BIMCO : The Guidelines on Cyber Security Onboard Ships

Cyber threats are constantly evolving which requires a regular review of all cyber related processes on board ships to allow for successful protection against cyber attacks. We are pleased to announce that today various maritime industry organisations published a revised third version of the “Guidelines on Cyber Security onboard Ships”. The document provides guidance to shipowners and operators on how to assess their operations and develop procedures to strengthen cyber resilience on board their ships. The Guidelines will continue to be updated regularly to mirror the evolution of cyber security threats and to outline new measures to mitigate against dynamic cyber risks.

Key updates in Version 3.0 include:

the requirement to incorporate cyber risks in the ship’s safety management system (SMS);
more detailed information related to the risk assessments of operational technology (OT);
increased guidance for dealing with the risks in the ship’s supply chain;
cases studies of verified cyber incidents onboard ships to highlight and illustrate potential problems.

Version 3.0 of the Guidelines can be downloaded HERE

BIMCO Version 3.0 of the Guidelines

1 file(s) 2.91 MB

Download

BIMCO aims to publish cyber security clause in spring 2019

Overview

BIMCO is developing a clause dealing with cyber security risks and incidents that might affect the ability of one of the parties to perform their contractual obligations.

The clause is being drafted by a small team led by Inga Froysa of Klaveness, Oslo. Other companies involved include Navig8, the UK P&I Club and HFW, and the project is due to be completed in May 2019.

Planning and protecting is key

The BIMCO cyber security clause requires the parties to have plans and procedures in place to protect its computer systems and data, and to be able to respond quickly and efficiently to a cyber incident.

Mitigating the effect of a cyber security breach is of paramount importance and the clause requires the affected party to notify the other party quickly, so that they can take any necessary counter-measures. The clause is also designed for use in a broad range of contracts. This way, the clause can cover arrangements with third-party service providers, such as brokers and agents.

The liability of the parties to each other for claims is limited to an amount agreed during negotiations. A sum of USD 100,000 will apply if no other amount is inserted.

Two important functions

The clause will fulfill two important functions. The first is to raise awareness of cyber risks among owners, charterers and brokers. The second is to provide a mechanism for ensuring that the parties to the contract have procedures and systems in place, in order to help minimize the risk of an incident occurring in the first place and, if it does occur, to mitigate the effects of such an incident.

In the early stages of development, the drafting team discussed if the clause should also address payment fraud. It was concluded that the risk of this increasingly common fraud is probably best dealt with at a procedural level by companies tightening up their internal payment procedures to require verification of any changes to payment details.

cyber threats against ports.

Brigadier General Gholam Reza Jalali, head of Passive Defence Organisation of Iran, has said more attention needs to be paid to cyber threats against commercial ports and shipping, insisting that this is a real area of concern.

Iran Press / Iran news: According to an Iran Press report, in an exclusive interview on Sunday, Brigadier General Jalali said: “Cyber threats which impact our ports and maritime operations are a critical issue which must be discussed, and we must be payed great attention to this issue.”

He added: “Cyber threats can be divided into three categories. The first one is, the probable extension of sanctions to cover the realm of infrastructure and cyberspace. The other one is, penetration and a cyber-attack on our maritime infrastructures. There have been significant joint efforts which have been carried out by the “Passive defence” and “Port and Maritime” Organisations and with decent structures regarding cyber defense and passive defense, we can jointly strengthen our infrastructure against cyber-threats.”

In further remarks, the head of the Passive Defence Organisation of Iran said: “In fact, to deal with this issue, we devised and prepared five guidelines or instructions, which are:

(1) An Emergency Response Project which is currently being implemented.

(2) Emergency security of Cyber Infrastructures.

(3) Protection of our computer systems and immunizing against a cyber-attack, which means security in the long term.

(4) Information Retrieval when a cyber-attack does take place.

(5) Cyber Preparedness and simulating a cyber-attack.”

