The enduring feature of cyber threats is their ability to adapt and evolve, with new lines of attack developed as barriers are put in place, and strategies to expose vulnerabilities constantly emerging. A June 2020 White Paper** from the British Ports Association and cyber risk management specialists Astaara suggests that reliance on remote working during the COVID-19 crisis coincided with a fourfold increase in maritime cyber attacks from February onwards, for example.

In fact, cyber security was ranked as the second highest risk for shipping in 2019, behind natural disasters, according to a survey of over 2,500 risk managers conducted by Allianz. Given that, according to IBM, companies take on average about 197 days to identify and 69 days to contain a cyber breach, it is clear that an attack on a vessel’s critical systems could threaten the safety of a ship as well as the business of shipping. The fact that a 2019 Data Breach Investigations Report from Verizon indicates that nearly one-third of all data breaches involve phishing provides one indicator that, where cyber vulnerabilities exist, the ‘human element’ can badly expose them.

Source: rivieramm

Maritime digital transformation is in its most rapid and turbulent era. Such a transformation offers substantial advantages and benefits, but with commensurate risks in the cyber domain.

On June 16, 2017, the International Maritime Organization (IMO) adopted Resolution MSC.428(98) that “encourages administrations to ensure that cyber risks are appropriately addressed in existing safety management systems (as defined in the ISM Code) no later than the first annual verification of the company’s Document of Compliance (DOC) after 1 January 2021.” The same year the IMO developed related guidelines (MSC-FAL.1/Circ.3). While the resolution is a formal acknowledgement of the importance of cybersecurity by the UN agency, the guidelines highlighted that effective cyber risk management should start at the senior management level.

But even smart and elaborate risk management will not be effective until appropriate cyber awareness arises among all those engaged in the maritime world. The human element is the most valuable but also the most vulnerable in maritime cybersecurity. While modern technology affords a measure of protection against direct hacking, social engineering has become the most prevalent vector for cybercrime.

There is a popular opinion that the direct targeting of senior leaders (known as whaling attacks, or CEO fraud), is the most probable scenario for a lucrative cyberattack. In cases of success, offenders can get access to sensitive data or even entire networks and affect many processes within the system. In some cases, attackers could even get options to direct groups of ships. On the other hand, such a “whaling attack” is a complicated process with disputable chances of success. The obligation senior executives have toward cyber risk management is fast becoming a standard assumption. These leaders are becoming more and more aware of these hazards and are better maintaining prudent behavior to reduce cyber risks to themselves personally. Much simpler is the method of attempting to socially engineer other types of maritime workers, who at first sight appear less significant than executives, but who also enjoy broad access to maritime systems and networks.

There are two main groups that can be distinguished as desirable targets. The first group includes crewmembers onboard commercial vessels and naval ships, especially those who have direct access to the ship’s control systems or important elements of shipboard systems, like communications, engines, or cargo handling equipment and storage areas. The second group includes shore-based personnel, including technicians and advisors, third party contractors, especially those who have remote access to seaborne networks and contacts.

There are three critical areas attractive to attackers, including navigational systems and sensors, cargo handling and storage, and propulsion and power. In most cases the latter two elements require direct physical access to effectively access critical systems. In contrast, navigational systems are perhaps among the most advanced networked and digitally accessible systems onboard.

If cyber intruders got access to ECDIS (the Electronic Chart Display and Information System), they would be able to attempt offensive options such as jamming  or corrupting signals received from external sensors (GPS, AIS, Radar/ARPA, Navtex), gathering critical hydrographic information, and tampering directly with the Electronic Navigational Chart (ENC). While official ENCs often feature highly protected data, unauthorized access to the ENC’s manual correction option can be disruptive. Hackers could also go for the simpler option of disabling the operating systems of the ECDIS workstations, where in the majority cases this is a commonplace Windows operating system, and not necessarily the latest version. With the highly integrated bridge navigational systems of modern chemical tankers and passenger ships, attackers could even target the ship’s auto-steering algorithm.

