Trust the Command, Not Just the Connection: Monitoring and Managing the NTCIP Command Path to Traffic Signal Controllers and Dynamic Message Signs

Intelligent Transportation Systems (ITS) govern physical roadway behavior through networked field devices, including actuated signal controllers, dynamic message signs (DMS), and roadside units. For the signal-controller and DMS standards examined here, the deployed command path has historically relied on Simple Network Management Protocol (SNMP) versions 1 and 2c. Those versions use shared community strings and do not provide the cryptographic message authentication, integrity protection, and replay resistance available in SNMPv3.

The result is a large installed base of transportation field devices that can act on commands based largely on network reachability and possession of a shared community string rather than on cryptographically verifiable command origin and integrity. This is not an outside critique: the NTCIP standards bodies published a formal assessment in 2021 concluding that the standards did not adequately address security. Nearly five years later, the SNMPv3 revision for signal controllers has not appeared on the published-standards register, and the base DMS object standard in force remains a 2014 publication that predates the assessment.

This paper examines the structural weakness in the NTCIP command path; reviews the public record of documented incidents and vulnerabilities across multiple vendors, spanning 2014 through a CISA advisory published three weeks before this writing; and argues that the case is sharpest precisely where agencies can least afford it — during incidents and emergencies, when signal timing and sign messaging are instruments of driver direction. We argue that agencies require monitoring and management applied to the command itself, inline and at the wire, rather than to the network connection alone. We then describe an inline, agentless enforcement approach implemented by PacketViper, explicitly state its limits, and conclude that command-path integrity is a reliability and public-safety requirement for ITS operations, not solely a cybersecurity control.