MARITIME CYBER SECURITY Archives - Page 25 of 41 - SHIP IP LTD

Anastasios Arampatzis reports for Tripwire.com in its official website about the biggest challenges and best practices to mitigate risks in maritime cybersecurity.

Lets look at the essential factors that are crucial in strengthening the cybersecurity of Maritime Industry.

Maritime industry a target for cyber attackers

With more than 90% of the world’s trade being carried by shipping, according to the United Nations’ International Maritime Organization, the maritime industry is an attractive target for cyber attackers.

The European Union has recognized the importance of the maritime sector to the European and global economy and has included shipping in the Network and Information Systems (NIS) Directive, which deals with the protection from cyber threats of national critical infrastructure.

Ships rely on information and technology

Ships are increasingly using systems that rely on digitalization, integration, and automation, which call for cyber risk management on board.

The convergence of information technology (IT) and operational technology (OT) onboard ships and their connection to the Internet creates an increased attack surface that needs to be addressed.

Challenges in Maritime Cybersecurity

The evolution of digital and communications technology has allowed the integration of these two worlds, IT and OT.

The IT world includes systems in offices, ports, and oil rigs, OT is used for a multitude of purposes such as controlling engines and associated systems, cargo management, navigational systems, administration, etc.

Adjunct Professor at the Hellenic American University says, “Maritime industry, especially through vessels digitalization and with the numerous different Operational Technology devices deployed, creates a digital landscape previously unknown to a big extent due to the specific hardware and software being used. New security risks will be evolved with the impact being very significant mainly due to the direct connection with the physical world and the consequent operational damage.”

The maritime OT world includes systems like:

• Vessel Integrated Navigation System (VINS)
• Global Positioning System (GPS)
• Satellite Communications
• Automatic Identification System (AIS)
• Radar systems and electronic charts

These technologies and systems provide significant efficiency gains for the maritime industry.

They also present risks to critical systems and processes linked to the operation of systems integral to shipping.

These risks may result from vulnerabilities arising from inadequate operation, integration, maintenance, and design of cyber-related systems as well as from intentional and unintentional cyberthreats.

To address the cyberthreats, it is important to consider the uniqueness of OT systems, as these assets control the physical world. There are certain challenges to consider, such as:

• OT systems are responsible for real-time performance, and response to any incidents is time-critical to ensure the high reliability and availability of the systems.
• Access to OT systems should be strictly controlled without disrupting the required human-machine interaction.
• Safety of these systems is paramount, and fault tolerance is essential. Even the slightest downtime may not be acceptable.
• OT systems present extended diversity with proprietary protocols and operating systems, often without embedded security capabilities.
• They have long lifecycles, and any updates or patches to these systems must be carefully designed and implemented (usually by the vendor) to avoid disrupting reliability and availability.
• The OT systems are designed to support the intended operational process and may not have enough memory and computing resources to support the addition of security capabilities.

Disruption of the operation of OT systems may impose significant risk to the safety of onboard personnel and cargo, cause damage to the marine environment, and impede the ship’s operation.

Safety warning from USCG

In fact, it was only last July that the U.S. Coast Guard issued a safety alert warning all shipping companies of maritime cyber-attacks.

The incident that led to this warning happened in February 2019 when a large ship on an international voyage bound for the Port of New York and New Jersey reported “a significant cyber incident impacting their shipboard network.”

The Coast Guard led an incident-response team to investigate the issue and found that “although the malware significantly degraded the functionality of the onboard computer system, essential vessel control systems had not been impacted.”

A series of incidents

• This was not the first time the U.S. Coast Guard had released a cyber safety warning.
• In May 2019, they published a bulletin to raise the awareness of maritime stakeholders of “email phishing and malware intrusion attempts that targeted commercial vessels.”

A cyber incident in ships might have severe consequences for the crew, the passengers, and the cargo on board.

Considering that many ships carry harmful substances, a cyber incident might have severe environmental consequences or might lead to hijacking the ship to steal the cargo.

The Baltic and International Maritime Council (BIMCO) has defined a cyber safety incident any incident that leads to “the loss of availability or integrity of safety critical data and OT.”

Cyber safety incidents can be the result of:

• a cyber security incident, which affects the availability and integrity of OT (for example, corruption of chart data held in an Electronic Chart Display and Information System (ECDIS))
• a failure occurring during software maintenance and patching
• loss or manipulation of external sensor data that’s critical to the operation of a ship including but  not limited to Global Navigation Satellite Systems (GNSS)

Best practices to mitigate maritime cyber threats

In 2017, the International Maritime Organization (IMO) adopted resolution MSC.428(98) on Maritime Cyber Risk Management in Safety Management System (SMS).

The Resolution stated that an approved SMS should consider cyber risk management and encourages administrations to ensure that cyber risks are appropriately addressed in safety management systems.