Unauthorized access to such an important navigational system can be obtained with malware accepted by equipment operators via their email client and personal social media profiles. Today, with the internet widely available onboard modern commercial vessels, shipboard personnel can freely use their personal mobile devices or laptops for web access and private communications. At the same time, cybersecurity hygiene and best practices are often neglected, and the same personal devices can be used for operational data storage and transfer, including transferring data to and from ECDIS workstations.

Imagine a scenario where a chemical tanker was chosen as a target by a hacking group. Information regarding the vessel’s static and dynamic (course/speed/position) data, crew composition, type and quantity of cargo, destination, captain’s name, and other items of interest could be collected from the web. Attackers could search and exploit the social media networks of crewmembers, preferably the targeted vessel’s bridge team member. The task is made easier by social media networks and websites focused on professional groups and employment.

During the second stage, the stage of evaluation, the opted profile is carefully examined by the offenders for weakpoints. Nowadays, the majority of social media users are registered across several platforms, such as those focused on personal and professional connections, as well as entertainment preferences. Therefore adversaries can gain information not only about the mariner’s place of service but also about their family, hobbies, places visited, and other information that could be relevant to designing a socially engineered attack.

Their objective will be to obtain unsanctioned admittance into the vessel’s systems. The targeted person can either be blackmailed or contacted by a fake profile of a trusted contact with the aim of dispatching malware via the victim’s access. An untrained and unaware navigational officer could install the malicious software to the navigational computer, under the guise of ‘colleague’s friendly tip.’

A socially engineered attack can be made to seem more credible when shore personnel, such as technicians or support desk members, are targeted. With almost the same measures in searching, evaluating, targeting, and hacking, perpetrators can infiltrate and attack even larger groups of ships due to how shore professionals often have access and jurisdiction over many vessels.

More nefarious intentions could include causing a chemical spill, setting a ship on a collision course with a naval ship or a passenger vessel, or damaging critical shore-based infrastructure. In respect of these scenarios, maritime cyber threats should be considered as a matter for the International Ship and Port Facility Security Code (ISPS), and not only the International Safety Management Code (ISM). The ISPS code consolidates various constructive requirements so that it can achieve certain objectives to ensure the security of ships and ports.

There are some important requirements under the ISPS. The security-related information exchanges among the appropriate contracting agencies, both government and private, include collecting and assessing the obtained information and further distributing it. Correspondingly, definitions are included for the relevant communication protocols for vessels and port facilities for uncomplicated exchanges of information. Another important element is attempting to prevent any unauthorized access on a vessel, port facility, or other important restricted areas. Even if unsanctioned entry is not a threat, it is always regarded as a potential danger.

The ISPS also regulates provisions of different options for alarm-raising in case a security-related incident is encountered or potential danger is evaluated. It seems logical enough to apply similar requirements for maritime cybersecurity. There are several main tasks to consider: cybersecurity information collecting, evaluation and exchange between concerned parties; prevention of unauthorized access; malware and spyware installation or transfer; and appropriate training of personnel.

Eventually, regulation should be introduced regarding the human element. Specifically, trainings and exercises should be introduced for vessels’ crew and port facilities’ staff to ensure their awareness with the security plan and that there will be no delay in procedure execution in case of a real threat. Advanced cybersecurity training and education should be encouraged, especially for critical staff like watchkeeping officers or engineers. The purpose of such an education would be to gain knowledge and develop skills in cybersecurity in order to anticipate threats at early stages. Trained personnel should also be ready to prevent unauthorized access to critical equipment and systems and be vigilant for particular malfunctions that could be caused by illicit infiltration. In cases of potential penetration, staff should be skilled enough to insulate affected areas of the system without losing control of the vessel. Their proficiencies should include the ability to manage a transition to emergency manual control and utilizing classic techniques in seamanship and communication.

Maritime security, through cybersecurity, will become a much more complex endeavor. It will require a considered combination of the human element, technical innovation, management procedures, security protocols, and classical maritime know-how. Considering the lack of cyber-awareness among some mariners, a transfer of malware from a personal device to a ship’s navigational system is just a matter of time. The international maritime community should accelerate and strengthen efforts to develop adequate measures to withstand future challenges in the maritime cyber domain.

