Municipality of Arnhem strengthens OT traffic system security with DEFION

Challenge

The Municipality of Arnhem manages an extensive network of around one hundred traffic control installations, parking guidance systems, and dynamic information displays. While these systems used to operate as stand-alone units, they are now connected to national platforms and smart applications such as navigation apps. They can also be operated remotely, and malfunctions can be resolved from a distance.

These advancements offer many benefits, but they also increase the risk of unauthorized access and privacy issues — risks that are subject to strict requirements from the Dutch Data Protection Authority.

The management of the data network for traffic lights and traffic management systems is outsourced to network specialist ConTraSys. To gain insight into the digital resilience of its traffic light network and minimize security risks, the municipality needed an independent, thorough security assessment.

Solution

The Municipality of Arnhem engaged DEFION to perform a comprehensive security test of the traffic light network. Together, a plan was developed to assess the network from multiple perspectives: through remote penetration testing as well as on-site testing at traffic control installations.

DEFION examined whether suppliers with access rights could exceed their intended privileges, tested firewall configurations, reviewed web applications, and assessed what could be done if someone gained physical access to the traffic light control cabinet.

This in-depth approach resulted in valuable findings, such as updating outdated configurations and tightening access permissions. With DEFION's support, Arnhem now has complete insight into the security of its traffic network — along with a clear plan to continuously improve that security in a structured way.