The same year, IMO developed guidelines that provide high-level recommendations on maritime cyber risk management to safeguard shipping from current and emerging cyber threats and vulnerabilities.

In addition, BIMCO has developed the Guidelines on Cyber Security Onboard Ships, which are aligned with the NIST Cybersecurity Framework.

To achieve this goal, maritime companies should follow these best practices:

• Identify the threat environment to understand external and internal cyber threats to the ship.
• Identify vulnerabilities by developing complete and full inventories of onboard systems and understanding the consequences of cyber threats to these systems.
• Assess risk exposure by determining the likelihood and impact of a vulnerability exploitation by any external or internal actor.
• Develop protection and detection measures to reduce the likelihood and the impact of a potential exploitation of a vulnerability.
• Establish prioritized contingency plans to mitigate any potential identified cyber risk
• Respond and recover from cyber incidents using the contingency plan to ensure operational continuity.

“Maintaining effective cybersecurity is not just an IT issue but is rather a fundamental operational imperative in the 21st century maritime environment,” said the U.S. Coast Guard in their July 2019 security warning.

Did you subscribe to our daily newsletter?

It’s Free! Click here to Subscribe!

Source: Tripwire

Despite the recent years’ NSA spying revelations, numerous international malware attacks and North Koreas’ hacking of Sony Pictures, maritime cyber-security is not an issue at the forefront of many ship-owners and managers minds.

However, whilst the maritime industry might not seem a likely target, reports of successful cyber-attacks are not unknown. Take, for example, the Port of Antwerp, where hackers working with a drug-smuggling gang repeatedly breached digital tracking systems to locate containers holding large quantities of drugs. They then dispatched their own drivers to retrieve the containers ahead of the scheduled collection time.

After two years, the operation was eventually shut down and there were no major repercussions for the Port of Antwerp or the companies involved. However, according to security experts at Trend Micro, these companies were extremely fortunate. Using the same techniques, it would not be difficult for criminals to cause chaos at sea. By simply accessing and manipulating a vessel’s AIS, hackers could prevent ships from providing movement information, cause AIS users to detect vessels in false locations or make “phantom” structures or vessels appear.

Other examples of an industry at risk include a drilling rig being hacked and forced to suspend operations, as well as a container line’s entire database of cargo information, including container number, location, place of origin, being erased. Furthermore, instances of maritime and offshore companies that have potentially fallen victim to cyber-attacks may be under-reported, as companies may fear appearing to have allowed confidential information to be compromised.

While maritime cyber-security is an issue that falls outside MTI’s traditional domain, we are in a position to use our platform to raise awareness of the issues at the executive level. Adopting good “cyber-hygiene” will dissuade opportunistic attacks and prevent accidental security compromises.

Developing and implementing such policies will require a top down approach within a company. At the most basic level a company should:

•             Set strong user access controls

•             Set strong network access controls

•             Perform regular backups

•             Keep software up to date

Training employees on how to recognize cyber-attacks and implementing policies on computer hard-ware usage, particularly the use of USB memory sticks, are further steps a company should consider.

Doing what you can to secure your networks and taking the time to integrate cyber-security into your risk management and crisis communications procedure, are the two most strategic things you can do to ensure you can respond effectively to maritime cyber-security threats and in doing so, protect your reputation as a secure service provider.

Source: mtinetwork

ENISA has published the first EU report ever on cyber security challenges in the Maritime Sector. This principal analysis highlights essential key insights, as well as existing initiatives, as a baseline for cyber security.

The high-level recommendations are given for addressing these  risks, Cyber threats are a growing menace, spreading to all industry sectors that relying on ICT systems. Recent deliberate disruptions of critical automation systems, such as Stuxnet, prove that cyber-attacks have a significant impact on critical infrastructures. Disruption of these ICT capabilities may have disastrous consequences for the EU Member States’ governments and social wellbeing. The need to ensure ICT robustness against cyber-attacks is thus a key challenge at national and pan-European level.

Some key findings of the report

• Maritime cyber security awareness is currently low, to non-existent. Member States are thus highly recommended to undertake targeted maritime sector awareness raising campaigns and cyber security training of shipping companies, port authorities, national cyber security  offices, etc.
• Due to the high ICT complexity, it is major challenge to ensure adequate maritime cyber security. A common strategy and development of good practices for the technology development and implementation of ICT systems would therefore ensure “security by design” for all critical maritime ICT components.
• As current maritime regulations and policies consider only physical aspects of security and safety, policy makers should add cyber security aspects to them.
• We strongly recommend a holistic, risk-based approach; assessment of maritime specific cyber risks, as well as identification of all critical assets within this sector.
• As maritime governance is fragmented between different levels (i.e. international, European, national), the International Maritime Organisation together with the EU Commission and the Member Statesn should align international and EU policies in this sector.
• Better information exchange and statistics on cyber security can help insurers to improve their actuarial models, reduce own risks, and thus offering better contractual insurance conditions for the maritime
  sector. Information exchange platforms, such as CPNI.NL, should be also considered and by Member States to better communications.