Leonid Vashchenko is a professional mariner, currently serving as a chief officer on board ocean-going commercial vessels. He holds a Masters Degree in Marine Navigation from the National University “Odessa Maritime Academy,” Ukraine, and is a active member of the Nautical Institute, London. His views are his own and do not necessarily represent the official views or policies of the organization or companies he is employed with.

Source: cimsec

The maritime transport industry is increasingly reliant on computing and communication technologies, and the need for cyber risk management of critical systems and assets on vessels is becoming critically important. In this paper, a comprehensive cyber risk assessment of a ship is presented. An experimental process consisting of assessment preparation activities, assessment conduct and results communication has been developed. The assessment conduct relies on a survey developed and performed by interviewing a ship’s crew. Computational vulnerability scanning of the ship’s Electronic Chart Display and Information System (ECDIS) is introduced as a specific part of this cyber security assessment. The assessment process presented has been experimentally tested by evaluating the cyber security level of Kobe University’s training ship Fukae-maru. For computational vulnerability scanning, an industry-leading software tool has been used, and a quantitative cyber risk analysis has been conducted to evaluate cyber risks on the ship.

Source: cambridge

Vessels worldwide are now facing compliance with IMO 2021 cyber security regulations.  These are the first of what could be additional cyber security regulations for regulated vessels and facilities. International Maritime Security Associates (IMSA), the developers of the award-winning ARMS software platform, have developed a suite of cyber security tools and services for the maritime industry.  The company has recently launched the capability to conduct basic shipboard network vulnerability assessments without sending personnel onboard.

“This capability is necessary in today’s current COVID environment.” Comments Corey Ranslem, CEO of IMSA. “We know it isn’t always easy, practical or cost effective to send people onboard a vessel to conduct a cyber security assessment, so we’ve developed this amazing remote assessment tool.  Through this tool, our cyber specialists can conduct a remote assessment at about half the cost of sending personnel onboard. This tool helps our global clients with IMO 2021 cyber security compliance along with protecting passengers, crew, and cargo.”

This unique tool is part of a larger suite of cyber security tools IMSA has developed to support vessels and maritime facilities with expanding their cyber security defenses.  Some of these cyber security tools are part of the ARMS software platform. Through ARMS, IMSA can monitor a vessel’s critical systems and networks remotely in real-time through their state-of-the-art SOC (Security Operations Center).  This capability protects vessels from real-time threats to IT, OT, and other critical network systems.

“IMSA is continually enhancing the levels of protection we provide our clients.” Says Ranslem.  “Through ARMS and our 24/7 operations center we provide a variety of client focused services to ensure the safety of your voyage and critical systems.”

Source: maritime-executive

There are growing signs that a military crisis could erupt across the Taiwan Strait this year as China flexes its military muscle to strongarm Taipei into accepting unification.

ASPI’s Peter Jennings notes that Beijing is also seeking to test the mettle of the new US administration.

It’s vital that the United States stand firm against any Chinese provocation. A failure to defend Taiwan would be an abdication of US international leadership. It would seriously damage America’s credibility in the Indo-Pacific and would invite China and others to become ever more aggressive. Thankfully, all indications suggest that President Joe Biden is set to continue strengthening Washington’s relationship with Taipei.

Jennings argues that it’s equally important for Australia to stand with the US in any Taiwan Strait crisis. If China decides that military adventurism, timed to exploit the ongoing Covid-19 pandemic and political turmoil in the US, is a way to further its goal of ending America’s strategic primacy in the Indo-Pacific, the worst thing Australia could do is look the other way.

Principles matter. As Australia enjoys all the benefits of a free and open society in a stable and functioning democracy, our principles and values must extend to supporting the survival of Taiwan as a vibrant democracy of 24 million people with a successful market economy. The examples of Hong Kong and Xinjiang suggest a dark future for the Taiwanese people if China decides to force unification with the mainland.

Taipei’s success provides a powerful alternative to Beijing’s promotion of authoritarianism with Chinese characteristics as a model for development. Ideological competition is intensifying as Xi Jinping pushes for a Chinese-led ‘community of common destiny’ as a basis for the future global order. It’s just as vital for Western democracies to win this new ideological battle as it was for us to resist Soviet communism during the Cold War. To turn away from a fellow democracy under threat from an aggressive authoritarian neighbour would make a mockery of the values we advocate and lower our credibility in the eyes of many developing countries.

