Pirate attacks against merchant ships off the African coast have been reported regularly over the past decade. And despite measures to suppress it, Somalia-based piracy remains a concern. On the other side of the continent, the Gulf of Guinea is now viewed as presenting a much more serious piracy problem.

Last year a record 130 crew members were kidnapped in 22 separate incidents, according to the International Maritime Bureau. The cluster of attacks in November and December has once again led to alarming headlines about the Gulf of Guinea being the world’s piracy hotspot.

But an increase in officially reported attacks does not necessarily mean that the actual number of attacks has increased. And individual cases must be analyzed carefully. Attacks against small cargo ships trading solely in the Gulf of Guinea, for example, are often linked to criminal disputes or other illicit activities at sea. These incidents are very different from random attacks targeting merchant ships in international trade which are solely aimed at kidnapping seafarers to collect a large ransom and are, therefore, a profit-driven crime.

Similarly, reports about suspicious approaches against merchant ships off Somalia are still frequent. Most are related to smuggling operations between the Horn of Africa and the Arabian peninsula or simply to everyday fishing activities.

Pirate attacks may grab most headlines, but maritime security is important for wider reasons. Illicit activities at sea limit the potential benefits of economic activities linked to the sea – what’s referred to as the “blue economy”. This includes maritime trade, fishing activities, offshore oil and gas production or coastal tourism. Also, criminality at sea and on land are closely linked. Government agencies need to recognize this if security is to be improved.

Many problems, few resources
Piracy remains arguably the most visible symptom of insecurity at sea. But coastal states also have other reasons to be concerned about it.

Illegal fishing, for example, has a direct impact on coastal communities where artisanal fishing is one of the few opportunities to earn a living. Smuggling on maritime routes even affects government income directly. Virtually all African countries rely heavily on customs revenues. When fuel, cigarettes or agricultural goods are smuggled, no import or export duties are paid. Less money can then be spent on schools, roads or hospitals, as my research has shown.

Governments are also concerned about drug trafficking or weapons smuggling at sea, underlined by international agreements which have been adopted by the majority of African coastal states.

Limited monitoring of maritime trade allows for a steady flow of pharmaceutical products – including fake drugs – into Africa as well as lucrative exports of unlicensed timber or illegal wildlife products.

Despite the widespread impacts, maritime security has only come into the political focus over the past decade. African countries have initiated international meetings about it. The African Union adopted a maritime strategy in 2014 and held a follow-up summit in Togo’s capital Lomé in 2016. But progress has been limited. National governments have largely failed to take concrete actions. Strategies aren’t supported by financial and human resources.

Even Ghana, where a comprehensive maritime strategy has been under development for years, is still unable to provide reliable funding for patrol boat operations.

The way forward
Some examples highlight that it is possible to provide more security at sea. In West Africa, Nigeria is leading the way with its $195 million Deep Blue project, scheduled to be fully operational in the coming months. This project is primarily aimed at better surveillance and enforcement across the country’s Exclusive Economic Zone, an area that stretches out up to 200 nautical miles (around 360 kilometers) from the coastline.

Benin, Gabon and Tanzania have partnered with environmental organizations like Sea Shepherd to combat illegal fishing in their waters. Such non-traditional partnerships may help overcome short-term challenges and focus on urgent problems.

But it’s necessary to build capacity for the long term.

In many African countries, the blue economy could help to increase economic growth and development, although it should not be limited to economic gains. Acknowledging the needs of local communities and environmental sustainability are equally important. Investments can yield direct benefits which are five times higher than the initial outlay, according to a recent study. And the inclusion of Sustainable Development Goal 14 on ocean resources could strengthen efforts to recover from the economic impacts of COVID-19.

Despite some alarming headlines, there is no evidence to suggest that the coronavirus pandemic has had an immediate impact on security threats at sea. But growth forecasts have been slashed and governments are unlikely to prioritize spending on navies and other maritime agencies.

Security concerns on land are much more immediate threats, and even relatively limited stimulus packages are another burden for government budgets.

A closer analysis of sea piracy is important for law enforcement and longer-term prevention whether these are solely aimed at pirates or at organized criminal groups. It is also important for shipping companies because it affects the threat assessment when attacks are linked to criminal activities and aimed at specific ships rather than random targets.

