Trust the Command, Not Just the Connection

Intelligent Transportation Systems control physical roadway behavior through networked field devices such as actuated signal controllers, dynamic message signs and roadside units. For the signal-controller and dynamic message sign standards examined, the deployed command path has historically relied on SNMP versions 1 and 2c, which use shared community strings and lack the cryptographic authentication, integrity protection and replay resistance of SNMPv3. A large installed base of field devices can therefore act on commands based largely on network reachability and possession of a shared community string, rather than on verifiable command origin and integrity.

The paper notes that this is not only an outside critique. The NTCIP standards bodies published an assessment in 2021 concluding that the standards did not adequately address security, and nearly five years later the SNMPv3 revision for signal controllers has not appeared on the published-standards register. It reviews the public record of documented incidents and vulnerabilities across multiple vendors, from 2014 through a recent CISA advisory, and argues that the case is sharpest during incidents and emergencies, when signal timing and sign messaging are instruments of driver direction.

The author concludes that agencies need monitoring and management applied to the command itself, inline and at the wire, rather than to the connection alone. The paper describes an inline, agentless enforcement approach implemented by PacketViper and states its limits: it is a compensating control, not a substitute for patching, segmentation, credential hygiene or standards migration, and it does not address physical access to a cabinet. It frames command-path integrity as a reliability and public-safety requirement for ITS operations, not solely a cybersecurity control.