China has a geostrategic agenda that goes beyond forcing unification on the Taiwanese people. Taiwan is a means to a Beijing-dominated regional order that would dramatically worsen our strategic outlook.

A Chinese-controlled Taiwan would ease the challenges for Beijing in projecting naval power across the Indo-Pacific and weaken the ability of the US to maintain a forward presence in the western Pacific. From ports and air bases in Taiwan, the People’s Liberation Army could support the extension of its maritime militia and coast guard northwards through the Ryukyu Islands and against the Senkaku Islands. That would make it more difficult for Japan to protect its southern islands and give Beijing added coercive leverage against Tokyo in a crisis, including by interfering with Japan’s maritime commerce.

From Taiwan, the PLA could also pivot south, effectively enveloping the Philippines and giving Beijing easier access to the resource-rich Benham Rise. China has already sent oceanographic vessels there and challenged Manila’s sovereignty over those waters. Chinese control of Taiwan would also strengthen Beijing’s ability to control the South China Sea by blocking the Luzon Strait and the Balintang and Babuyan channels, cutting off the traditional access paths used by US naval vessels.

Control of Taiwan would make it easier for the PLA to reach Guam using long-range missiles and airpower, extending its anti-access capabilities beyond the first island chain. It would also enable the PLA to operate Type 096 ballistic-missile submarines further out into the middle sea between the first and second island chains, bringing more of the US within reach of JL-3 nuclear-armed submarine-launched ballistic missiles.

Taiwanese strategic analyst Eli Huang argued in 2017 that China had big plans for regional dominance extending well beyond the Taiwan Strait. Its development of large aircraft carriers and advanced aviation vessels for amphibious operations reinforces a power-projection capability that is increasing. Access to forward bases, whether through direct military conquest, such as the seizure of Taiwan and the militarisation of the South China Sea, or by exploiting its Belt and Road Initiative to gain access to commercial ports that could support Chinese naval vessels, would further extend that reach.

If China were to provoke a crisis over Taiwan, whether this year or in a future year, some would no doubt argue that it’s not Australia’s business and that supporting a US response would increase the risk of devastating Chinese military, political and economic retaliation against us. To accept that argument as policy would mark the end of our strategic alliance with the US, leaving us more exposed to Chinese coercive pressure and political warfare, or even a direct military threat.

As Kim Beazley stated in 2020:

Australia cannot be defended without the alliance with the United States. It’s as simple as that. If you know the math. If you know the capability. And if you know what we can actually spend—and I’d still say that at 2.3% of GDP—to contemplate a situation without them, you can forget it.

The loss of the US alliance would be catastrophic for our security, and a hegemonic China with grand imperial ambitions would force us to confront an ugly strategic choice. Acting alone, we’d need  significant boosts to our defence spending to achieve a degree of self-sufficiency beyond the traditional levels of ‘self-reliance’ that past defence white papers have alluded to. That could include developing military capabilities normally not considered for our defence force to deter a nuclear-armed adversary. We may well see an intensification of the political and economic pressure Beijing applied to Australia for much of 2020.

A military crisis across the Taiwan Strait would be a serious test of our national resolve, the strength of our most vital strategic relationship and our commitment to the values we stand for. The outcome of such a crisis would shape the strategic environment of the Indo-Pacific region for decades.

SHIP IP LTD – Remote internal/external Vulnerability &

Penetration Testing

TRUST OUR NETWORK – WE GUARANTEE BEST PRICES!

READ MORE

Maritime Vulnerability and Penetration Testing

Source: aspistrategist

Make a difference and join an enthusiastic team looking to make a difference in the lives of today’s military!  CACI is looking for a Senior Cyber Security Information System Security Officer (ISSO) with strong interpersonal and communication skills as well as a record of accomplishment in successful project execution.

Serve as a Senior ISSO and Senior Cyber Security Engineer supporting the Navy, USMC and Air Force projects assisting with project certifications and accreditation packages.  Act as the Norfolk cyber liaison for CACI, Government and Military Information Assurance Teams.