Short-term solutions for long-standing problems are impossible. Even small steps, however, are important to improve maritime security in the medium to long term. That would be in line with the AU’s maritime strategy which highlights the blue economy’s potential contribution to economic growth and development across the continent.

 

Source: marinelink


With more containerships arriving daily, the backlog at the Southern California ports has grown to record levels. For the first time in seventeen years, ships are being held in drift positions outside the anchorage in San Pedro Bay with predictions that the congestion will continue at these levels at least until mid-to-late February.

The Marine Exchange of Southern California, a ninety-plus-year-old, non-profit organization that oversees the flow of maritime commerce throughout the region, reported on Wednesday, January 27, that the San Pedro Bay port complex had set a new record with 55 ships at anchor. That topped the previous high by three vessels, but the record would only last for hours. Five additional ships entered the anchorage on January 28, raising the record to 60 vessels.

 

Source: maritime-executive


We are moving more and more towards a digital future. Valuable data is now stored in the cloud, your employee’s workstations connected and administered through Active Directory, guests coming into your office can connect to a free Wi-Fi, maybe you even have a smart coffee machine connected to your network. While those changes open new possibilities to be flexible and agile, with them a new need for security is arising.

Cyber security is a broad spectrum and all the possibilities might lead to confusion for you. For an easier understanding it is helpful to divide it into defensive and offensive Security. Defensive Security includes your Anti-Virus Program, your internal Security Guidelines, maybe even an internal Team within your company dedicated to protecting your data and employees. Having this in place is important but does not cover the full spectrum of what is needed to secure yourself and your company.

Atos’ Nordic Cyber Defense Center is a team of Ethical Hackers that use their skill and experience to protect, attack and solve. Our core skills as cyber security Professionals allow us to act in different roles and perform different tasks, providing the mindset of an attacker.

“We cannot solve our problems with the same thinking we used when we created them.” – Albert Einstein

This is where offensive Security comes in, here in particular, Attack Simulations, also widely known as Penetration Test. Offensive Security focuses on attacking a network to discover its vulnerable points. Such a test includes a team of Hackers attacking your company or solution, finding strategies to gain access to critical infrastructure. This is not only limited to digital solutions but can include your staff through Phishing Attack Simulations or your Physical Security through a Red Team Exercise or a custom-made test focusing on breaking into your building.

Throughout all the different Penetration Testing variations we deliver; we strive for technical excellence and staying as close as possible to the actual scenario of a malicious attack. This ensures that we will find and deliver the best mitigation techniques for every potential attack vector. In this process, we only use automated tools to a certain extent – as an actual Hacker trying to compromise your system would not stop if an automated scan does not find a way in, so we do not stop there either. Rather than simply focusing on finding vulnerabilities, we are searching for strategies to compromise any given target.

SHIP IP LTD – Remote internal/external Vulnerability & Penetration Testing

TRUST OUR NETWORK – WE GUARANTEE BEST PRICES!

READ MORE

http://shipip.com/maritime-vulnerability-and-penetration-testing/


With the permission and under the supervision of system manufacturers and owners, Naval Dome’s cyber engineering team hacked into live, in-operation systems used to control a ships’ navigation, radar, engines, pumps and machinery.

While the test ships and their systems were not in any danger, Naval Dome was able to shift the vessel’s reported position and mislead the radar display. Another attack resulted in machinery being disabled, signals to fuel and ballast pumps being over-ridden and steering gear controls manipulated.

Commenting on the first wave of penetration tests, on the ship’s Electronic Chart Display and Information System (ECDIS), Asaf Shefi, Naval Dome’s CTO, the former Head of the Israeli Naval C4I and Cyber Defense Unit, said: “We succeed in penetrating the system simply by sending an email to the Captain’s computer.

“We designed the attack to alter the vessel’s position at a critical point during an intended voyage – during night-time passage through a narrow canal. During the attack, the system’s display looked normal, but it was deceiving the Officer of the Watch. The actual situation was completely different to the one on screen. If the vessel had been operational, it would have almost certainly run aground.”

According to Shefi, the Naval Dome hack was able to alter draught/water depth details in line with the spurious position data displayed on screen.

“The vessel’s crucial parameters – position, heading, depth and speed – were manipulated in a way that the navigation picture made sense and did not arouse suspicion,” he said. “This type of attack can easily penetrate the antivirus and firewalls typically used in the maritime sector.”