SOURCE READ FULL ARTICLE

by Eric Holdeman / November 1, 2018 – READ FULL ARTICLE CLICK HERE

Maritime Industry Not Cyber-Ready

Maritime Industry Not Cyber-Ready, I had the opportunity to observe the maritime industry up close when I was director of security for the Port of Tacoma (almost six years ago). My observation then was that the people who make up the industry have never thought of themselves as technology companies or even being attuned to what technology can do for their businesses. A telling comment came from the deputy director at the port. Apple iPads had recently been fielded (2010) and I suggested purchasing an iPad for each of the port’s elected commissioners. His reply went something like, “Here in the maritime industry we are not oriented on technology, nor progressive in that area.” This from a top 10 port. There are many more small companies that move goods, have trucks, drivers, etc., and really don’t understand their vulnerability. See the article below for survey results of the industry.

Homeland Security Today: Survey Finds U.S. Maritime Industry Unprepared for Cyber Attacks

Rapidly evolving technologies deployed throughout the U.S. maritime industry to increase efficiency and competitiveness present significant cybersecurity risks that the industry is unprepared to shoulder, according to the Jones Walker LLP Maritime Cybersecurity Survey.

The law firm’s survey reflects the responses of 126 senior executives, chief information and technology officers, non-executive security and compliance leaders, and key managers from U.S. maritime companies.

The respondents represent key sectors in the maritime industry and include professionals from small, mid-size, and large companies.

The survey found that nearly 80% of large U.S. maritime industry companies (those with more than 400 employees) and 38% of all industry respondents reported that cyber attackers targeted their companies within the past year. Ten percent of survey respondents reported that the data breach was successful, while 28% reported a thwarted attempt.

Small and mid-size companies are far less prepared than larger companies to respond to a cybersecurity breach. All respondents from large organizations indicated they are prepared to prevent a data breach, while only 6% of small company (1 to 49 employees) respondents and 19% of mid-size company (50 to 400 employees) respondents indicated preparedness.

The survey discovered that many small and mid-size companies lack even the most fundamental protections, exposing them to huge potential losses. 92% of small company and 69% of mid-size company respondents confirmed they have no cyber insurance.

In contrast, 97% of large company respondents have cyber insurance coverage.

Less than 15% of companies are using multi-factor authentication for remote access, or providing off-site backups in physically secure locations. 60% said they are unprepared to deal with negative public opinion, blog posts, and media reports after a data breach; 49% are unprepared to minimize the loss of customers’ and business partners’ trust and confidence after a data breach; 70% are unprepared to respond to a data breach involving business confidential information and intellectual property; and 70% are unprepared to respond to the theft of sensitive and confidential information that requires notification to victims and regulators.

The majority of respondents (69%) expressed confidence in the maritime industry’s cybersecurity readiness, while a minority (36%) believe that their own companies are prepared. Lee says there is a real disconnect between how stakeholders view the maritime industry’s overall preparedness level versus how they see their own shops. “By and large, they view the industry as prepared, but their own companies as unprepared. That is like saying that my neighborhood is safe, but my house is a hotbed of crime,” he said. “What I take away from this is that the respondents are likely wrong about the industry, and right about their own companies.”

Maritime Cyber attack !

Australian ferry and defense shipbuilder Austal reported Thursday that it has been hit by a cyberattack. An unknown offender managed to steal internal data, including some staff contact information and unspecified data affecting a “small number of stakeholders.” The firm emphasized that its ship design drawings for vendors and customers are neither sensitive nor classified, without specifying whether any drawings may have been taken.

Austal said that the attacker attempted to engage in extortion using the stolen information and tried to sell it online. In line with its company policy, Austal did not respond to extortion offers, the firm said.

The firm, which builds the U.S. Navy’s Independence-class Littoral Combat Ship and the Expeditionary Fast Transport, said that there were no indications that the data breach had national security implications. “Austal’s business in the United States is unaffected by this issue as the computer systems are not linked,” the company said.

The Australian Cyber Security Centre and the Australian Federal Police are investigating the attack, and the Australian Department of Defence is providing technical assistance. “This incident reinforces the serious nature of the cyber security threat faced by defence industry, and the need for industry partners to put in place, and maintain, strong cyber defences,” said the Department of Defence in a statement. Austal holds the contract to build and maintain two patrol boat classes for Australian military and government operators.

Austal said that the attack had no effect on its day-to-day operations, and that its data systems have been secured and brought fully back online.