The project is within CACI’s Healthcare Delivery Systems portfolio.

More About the Role:

• Full accountability for the execution and delivery of multiple projects as related to testing, and security of network environments and administration
• Managing client, customer relationships
• Prepare and deliver customer deliverables and scope execution requirements established by customer
• Managing risks and issues and taking corrective measurements

You’ll Bring These Qualifications:

• A minimum of 7+ years of relevant experience
• Master’s Degree in Computer Science, IT Information Security, Information Systems, Engineering, Physics, Network Security or Engineering preferred
• Expertise in the areas of vulnerability and risk management
• Provide management level support to the Theater Medical Information Systems Program-Maritime (TMIP-M).
• Serve as the Information Systems Security Officer (ISSO) and support the Naval Information Warfare Center (NIWC) Program Management Team in regard to ensuring all TMIP installations are compliant with DOD Cyber requirements.
• Secure multiple Accreditations (ATO’S) for TMIP applications.
• Support the development of all deployment based procedures to ensure all TMIP Systems are compliant.
• Risk Management Framework Expert
• Create, develop and improve processes and deployment based procedures
• Advanced knowledge of DoD Cybersecurity policies, procedures and practices including the RMF and NIST SP 800-53.
• Advanced knowledge of Cybersecurity, Information Technology and Network Architecture.
• Advanced knowledge in the Information Assurance disciplines of Cybersecurity Testing, Evaluation, Validation and Verification of traditional and non-traditional information systems.
• Advanced knowledge of administrating traditional and non-traditional network systems, components, and other Information Technology associated with military applications.
• Advanced knowledge of computers, networks, deployment environments (e.g., data center, cloud, etc.), systems and application security threats and vulnerabilities.
• Advanced knowledge of and skill in using DoD tools and capabilities for vulnerability assessments and compliance reporting (eMASS, ACAS, STIGs, SRGs, SCAP, XCCDF, etc.)
• Experienced implementing mitigation strategies and methods to resolve problems, and to lead re-testing and re-evaluation of affected systems.
• Demonstrate skills and abilities in planning, testing, evaluation of moderately complex operating systems (Windows and Linux), and networking hardware. Scope includes the demonstrated ability to implement the appropriate level of test rigor to verify/validate compliance of moderately complex systems
• Develop Risk Management Framework (RMF) artifacts, plan security assessment execution events, and report to cross-functional teams, IPT Leadership, Program Office personnel, and external Stakeholders
• Ability to advise team leaders on DOD/DON Security policy and guidelines for complex systems.
• Ability to summarize and report vulnerabilities and weaknesses verbally and in writing to the appropriate level of leadership
• Ability to work independently and meeting strict standards
• Execute RMF processes including the completion of RMF process steps in eMASS, the development of RMF artifacts and the implementation of Security Controls in coordination with development project teams.
• Design and development of plans, processes, and procedures for information systems leading to authorization and Approval to Operate (ATO) of complex systems IAW Federal and DOD cybersecurity requirements.
• Security+ Certification – must be obtainable with 90 days of employment
• Active Secret clearance is required

SHIP IP LTD – Remote internal/external Vulnerability &

Penetration Testing

TRUST OUR NETWORK – WE GUARANTEE BEST PRICES!

READ MORE

Maritime Vulnerability and Penetration Testing

Source: clearedjobs

In 2018, then-Chairman of the Joint Chiefs of Staff General Joseph F. Dunford described how the changing character of war and strategic landscape have “accelerated the speed and complexity of war” and contributed to a collapsed decision space. This is troubling for a navy in great power competition with potential adversaries who have increasingly capable long-range antiship missiles. This extended range and lethality, combined with the vulnerability of networks and ubiquitous use of communications, means naval forces are increasingly susceptible to adversary targeting. Distributed maritime operations (DMO) strive to counter this with distributed lethality, but  the limiting factor is a commander’s decision cycle. Acknowledging the need for improved decision-making, then-Chief of Naval Operations Admiral John M. Richardson wrote that the competition had shifted “from information superiority to decision superiority.”¹ Great power competition in the age of missiles and information abundance means the ability to translate information superiority into decision superiority will be the decisive factor.