Commenting on the ease with which Naval Dome was able to by-pass existing cyber security measures, Shefi explained: “The Captain’s computer is regularly connected to the internet through a satellite link, which is used for chart updates and for general logistic updates. Our attacking file was transferred to the ECDIS in the first chart update. The penetration route was not too complicated: the attacking file identified the Disk-On-Key use for update and installed itself. So once the officer had updated the ECDIS, our attack file immediately installed itself on to the system.”

In a second attack, the test ship’s radar was hit. While the radar is widely considered an impregnable, standalone system, Naval Dome’s team used the local Ethernet Switch Interface – which connects the radar to the ECDIS, Bridge Alert System and Voyage Data Recorder – to hack the system.

“The impact of this controlled attack was quite frightening,” said Shefi. “We succeeded in eliminating radar targets, simply deleting them from the screen. At the same time, the system display showed that the radar was working perfectly, including detection thresholds, which were presented on the radar as perfectly normal.”

A third controlled attack was performed on the Machinery Control System (MCS). In this case, Naval Dome’s team chose to penetrate the system using an infected USB stick placed in an inlet/socket.

“Once we connected to the vessel’s MCS, the virus file ran itself and started to change the functionality of auxiliary systems. The first target was the ballast system and the effects were startling. The display was presented as perfectly normal, while the valves and pumps were disrupted and stopped working. We could have misled all the auxiliary systems controlled by the MCS, including air-conditioning, generators, fuel systems and more.”

Itai Sela, CEO of Israel-headquartered Naval Dome, furthered that the virus infecting ship systems can also be unwittingly transferred by the system manufacturer.

“As manufacturers themselves can be targeted, when they take control of onboard computers to carry out diagnostics or perform software upgrades, they can inadvertently open the gate to a cyber attack and infect other PC-based systems onboard the ship. Our solution can prevent this from happening.”

SHIP IP LTD – Remote internal/external Vulnerability & Penetration Testing

TRUST OUR NETWORK – WE GUARANTEE BEST PRICES!

READ MORE

http://shipip.com/maritime-vulnerability-and-penetration-testing/


The Maritime business is facing huge challenges with managing Cyber Security in their environments. The maritime regulator, International Maritime Organization IMO, has identified these challenges in their efforts to regulate the maritime environment and has updated their regulations and guidelines to include cyber risk management onboard ships mandatory as of 1 January 2021.

Maritime organisations need to assess risks in both traditional information technology(IT) and Operational Technology(OT) environments in order to establish appropriate controls against cyber security incidents. In many cases, IT and OT is managed by different teams without established standards, shared knowledge and minimal collaboration, leaving IT uninformed about the OT technologies on ships and OT uninformed about the cyber threats and risks in traditional IT environments. Deductive Labs has the knowledge and experience that can help bridge the gap between IT and OT, aligning the areas with business goals, operational processes and security requirements.

Deductive Labs provide our customers with professional security services in order to improve their cyber security posture and fulfil current and upcoming requirements and regulations.

We combine our security- and penetration testing methodologies with our 15+ years of security knowledge and experience. Penetration testing methodology based on industry best practices from PTES standard, OWASP Testing Guide. ISO27001, IEC 62443, NIST Cyber Security Framework as information Security frameworks.

SHIP IP LTD – Remote internal/external Vulnerability & Penetration Testing

TRUST OUR NETWORK – WE GUARANTEE BEST PRICES!

READ MORE

http://shipip.com/maritime-vulnerability-and-penetration-testing/

 


 

GTMaritime is now offering a penetration testing service free of charge which allows customers to evaluate the ability of their personnel to identify phishing attacks

Hackers are constantly trying to come up with new ruses to outwit software-based protections. For this reason, crew cannot afford to become complacent in the belief that, with a technological safety net in place, everything reaching their inbox is trustworthy and can be taken at face value.

On the contrary, they must remain vigilant: the few malicious messages that do arrive will more likely resemble an authentic request or employ advanced social-engineering techniques, which make them harder to recognise.

Quality ship operators understand this and take a holistic approach to cyber defence. To supplement the work done by technological tools such as GTMailPlus by GTMaritime, they routinely remind staff to stay alert and offer training on what to look out for.

However, it can be difficult to gauge exactly how well these measures are working or to identify areas that would benefit from improvement. In the same way that cyber criminals are constantly refining their techniques, ship operators too must continually adapt.