Source – Read full article

The International Association of Classification Societies (IACS) has published nine of its 12 recommendations on cyber safety for ships.

IACS initially addressed the subject of software quality with the publication of UR E22 in 2006. Recognizing the huge increase in the use of onboard cyber-systems since that time, IACS has developed this new series of recommendations with a view to reflecting the resilience requirements of a ship with many more interdependencies. They address the need for:

• A more complete understanding of the interplay between ship’s systems
• Protection from events beyond software errors
• In the event that protection failed, the need for an appropriate response and ultimately recovery.
• In order that the appropriate response could be put in place, a means of detection is required.

Noting the challenge of bringing traditional technical assurance processes to bear against new and unfamiliar technologies, IACS has launched the recommendations in the expectation that they will rapidly evolve as a result of the experience gained from their practical implementation. So, as an interim solution, they will be subject to amalgamation and consolidation.

More than 90 percent of the world’s cargo carrying tonnage is covered by the classification design, construction and through-life compliance rules and standards set by the 12 member societies of IACS.

The 12 Recommendations are:

Recommended procedures for software maintenance of shipboard equipment and systems (published)

Shipboard equipment and associated integrated systems to which these procedures apply can include:
– Bridge systems;
– Cargo handling and management systems;
– Propulsion and machinery management and power control systems;
– Access control systems;
– Ballast water control system;
– Communication systems; and
– Safety system.

Recommendation concerning manual / local control capabilities for software dependent machinery systems (published)

IMO requires through SOLAS that local control of essential machinery shall be available in case of failure in the remote (and for unattended machinery spaces, also automatic) control systems. For traditional mechanical propulsion machinery, this design principle is well established. The same design requirement applies to computerized propulsion machinery, i.e. complex computer based systems with unclear boundaries and with functions maintained in the different components.

Contingency plan for onboard computer based systems (published)

Computer based systems are vulnerable to a variety of failures such as software malfunction, hardware failure and other cyber incidents. It is not possible for all failure risks to be eliminated so residual risks always remain. In addition, a limited understanding of the operation of complex computer based systems together with fewer opportunities for manual operation can lead to crews being ill-prepared to use their initiative to responding effectively during a failure.

IMO and Classification Society rules contain many context specific examples of requirements for independent or local control in order to provide the crew with the means to operate the vessel in emergencies or following equipment failures. These requirements have generally been introduced when automation or remote control is introduced to individual pieces of equipment or functions and address concerns regarding its possible failure of the new features. The introduction of technologies which integrate different vessel’s functions creates the opportunity for two or more systems to be impacted by a single failure simultaneously.

Where, due to high computer dependence, manual operation is no longer practical or where the number of systems simultaneously affected is too high for manual operation to be practical with existing crew levels then the value of local control as a form of reassurance is limited, however the crew will still need to be provided with practical options to try to manage threats to human safety, safety of the vessel and/or threat to the environment.

If the practical options are not considered during the design and installed during construction of the vessel then the vessel and its crew could be, due to the introduction of new technologies, exposed to risks which they cannot manage.

Practical options could include limiting the extent of potential damage so that manual control is still achievable or providing backup systems which could be used in a worst case systems failure. Whatever form of contingency is provided to address failures it is important that it is well documented, tested and that the crew is aware and trained.

Requirements related to preventive means, independent mitigation means, engineered backups, redundancy, reinstatement etc. are dealt with in the other relevant recommendations.

Network Architecture (published)

Ship control networks have evolved from simple stand-alone systems to integrated systems over the years and the demand for ship to shore remote connectivity for maintenance, remote monitoring is increasing.

Incorporation of Ethernet technology has resulted in a growing similarity between the once disconnected fieldbus and Internet technologies. This has given rise to new terms such as industrial control networking, which encompasses not only the functions and requirements of conventional fieldbus, but also the additional functions and requirements that Ethernet-based systems present.

The objective of the present recommendation is to develop broad guidelines on ship board network architecture. The recommendation broadly covers various aspects from design to installation phases which should be addressed by the Supplier, system integrator and yard.