This carries significant implications for naval intelligence and the Information Warfare (IW) Community and requires change at the operational level of war. While DMO aims to complicate adversary targeting and provide commanders with more reliable offensive capability, it also requires greater coordination across the fleet and exquisite intelligence at the fleet level. It also means naval strategist Wayne Hughes’ maxim to “attack effectively first,” traditionally viewed as a tactical principle, now applies to the operational level. In addition, former Pacific Fleet Commander Admiral Scott Swift believes the return of great power competition in the maritime domain means the “basic warfighting element” is now the fleet, and an independently operating carrier strike group no longer brings adequate combat power or can ensure its own security. Not only do operations demand greater shared understanding across the fleet, they must occur in a challenging and vulnerable communications environment. One answer, according to Admiral Swift, is to enable mission command “by providing precise and widely understandable commander’s guidance and intent before communications and networks are put at risk.” This intent must be built on a foundation of solid intelligence though. Naval intelligence must focus on the operational level of war to lead the IW community in enabling decision superiority.

To do this, naval intelligence must embrace integrating the IW community in all fleet maritime operations centers (MOCs) because of IW’s ubiquity in all aspects of the operating environment. Next, to address declining expertise and information overload, artificial intelligence (AI) and information design must be used to develop penetrating insight and improve decision-making. Finally, increasing red team capabilities will improve support to wargaming and reinforce effective learning behaviors that help the fleet outthink the adversary.

Fully Embrace IW Integration at the Fleet Level

Although the “the effect of information warfare (IW)” is recognized as the “fastest-changing trend in naval tactics today,” further integration at the fleet-level is required to fully realize its potential as a warfare discipline.² The Navy has embraced integration at the CSG-level but failed to successfully replicate this across the fleets. In fact, as Chief of Naval Operations Admiral M. Michael Gilday recognized, fleet MOCs must fully integrate IW capabilities to “master fleet-level warfare.” One of the primary applications of IW at the CSG-level is electromagnetic maneuver warfare (EMW), using techniques such as emissions control carefully coordinated with maneuver to complicate adversary targeting efforts.³ Close coordination between IW disciplines is paramount to this process and intelligence is foundational. If the fleet is now truly the basic warfighting element, IW lessons from the CSG-level must be understood and ingrained at the fleet MOCs. Traditionally responsible for creating shared understanding through battlespace awareness, naval intelligence is a natural discipline to lead the integration of IW.

The Need for Penetrating Insight

Developing penetrating insight is critical when intelligence officers are expected to think like the enemy, assessing adversaries from significantly different cultures, while avoiding the pitfalls of mirror-imaging.⁴ Recall the victory at the Battle of Midway in June 1942, made possible by the efforts of Lieutenant Commander Edwin Layton and Commander Joseph Rochefort. As Captain Bill Bray recognized in his Proceedings article, “naval intelligence: Build Regional Experts,” these two were valuable to Admiral Chester Nimitz not only because they knew intelligence and cryptology well, but because their expertise of the Imperial Japanese Navy and the Japanese culture meant their advice carried weight. Since the career path of naval intelligence officers is unlikely to change in the near term, time must be spent more efficiently to develop expertise.

One such opportunity is to decrease the level of effort devoted to developing a common operational picture (COP). The COP is fed largely by operational intelligence (OpIntel), which is the all-source intelligence process used at the tactical and operational levels to provide near-real-time locations and assessments of potential adversary activity. Operational intelligence and OpIntel are not synonymous and, all too often, OpIntel comes at a cost of conducting the true operational intelligence tasks required at the theater-level. Admiral Swift recognized the resources of intelligence teams are largely devoted to development of the perfect COP, at an opportunity cost to conducting predictive analysis, and recommended a fleet commander’s window of focus should really be no fewer than 96 hours and perhaps as far as 90 days in the future. This means if naval intelligence is to influence fleet decision-making, it must stop focusing on the here and develop penetrating insight of the adversary.

Integrate Artificial Intelligence into the Process

Providing “quality over quantity” is a challenge when faced with an overabundance of information. A 2016 Intelligence and National Security article examining intelligence tasks of the future found the number of words an analyst must read per day was ten times greater than 20 years prior, which is more than would be possible in a day, assuming no other tasks were accomplished. This influx of data is staggering and the implications are troubling. While intelligence will always remain a very human-centered process, the relationship with information and technology must change.

