Incident response for rail cybersecurity