Last autumn GTMaritime started offering a penetration testing service free of charge to its shipping company customers. The service involves sending a selection of crafted spoof phishing messages to crew to test for alertness and for response. These realistic but ultimately harmless simulated attacks offer an effective way of gathering quantitative evidence on the alertness of the frontline staff most exposed to hoax emails.

By revealing weaknesses in training provision, the free service allows customers to pinpoint where educational resources can be enhanced or redirected, knowledge gaps plugged and awareness raised.

Test results revealed weaknesses

We recently completed a two-round penetration test for an established shipping company. For the initial test the vessel operator sent to sixteen of its captains a spoof message appearing to come from a Port Authority requesting basic identifying information about the vessel and its owner.

Half correctly identified the message as a phishing attempt and ignored it, but half supplied the information asked for. Of the latter group, in no case was the message escalated to management for advice on how to proceed.

The 50-50 split certainly raised pulses at company headquarters, as the spoof email was written in poor English and emanated from a mysteriously unnamed port authority – both common traits that should ring alarm bells. To determine if the same result would be found if more detailed information was requested a second test was employed.

This time the message that supposedly came from a port authority had a personalised subject line that mentioned the target vessel’s name and IMO number. There is mounting evidence of cyber criminals including references to familiar people or organisations, adding a veneer of authenticity that encourages the targeted recipient to lower their guard. The rogue message then asked for a host of sensitive particulars and security details, which if passed on to pirates could jeopardise the safety of vessel and crew.

The response showed a marked improvement over the first test. Eight recipients immediately detected something was amiss and ignored the request. Encouragingly, three were suspicious enough to seek guidance from head office. Although head office personnel were kept in the dark about the test, they reacted correctly, advising vessels not to send any data and also alerted the IT department.

Even so, five vessels still obligingly followed the instructions in the message without properly considering either the safety or commercial ramifications of sensitive information falling into the wrong hands.

Path to enhanced education and procedures

Following the penetration tests GTMaritime supplied the vessel operator with educational materials for both staff and IT personnel. The operator took an enlightened view to the results, seeing them as an opportunity to learn rather than apportion blame. It later shared the full findings in a company-wide security bulletin in the hope that using real data rather than hypothetical scenarios to present the dangers would drive home the need for vigilance.

SHIP IP LTD – Remote internal/external Vulnerability & Penetration Testing

TRUST OUR NETWORK – WE GUARANTEE BEST PRICES!

READ MORE

http://shipip.com/maritime-vulnerability-and-penetration-testing/

 


As ships get bigger, with more automation, fewer crew members, and more connectivity, the attack surface of a modern commercial vessel is becoming as complex and diverse as that of a connected car or commercial aeroplane.

We have ex-ships officers and engineering staff on the team here, so we have first-hand experience of the unusual networks and communications found on board.

Don’t risk your ships security to a penetration tester that doesn’t understand shipping; we’ve come across other consultancies that have broken critical systems on board whilst trying to test their security, as they simply didn’t understand what they were testing.

What does a ship look like to an attacker?

The complex systems involved in shipping offer rich pickings to the hacker, pirate and thief. Load theft, smuggling stowaways, narcotics, arms, even crippling or sinking a vessel are very real threats.

Maritime insurance often specifically excludes losses as a result of ‘cyber’ incidents, so it’s very important to check your cover.

From satcoms, mobile data and Wi-Fi through to propulsion and loading systems, this is what a hacker sees when they look at a ship. Many of these systems can be comprised, causing financial loss and safety issues.

Tactical Advice
Tens of vendors are involved in connected systems on ships, from Dell providing desktop PCs, to satcoms gear for Internet, chart systems, MMI, control systems, radar systems etc. This is a recipe for security disasters.

Here are a few basic issues you could check for yourself:

Check your satcom terminals for default, weak or blank admin passwords. Make sure the latest software is running on ALL of your terminals.

Check the network isolation and segregation between bridge, engine room, crew, Wi-Fi and business networks.

Check Wi-Fi networks for strong encryption and strong passwords. Make sure that business systems are particularly well protected.

Demand evidence from your technology suppliers that the systems they provide to you are secure. Remember, if you don’t ask for security, you probably won’t get it!

Sit down and think about how you might attack your ships network, given your knowledge of your systems. That’s what the hacker does, so pre-empt them and defend better.