By embracing the power of AI, naval intelligence can leverage technology to automate many of the processes associated with current intelligence, allowing more time to develop the penetrating insight required to enable decision superiority. AI will allow analysts “to move away from questions of ‘situational awareness’–the compilation, processing and repackaging of data,” such as COP development, and toward the development of anticipatory intelligence useful to a fleet commander. This has significant implications for OpIntel, where the central effort is to generate and test a hypothesis that results in an estimation many refer to as the “so what.” Although hypothesis generation is not yet algorithmic and therefore not possible with AI, hypothesis testing can be subjected to data and is thus algorithmic. Therefore, it is possible for an informed analyst to create a hypothesis, recognize which pertinent data to include, and use AI to run possibilities. As former Pacific Fleet director for intelligence Captain Dale Rielage asserted, the use of AI in OpIntel “is a great example of where human-machine teams could be a game changer. Not only would this create more time to develop expertise, it would likely improve the accuracy of OpIntel assessments.

Mind the (Information) Gap

Significant effort also continues to be expended finding methods to communicate the right intelligence in the right medium to rapidly impart meaning to the commander, which requires an understanding of the customer and information design. Studies across the military and intelligence community found that “information needs to be designed” because as consumers become more “digital savvy,” their expectation for visualization increases. This should come as no surprise with the amount of thoughtfully designed information available at the fingertips of anyone operating a smart phone. The effective depiction of information reduces mental load and maximizes the potential for understanding, retention, and recall along with improving receptivity while decreasing the likelihood of “mind-set and information overload.” The cost of not designing information effectively can be tremendous.

The attacks on Pearl Harbor and the World Trade Center are poignant examples of how, despite the intelligence system arguably blinking red, policy makers who suffered from mirror imaging and lack of receptivity remained unconvinced by reports. Although these particular failures lacked a specific, tactical-level warning and clues may have been lost in background noise, a third explanation is possible.⁵ Decision-makers were not presented information in a manner that enabled an effective decision. This is referred to as information-gap theory, which describes the gap between what someone knows and what someone needs to know to make good decisions. Naval intelligence must design intelligence effectively to communicate what the commander needs to know for decision superiority.

Investing in a Red Team is a Win-Win

Robert Rubel recalled the phrase, “the medium is the message,” to emphasize the meaningful influence of wargaming and how it nurtured critical thinking in participants. While official wargames are often thought of occurring at the high-operational and strategic levels, they can occur in many fashions, such as exercises or during staff discussions, and help to create the shared understanding across a staff necessary to achieve decision advantage. Some of the broad objectives of wargaming are to test concepts and plans, experience the consequences of decisions and to analyze the decision behavior of leaders, but it also tests the signals that are produced by actions and how inputs, such as information, impact decisions. Greater participation in wargaming will allow naval intelligence officers to refine assessments of adversary reactions, potentially augmented with AI, and experiment with alternative forms of information “designed” for decision-makers.

While the utility of wargaming is proven, its effectiveness is limited by the accuracy of the adversary portrayed, typically referred to as red, and although naval intelligence is integral to the wargaming effort, it does not have a sufficient capability writ large. Several Proceedings articles have sounded the alarm, and Rielage has urged, “to fully exploit the value that war gaming can bring to the Navy, a deliberate effort to build our red is required.”

The critical issue is making this a deliberate and formal function at the operational level of war. Pacific Fleet was successful in this endeavor and established a red team in 2014, referred to as the Pacific Naval Aggressor Team, which assumes the role of adversary decision-makers in wargames and, as Admiral Swift found, not only does this improve wargaming and exercise efforts, it ultimately improves the quality of intelligence analysis. Wargaming benefits intelligence personnel in helping them gain a greater understanding of the adversary, while also gaining a greater understanding of the decision-makers they support.