Data Assurance (published)

Regulation strongly focuses on system hardware and software development, however, data related aspects are poorly covered comparatively. Data available on ships has become very complex and in a large volume, meaning a user is unlikely to spot an error and it would be unreasonable to expect them to do so. Cyber systems depend not only on hardware and software, but also on the data they generate, process, store and transmit. These systems are also becoming more data intensive and data centric, often used as decision support and advisory systems and for remote digital communication.

Data Assurance may be intended as the activity, or set of activities, aimed at enforcing the security of data generated, processed, transferred and stored in the operation of computer based systems on board ships. Security of data includes confidentiality, integrity and availability; the scope of application of Data Assurance covers data whose lifecycle is entirely within on board computer based system, as well as data exchanged with shore systems connected to the on board networks.

Physical Security of onboard computer based systems (to be published Q4, 2018)

Network Security of onboard computer based systems (published)

Network security of onboard computer-based systems consists in taking physical, organizational, procedural and technical measures to make the network infrastructure connecting Information Technology and/or Operational Technology systems resilient to unauthorized access, misuse, malfunction, modification, destruction or improper disclosure, thereby ensuring that such systems perform their intended functions within a secure environment.

Vessel System Design (to be published Q4, 2018)

Inventory List of computer based systems (published)

For effective assessment and control of the cyber systems on board, an inventory of all of the vessel’s equipment and computer based systems should be created during the vessel’s design and construction and updated during the life of the ship: tracking the software and hardware modifications inside ship computer based systems enables to check that new vulnerabilities and dependencies have not occurred or have been treated appropriately to mitigate the risk related to their possible exploitation.

Integration (published)

Integration refers to an organized combination of computer-based systems, which are interconnected in order to allow communication and cooperation between computer subsystems e.g. monitoring, control, Vessel management, etc.

Integration of otherwise independent systems increases the possibility that the systems responsible for safety functions can be subject to cyber events including external cyberattacks and failures caused by unintentionally introduced malware. Systems which are not directly responsible for safety, if not properly separated from essential systems or not properly secured and monitored in an integrated system, can introduce routes for intrusion or cause unintended damage of important systems. It is necessary to have a record and an understanding of the extent of integration of vessels’ systems and for them to be arranged with sufficient redundancy and segregation as part of an overall strategy aimed at preventing the complete loss of ship’s essential functions.

Remote Update / Access (published)

Information and communications technology (ICT) is revolutionizing shipping, bringing with it a new era – the ‘cyber-enabled’ ship. Many ICT systems on-board ships connect to remote services and systems on shore for monitoring of systems, diagnosis and remote maintenance, creating an extra level of complexity and risk. ICT systems have the potential to enhance safety, reliability and business performance, but there are numerous risks that need to be identified, understood and mitigated to make sure that technologies are safely integrated into ship design and operations.

Communication and Interfaces (to be published Q4, 2018)

Are the maritime industries about to be revolutionised by smart shipping or is the sector not yet ready for the fourth industrial revolution? It is a highly emotive subject and the Parliamentary Debate at Seatrade Maritime Middle East will see six leading industry executives, all with strong opinions debate the motion: “This House believes the shipping industry is not yet ready to embrace smart shipping”.

On the one hand Smart Shipping has the potential to transform the fundamentals of ship operation, with digital technology and big data driving radical new solutions up to and including autonomous ships.

But on the other what does the industry actually want from these new technologies, how real are the efficiencies they offer and what changes to the regulatory framework would be needed prior to significant implementation?

The Parliamentary Debate held on 29 October at Seatrade Maritime Middle East in Dubai will be chaired by leading maritime lawyer Jasamin Fichte, Managing Partner of Fichte & Co.

Speaking for the motion are: Khalid Hashim, Managing Director, Precious Shipping, Ali Shehab Ahmad, Deputy Chief Executive Officer, Kuwait Oil Tanker Company (KOTC) and Captain David Stockley, Chief Operating Officer, Oman Ship Management Company.

On the side against the motion are: René Kofod-Olsen, Chief Executive Officer, Topaz Energy and Marine, Oskar Levander, Senior Vice President Concepts & Innovation, Rolls Royce Marine, and Ronald Spithout, President, Inmarsat Maritime.

So is the industry ready or not to embrace smart shipping? There is only one way to find out – attend the debate, listen to the arguments, and then as the parliamentarians (audience) you vote on which side wins the debate.