Don’t forget your people. Officers can become fixated on digital navigation systems on the bridge. These can be hacked and manipulated, so don’t forget to look outside.

SHIP IP LTD – Remote internal/external Vulnerability & Penetration Testing

TRUST OUR NETWORK – WE GUARANTEE BEST PRICES!

READ MORE

http://shipip.com/maritime-vulnerability-and-penetration-testing/


  • PSC Planner web application: Available for all customers via VERACITY by DNV GL, overview of ones fleet’s PSC performance, helps to prepare for upcoming PSC inspections with ship specific short checklists
  • Pro-active PSC risk profiling for your fleet – send inquiry
  • One-day interactive PSC workshop or tailor-made trainings via DNV GL Academy
  • Ad-hoc PSC seminars and training courses on request
  • PSC news, additional guidance on technical topics from a PSC inspection view
  • Support for preparation on Concentrated Inspection Campaigns (CIC):
    • Paris MOU and Tokyo MOU will carry out a joint CIC from August – September 2019 on “Emergency Systems and Procedures”
    • This CIC will also be joined by Black Sea MoU, Med MoU, Indian MoU, Riyadh MoU and Vina del Mar MoU
    • DNV GL will offer detailed information about the topic during a smart-up session annual in August – next webinar will be in August 2020 for the CIC in 2020
    • Recordings of previous CIC smart-up can be found below under Videos and Downloads
    • Further guidance on actual and previous CICs can be found under PSC news

Carbon reduction is a key strategic objective for our company and follows our mission of connecting the world today, creating a sustainable tomorrow,” said Oeyvind Lindeman, Chief Commercial Officer at Navigator. “We continuously strive to reduce our carbon emissions through innovations in the way we manage our company and in the way we operate our assets. Offsetting is one of several tools we choose to use in order to deliver a true carbon-neutral voyage. We are looking at ways to further promote and develop similar voyages in collaboration with our stakeholders whilst always keeping the UN’s Sustainable Development Goals in mind.”

In addition to industry-led technological and regulatory developments in reducing its carbon footprint, Navigator Gas looks forward to further harnessing the potential of similar projects in the future to provide carbon offsetting to its customers in an effort to abate the current carbon emissions associated with day-to-day shipping activities, whilst future solutions are developed and deployed.

“Navigator is taking the lead in applying new solutions to address the existing carbon footprint associated with seagoing vessels. Their effort marks a landmark change in the global maritime sector by moving from words to tangible action, and we believe many more will follow their example. At CHOOOSE, we are proud to be participating in this global change led by Navigator by building technology that makes the global maritime sector a part of the solution,” said Andreas Slettvoll, CEO and co-founder at CHOOOSE.

Navigator Holdings Ltd. is the owner and operator of the world’s largest fleet of Handysize liquefied gas carriers and a global leader in the seaborne transportation of petrochemical gases, such as ethylene and ethane, liquefied petroleum gas (“LPG”) and ammonia. We play a vital role in the liquefied gas supply chain for energy companies, industrial consumers and commodity traders, with our sophisticated vessels providing a safe, efficient and reliable ‘floating pipeline’ between the parties. Please visit www.navigatorgas.com for more information.

 

Source: prnewswire


Please use the sharing tools found via the share button at the top or side of articles. Copying articles to share with others is a breach of FT.com T&Cs and Copyright Policy. Email licensing@ft.com to buy additional rights. Subscribers may share up to 10 or 20 articles per month using the gift article service. More information can be found here.
https://www.ft.com/content/20b9430e-9058-4d7f-b953-d5d178def3c5

Fines imposed under the General Data Protection Regulation have increased by almost a half over the past year as European authorities flexed their regulatory muscles despite disruption caused by the pandemic. A total of €272m has been levied in fines by European data protection authorities since the introduction of the GDPR in 2018. Over half of those penalties were imposed by Italy and Germany. According to research by DLA Piper, €159m of those fines were imposed in the past 12 months, an increase of nearly 40 per cent on the first 20-month period after GDPR came into force.

 

Source: ft


Company DETAILS

SHIP IP LTD
VAT:BG 202572176
Rakovski STR.145
Sofia,
Bulgaria
Phone ( +359) 24929284
E-mail: sales(at)shipip.com

ISO 9001:2015 CERTIFIED