Naval intelligence must focus on initiatives at the operational level of war to achieve the decision superiority necessary to enable the fleet to “attack effectively first.” The full integration of IW at the fleet MOCs; focusing on the decision timeframe relevant to a fleet commander, along with leveraging the power of AI; and institutionalizing red team support to wargaming will allow fleet intelligence to enable decision superiority and win the future fight.

Lieutenant Commander Hoadley is a naval intelligence officer and member of the Information Warfare Community. He is a 2007 graduate of the U.S. Naval Academy and a 2020 graduate of the U.S. Naval War College. His career has included tours at SEAL Team Two, Naval Mine and Anti-Submarine Warfare Command (NMAWC), Sixth Fleet (CTF-69), and on board the USS Ronald Reagan (CVN-76). He is currently the OIC of Joint Reserve Intelligence Center (JRIC) Denver.

SHIP IP LTD – Remote internal/external Vulnerability &

Penetration Testing

TRUST OUR NETWORK – WE GUARANTEE BEST PRICES!

READ MORE

Maritime Vulnerability and Penetration Testing

Source: usni

Last year, we were faced with one of the biggest threats to our homeland: the COVID-19 pandemic. And there is the potential for even bigger crises than this. While some may consider this disease to have changed the threat landscape, we would argue that in fact this threat has existed all along – for any point on the spectrum from governments, to businesses, to individuals. Public health is now, and has always been, an underlying and vital component of any crisis, big or small. If we are to find any positive aspects of COVID-19, it is that it has shed new light on the importance of public health – public health has finally entered the much-needed spotlight.

The current state of the world – with climate change, social injustice, widespread mistrust, and reliance on social media rather than experts – means that crises will be exacerbated, and so too will the public health impact of these crises. Leaders now must immediately incorporate public health thinking into all of their activities. COVID-19 has touched every aspect of life – and this is how deep public health thinking must go. In 2020 we experienced firsthand the importance of a healthy workforce, of personal health, of solid health policy, of consistent health messaging. Accomplishing these goals requires intentional thought and work toward public health.

With that in mind, for leaders both in government and business to incorporate public health measures into their future planning and operations, public health experts must be consulted. The idea of a Public Health Officer or advisor is a new and exciting way to realize these ambitions. Public health experts, with experience and knowledge in areas such as infection control, social determinants of health, health initiatives, and policy, are primed for these positions. A Public Health Officer would require a voice at the highest management levels to provide insight and guidance for how to ensure a healthy workforce and population. They can step into many different industries and scenarios and provide the much-needed expertise to help people regain control of their health.

Economic hardships will admittedly present a challenge in the hiring of a new executive. But think about what might happen if you don’t. Ongoing COVID-19 could leave your workforce susceptible to extended time out of work. Without advisors on health and safety measures, returning to in-person work could be drawn out and expensive. Uncoordinated vaccine administration could leave part of the workforce still vulnerable to communicable diseases. Wary individuals could stop frequenting your business if they perceive inadequate health measures. Sedentary lifestyles could leave your company paying for more chronic illnesses through employer-sponsored insurance. These pressing problems, and many more, could be easily managed through Public Health Officers or advisors. They will ensure that your organization, and the people you care about, are prepared for any unexpected event and can remain healthy for whatever may be on the horizon.

SHIP IP LTD – Remote internal/external Vulnerability &

Penetration Testing

TRUST OUR NETWORK – WE GUARANTEE BEST PRICES!

READ MORE

Maritime Vulnerability and Penetration Testing

Source: hstoday

In recent years, cruise liners and their associated infrastructure rely more heavily on the interconnectivity of IT systems and operational technology (OT) systems, creating a robust digital environment to successfully execute their missions.

However, as ships become “smarter” and more interconnected, the risks of cyber attacks increase, which can negatively impact the business. The U.K. Government’s Transportation Department recently issued a warning in the “Cyber Security for Ships” code of practice in 2017 regarding the growing vulnerabilities in the maritime industry. It stated that computer system hacks could, at worst, endanger human life. If the hack were a terrorist motive, this could certainly threaten lives.

SHIP IP LTD – Remote internal/external Vulnerability &

Penetration Testing

TRUST OUR NETWORK – WE GUARANTEE BEST PRICES!

READ MORE

Maritime Vulnerability and Penetration Testing

Source: fortressinfosec