ARTICLE SOURCE CLICK LINK

OCIMF is pleased to announce the release of the seventh edition of the SIRE Vessel Inspection Questionnaire (VIQ7).

This edition has undergone an extensive revision process which has brought the VIQ up-to-date with respect to changes in legislation and best practices. The SIRE Focus Group, which has led the work on the revision of this document, has examined the questions to determine whether these continue to remain relevant and has reduced the overall set of questions by up to 90 questions.

The section on Structural Condition in the existing VIQ6 (Chapter 7) has been reduced and merged with Chapter 2. A new chapter (Chapter 7) has been developed to cover Maritime Security which has 21 new questions covering Policies and Procedures, Equipment and Cyber Security.

The section on Mooring (Chapter 9) has been significantly reviewed to incorporate the revisions and best practices that will be introduced in the Mooring Equipment Guidelines, Fourth Edition (MEG4). Operators will be encouraged to align their procedures and equipment with the guidance provided in MEG4 as soon as possible.

The existing chapter on Communications (Chapter 10) has been reduced and merged with Chapter 4, which is now a section on Navigation and Communications.

A set of 10 questions on LNG Bunkering has been added to the section on Engine and Safety Compartments (Chapter 10). These questions have been developed in conjunction with advice and guidance from SIGTTO and SGMF.

The following templates within the seventh edition of the SIRE Vessel Inspection Questionnaires (VIQ7) are now available to integrators upon the OCIMF Staging environment and will be released to the Production environment on the 17September 2018.

Template 4401 – VIQ7 (Petroleum)
Template 4402 – VIQ7 (Chemical)
Template 4403 – VIQ7 (LPG)
Template 4404 – VIQ7 (LNG)

Release of the seventh edition of the SIRE Vessel Inspection Questionnaire (VIQ7): 17 September 2018

1 file(s) 4.00 KB

Download

maritime cyber security Kongsberg Maritime director of autonomy Peter Due explains why e-navigation and technology developed for the Yara Birkeland project will enable a future of autonomous shipping

ECDIS and e-navigation will be essential for generations of future autonomous ships. Although the first unmanned ships will be remotely controlled and operating in coastal waters, in the long term there will be ocean-going autonomous ships, with e-navigation technology monitoring their progress onshore.

IMO placed ocean-going autonomous vessels firmly on the global agenda during the Maritime Safety Committee (MSC) 99 session in May this year, by implementing a working group to conduct a regulatory scoping exercise for using MASS (Maritime Autonomous Surface Ships)*.

Kongsberg Maritime will be part of that working group and will deliver technology to the world’s first all-electric, zero emissions and autonomous container vessel, Yara Birkeland. This ship is scheduled to transport fertiliser products along a 30 nautical mile route to the ports of Brevik and Larvik next year and by 2020 is likely to be unmanned.

Kongsberg Maritime director of autonomy Peter Due said new navigation and collision avoidance systems that centre on e-navigation technology were needed for this project, as Yara Birkeland will operate on a busy waterway.

Kongsberg drew on its experience in autonomous underwater vehicles, dynamic positioning, ECDIS and sensor fusion as a foundation for autonomous navigation. But Mr Due explained to Marine Electronics & Communications that more development was required. “Harmonising with artificial intelligence, machine learning and digital twin technology enables the extreme level of safety required,” he said.

Mr Due said Yara Birkeland’s operations will be planned, pretested and optimised in the cloud using the Kognifai digital platform and its digital twin that Kongsberg generated. This includes navigation in different metocean conditions.

“The twin integrates all data including weather, currents, tides and temperature with a detailed physical ship model,” said Mr Due. “We can then decide the optimum route and simply transfer it to the ship’s autonomy engine, navigation systems and ECDIS when it is in port,” he continued.

“Once the ship sets off, sensor fusion comes into play, enabling the autonomy engine, working with the onboard digital twin and e-navigation systems to adjust and reroute at sea according to the going conditions and other vessels in the vicinity.”

It is this dynamism a fully autonomous navigation system requires that led to the establishment of the Hull to Hull (H2H) EU-funded research project. This will develop technical solutions for safer navigation in close proximity of other stationary or moving vessels and objects.