Source: enisa.europa

Namely, the top priority in the following year would be the implementation of cyber security measures as vessels are more and more connected and further integrated into corporate IT networks.

In addition, in the new year, shipping companies will assess their risk exposure and develop measures to include in their Safety Management Systems to mitigate cyber threats. The owners are called to not only to be in line with IMO’s regulations, -coming into force in January 2021- but to also ensure their assets, IT and operational technology is protected from rising cyber threats.

Year 2020 will bring many changes in the spotlight of the shipping industry, highlighted by IMO’s Sub-Committee on Navigation, Communications and Search and Rescue (NCSR) meetings on 13-24 January to discuss progress on modernising the Global Maritime Distress and Safety System (GMDSS) and performance standards for navigational and communication equipment.

The meeting will focus on improving Inmarsat’s GMDSS services and will continue with the implementation of IMO’s e-navigation strategy. The sub-committee will discuss the feedback from joint working groups on harmonising aeronautical and maritime search and rescue, and from International Telecommunications Union’s group on maritime radio-communications matters.

2020 will also focus on developing regulations about testing and operating maritime autonomous surface ships (MASS).

One of the first tests for MASS will come in September 2020 when Mayflower Autonomous Ship attempts the world’s first unmanned transatlantic crossing from the UK to Plymouth in the US.

Source: safety4sea

Cyber security threats have grown in reach and complexity. As a consequence, cyber security has become a concern and should be considered as an integral part of the overall safety management in shipping and offshore operations. With multifaceted vulnerabilities and cyber-attack scenarios (intended or unintended), the answer to cyber security lies in a multifaceted approach to manage risks.

DNV GL uses a systematic approach to assess the cyber security of vessels and their interaction with onshore stakeholders. Best practices from risk management in oil & gas, maritime and energy applications come together to identify threats and build counter-strategies, looking at both technical and behavioural aspects.

Proven cyber security management approaches look at:

• Raising the awareness of all stakeholders, including onshore personnel and offshore crews
• Assessing and implementing defensive and reactive countermeasures
• Monitoring and reviewing effectiveness and robustness of barriers, emphasising continuous improvement

Our approaches address information technology (IT) as well as the industry-specific operational technology (OT) systems. Our range of services and solutions include:

• Organisational and technical gap assessments: According to your needs to reach compliance with regulations and standards (e.g. IMO Resolution MSC.428(98), DNV GL’s Cyber Secure Class Notation, ISO/IEC 27001, NIST Cybersecurity Framework, TMSA 3, GDPR) our cyber security experts  will engage with your onshore personnel and offshore crews to check written and unformal praxis of your company and vessels;
• Cyber risk assessment: Our interdisciplinary teams engage with your onshore personnel and offshore crews to identify and address your cyber security risks via various levels of assessment; starting with a high-level self-assessment through an App on Veracity – My Services, to more detailed assessments tailored to your specific business risks.  
• Assessment of ships in operation – We provide cyber security assessment & testing onboard your vessels, including visual inspection of the systems and their surroundings, interviews with crew members and testing of systems and networks. 
• Cyber security enhancement – Based on a systematic assessment, we help you efficiently close cyber security gaps by supporting the development of improvement plans, looking at systems, the human factor and management procedures. 
• Penetration testing – Testing the robustness of your barriers is essential to ensure that your assets are secure. Our penetration testing offer comprehensive and effective validation of your systems and procedures.
• Verification for newbuilds and ships in operation – We provide third-party verification of cyber security requirements throughout the life cycle of a vessel towards the compliance with DNV GL’s Cyber Secure Class Notation or letter of compliance for other classed vessels.
• Training – Our (online) classroom training covers general awareness, management, technical and hacking lessons. Our e-learning solution can be performed on board or in the office, so your crews can address pivotal aspects of any cyber security system – covering the human factor.
• Emergency response exercise – In order to be better prepared for an incident we help you with executing desktop exercises both onboard and onshore to train and verify effective communication, response and recovery activities.
• ISO/IEC 27001 preparedness – DNV GL Maritime assesses and help you improve the existing documentation to help you prepare for certification.  
• Certification – DNV GL Business Assurance certify against ISO/IEC 27001 and ISO 22301. 

Be on the safe side of cyber security with DNV GL:

• Combining traditional IT security best practices with in-depth understanding of maritime operations and industrial automated control systems
• Local and international experts draw on extensive knowledge and experience in cyber security risk management, maritime operations and the human factor
• All testing and recommended mitigation measures are tailored to specific maritime needs

Source: dnvgl