.

1. Developing rigorous testing environments

In software development, testing often gets left to the last minute. Project deadlines overrun, and testing is often what suffers.

Mark says;

For critical systems, it’s absolutely vital to begin testing alongside system development.

This can be achieved by creating test environments; simulated systems where code can be validated against a variety of scenarios, including cyber threats.

An example of where testing failed was the CrowdStrike outage of July 2024, which caused approximately 8.5 million Microsoft Windows operating systems to crash worldwide, leading to global disruption of critical services.

As Mark notes;

Failure to test adequately is what led to the “largest outage in the history of information technology”. This could have been avoided with a more diligent and rigorous testing procedure, and a robust testing environment running in parallel.

2. Implementing Continuous Integration and Deployment (CI/CD)

CI/CD allows systems to be continuously updated and tested in smaller increments, reducing the risks associated with larger, more infrequent updates. Automated pipelines can identify vulnerabilities as they arise, for faster resolutions without significant downtime.

Matt explains the advantages of CI/CD;

In CI/CD, software developers build the right unit, integration and system tests to run automatically as soon as code is pushed to repositories. After these automated tests, the system creates releases automatically.

This is far more rigorous than human testing could ever be, and far more efficient. It does take more time to develop initially, with a greater effort required at the start – but after the initial investment, updates are swift, precise, and reliable. As Matt puts it;

Organisations should invest up front, building that environment once, so that they can continuously update without the traditional risks of downtime and disruption.

As systems approach obsolescence, or evolve into modern technologies, this cycle of continuous integration and deployment can help alleviate backlog – as new items can be bolted on to testing scripts.

3. Retrofitting legacy systems

Even older systems can benefit from modern testing and update mechanisms. Retrofitting may include:

• Adding automated testing environments to legacy software systems
• Introducing network connectivity for remote updates
• Updating documentation to ensure current functionality aligns with system specifications

Documentation is often a big stumbling block with obsolescence management, and sometimes the lack of good documentation requires software to be reverse-engineered, so that it can be properly documented and understood.

Nadia reflects on some past retrofitting challenges;

Retrofitting, in both hardware and software, needs to be carefully managed, to close any security loopholes that might lead to breaches. Documentation can help this process greatly.

4. Addressing technical debt

Organisations that prioritise ongoing maintenance of software and hardware systems are less likely to fall into "technical debt". This is where neglected systems become costlier to repair or replace over time, because of a buildup of issues.

In the first instance, tackling technical debt can be intensive and costly – but the benefits include increased resilience to cyber threats, as well as smoother operations.

5. Continued best practice in cybersecurity

Organisations should implement cybersecurity measures across all systems, including regular vulnerability assessments, multi-layered security protocols, and employee training to recognise and mitigate cyber threats.

Cyber attacks are all too often a human and social engineering issue as much as they are a software engineering one, so training should always be up to date.

The UK government offers several resources on standards.

There’s guidance freely available from the National Cyber Security Centre (NCSC), the UK’s cybersecurity authority. The NCSC developed the Cyber Assessment Framework (CAF) for operators of essential services – which is the best place to start.

There’s also GovS 007 – a cybersecurity standard that sets out expectations and reasons for the security activities which organisations need to carry out, to protect government assets specifically.

While initial investments in automated testing, CI/CD pipelines, or system retrofits may seem costly, the long-term savings and risk reduction far outweigh these expenses.

Mark highlights the cost-benefit dynamic;

Matt says;

Cybersecurity and obsolescence present a significant challenge. But it’s not insurmountable.

By addressing the issues facing infrastructure and industry now, we can collectively ensure smoother operations, reduced risks, and greater resilience – in an increasingly connected world.

With our 25 years of expertise in Software and Systems engineering, one area we have come to specialise in is the analysis, update and securing of ageing infrastructure systems.

Our obsolescence management solutions include a thorough system analysis, to identify vulnerabilities and recommend solutions – giving our partners better documentation and an actionable plan.

From there, we oversee the implementation of CI/CD pipelines for continuous updates, and the retrofitting of legacy systems with modern integrations.

And we provide ongoing support, to ensure systems remain secure and compliant.

If you’re interested in learning more, get in touch – call 01225 764 444, or send your message to enquiries@zirconsoftware.co.uk.