H2H will use the European Global Navigation Satellite System to enhance safety in busy waters and during close manoeuvring. “This will help mariners to make the correct navigation decisions and will create the fundamental conditions for autonomous vessel navigation,” said Mr Due. Data can be used as an input to an autonomy controller.

Navigational safety is essential if the benefits of MASS are ever to be truly realised”

Ensuring e-navigation and collision avoidance technology works correctly will be fundamental to autonomous shipping. “Navigational safety is essential if the benefits of MASS are ever to be truly realised,” said Mr Due.

SOURCE READ FULL ARTICLE

Maritime GDPR – General Data Protection Regulation Implementation

The EU General Data Protection Regulation (GDPR)

The EU’s General Data Protection Regulation (GDPR) will apply from 25 May 2018, when it supersedes all EU member states’ current national data protection laws. Significant and wide-reaching in scope, the Regulation brings a 21st-century approach to data protection. It expands the rights of individuals to control how their personal information is collected and processed, and places a range of obligations on organisations to be more accountable for data protection.Maritime GDPR – General Data Protection Regulation Implementation!

Deadline for compliance: 25 May 2018

Penalties

Under GDPR organizations in breach of GDPR can be fined up to 4% of annual global turnover or €20 Million (whichever is greater). This is the maximum fine that can be imposed for the most serious infringements e.g.not having sufficient customer consent to process data or violating the core of Privacy by Design concepts. There is a tiered approach to fines e.g. a company can be fined 2% for not having their records in order (article 28), not notifying the supervising authority and data subject about a breach or not conducting impact assessment. It is important to note that these rules apply to both controllers and processors — meaning ‘clouds’ will not be exempt from GDPR enforcement.

Who is impacted?

The GDPR applies to controllers and processors that are handling the personal data of European individuals. Perhaps one of the most important things to note is that this new regulation applies to ALL organisations collecting and processing personal data of individuals residing in the EU, regardless of the company’s physical location.

All maritime companies need to be in compliance by the deadline of enforcement / SHIP IP LTD can assist you STEP BY STEP and prepare an organization to be compliant with the GDPR, update your SMS provide you policies and all tools required !

FAQ

How we get started ?

Please complete simple form below so we can understand your company’s size and resources required to be reviewed .

Our consulting team will get in contact with you soon to arrange a web conference and discuss next steps.

How much it costs ?

That depends the size of your company / number of people involved and our findings after our initial GAP analysis .

How much time required until implementation ?

Usually between 4-8 weeks – We suggest you that the person really knows your internal workflow and data structure to be in direct contact with our team so we can reduce implementation time to minimum.

Do we need a DPO (Data Protection Officer) ?

YES you need for sure ! at least the first two years so people can be trained and be mature with the new regulation.

SHIP IP LTD offers outsourced DPO service with an agreed annual FEE – So we actually can follow up and ensure implementation after we complete relevant consulting . Our DPO is certified by TUV Austria

What Documentation will be provided ?

40+ policies, procedures, controls, checklists, tools, presentations and other useful documentation , sample list below not limited :

Data protection policy
Training policy
Information security policy
Data protection impact assessment procedure
Retention of records procedure
Subject access request form and procedure
Privacy procedure
International data transfer procedure
Data portability procedure
Data protection officer (DPO) job description
Complaints procedure
Audit checklist for compliance
Privacy notice

SHIP IP LTD will help you from initial steps until implementation and auditing to ensure continues auditing !

Get in contact with us TODAY !

Error: Contact form not found.

Newer Posts

Older Posts

CYBER SECURITY Archives - Page 6 of 8 - SHIP IP LTD

BIMCO : The Guidelines on Cyber Security Onboard Ships Version 3

BIMCO Version 3.0 of the Guidelines

BIMCO aims to publish cyber security clause in spring 2019

BIMCO aims to publish cyber security clause in spring 2019

Overview

Planning and protecting is key

Two important functions

More attention needs to be paid to cyber threats against ports and shipping

cyber threats against ports.

Brigadier General Gholam Reza Jalali, head of Passive Defence Organisation of Iran, has said more attention needs to be paid to cyber threats against commercial ports and shipping, insisting that this is a real area of concern.