Cybersecurity threats to railways are increasing, both due to improvements in the techniques of hackers and the increasing merger of cyber and physical spheres. Accepted approaches to safety can be extended to consider the risks from cyber, however the nature of railways as complex cyber-physical systems of systems may require a broader approach beyond functional safety. This paper explores some of the cybersecurity hazards using a war gaming approach. The authors find that, while standard engineering approaches are effective in building new rail control system components, a broader and more creative consideration of attacks has benefits. In particular they identify the ability to cause mass disruption by targeting the fail-safes designed to ensure safety or auxiliary systems that are not directly classified within the scope of the ICS.