MARITIME CYBER SECURITY Archives - Page 29 of 40 - SHIP IP LTD

ZIM has partnered with Konfidas, a cybersecutiy expert, to establish ZKCyberStar, a new subsidiary company offering a full range of cybersecurity services, tailor-made for the maritime industry, to increase cyber readiness and ensure business continuity in the event of cyber-attack.

The ever-growing threat of cyber-attack on the maritime industry has only been magnified by the Covid-19 pandemic. At the same time, the industry’s ongoing digitization of its business processes has increased their exposure to cyber-attack. ZKCyberStar will provide a suite of services to support operational cybersecurity readiness, including cyber and regulatory postures, strategy and planning, cyber awareness and executive training, incident response capabilities, supply chain risk management, ongoing threat intelligence and regulatory alerts and briefs. The ZKCyberStar solution employs a unique methodology designed and developed specifically to achieve maximal readiness for and protection against maritime cyber-attack.

ZKCyberStar will be led by Ronen Meroz as CEO, Ram Levi and Eli Zilberman Caspi. Ronen is currently ZIM Global Intermodal Division Manager, a ZIM senior manager with extensive knowledge of the maritime industry. Ram is an international cybersecurity expert, public speaker and advisor to global organizations on cybersecurity. Eli is Co-Founder and COO of Konfidas and an expert on business continuity readiness for cyber-attacks and cyber incident response management.

“ZIM is uniquely positioned to tackle cyber threats in our industry. In recent years, I was approached by global companies seeking advice regarding cyber threats, and I have decided to create ZKCyberStar to support and advise organizations in our industry, using our long-standing cooperative relationship with the top cybersecurity expert team of Konfidas,” said Eli Glickman, President & CEO of ZIM. “With the creation of ZKCyberStar, we join forces to offer the most advanced and skilled services to cope with cyber threats and mitigate the risks and costly impact of cyber-attacks. We welcome Ram Levi, Eli Zilberman Caspi and the team of professionals at Konfidas to jointly create a top-level consulting company to help the industry cope with cyber threats.”

“The maritime and logistics industries have witnessed an unprecedented rise in cyber-attacks in recent years. Those attacks serve as a wake-up call for an industry which is critical to modern trade and commerce. As we move towards heavily networked and increasingly automated systems, cybersecurity must be a top priority,” said Raif Ram Levi, Founder & CEO of Konfidas. “Our unique partnership with ZIM, a global leader in container shipping, will enable ZKCyberStar to provide strong client-driven cybersecurity solutions with global expertise and implementation.”

About ZIM

Since 1945, ZIM has been providing creative operational and logistical solutions to customers. Over the years, ZIM has grown to become a leading force in the shipping industry by pioneering innovative technologies and expanding its vast geographical network while maintaining its tradition of excellence.

About Konfidas

Konfidas is a Tel Aviv-based boutique consulting firm specializing in a multi-disciplinary approach to cybersecurity. Our experts combine a proactive offense-directed mindset with a pragmatic defense-based approach to enhance organizational cybersecurity preparedness and incident response (IR). The company was established in 2013 with the goal of providing best-in-class cybersecurity consulting and related services to medium and large organizations.

Source: supplychainbrain

Shipping executives are particularly adept at risk management. They regularly have to navigate unpredictable weather systems, climate change, persistent piracy, evolving geopolitical tensions, commodity price and forex fluctuations. They place faith in around 20 seafarers to operate each vessel worth tens of millions, in environments that would be challenging to reach quickly in an emergency. But cyber risk is new territory. And many don’t really know whether their organisation is ready to manage a cyber incident.

One way to prepare your organisation for a cyber attack is to set up a cyber drill. Here’s how to set one up with your own management team that can help improve your organisation’s cyber readiness. Register here for a free consultation with our team of experts on how to design and optimise a cyber drill and improve boardroom awareness of cyber risk.

So it has happened…

The screens on the business PCs in the engine control room and bridge have all locked down. The computers are simply displaying a black screen with a blank pop up window. No text. There is no ransom note (yet). One of the ECDIS systems is also no longer functioning properly and keeps restarting randomly.

The vessel has entered US waters and a pilot has boarded to bring the vessel into safe harbour. The crew have also received notification from the US Coast Guard of their intention to dispatch an inspector and are anticipating a Port State Control examination when the vessel is in port.

The master is on the phone to the Technical and IT Managers, trying to follow instructions in order to rapidly diagnose the problem. But the phone line isn’t great at the moment as the vessel is currently in a position with poor connectivity. In his mind, he is working out the best way to explain what is happening to the authorities, while trying to make up contingency plans on the fly. The pressure is on to avoid a detention.

This scenario is entirely plausible from 1 January 2021 when the cyber security requirements set out in IMO 2021 becomes effective and as cyber attacks on shipping operations continue to increase.

A false sense of readiness and resilience in shipping

“We thought we were prepared for a cyber attack and then we got a nasty surprise when one actually occurred.” This is a common reaction of those who have lived through a cyber attack.

Based on CyberOwl’s experience engaging with nearly 100 fleet operators, less than 5% of them would be able to answer a few fundamental cyber security questions when they are under pressure during a high profile cyber incident, such as: “what is actually happening to the onboard systems?”, ”are we sure we have been cyber attacked?”, “will it spread and how do we stop it spreading?” and “how quickly can we recover operations?”

This is before the more complicated questions that come later during forensic analysis, such as: “what has been the full scale of the impact of the cyber attack?”, “what systems have been compromised?”, “how did the attack actually happen?” and “how do we prevent the same attack in future?” In fact, there are some security teams that never properly answer these latter questions.

If you’re the Fleet IT Manager, scrambling around trying your best to quickly put fires out during such a cyber incident is not going to be a fun day at the office. One of the key decisions you are going to have to quickly make is whether you should be reporting the incident to the leadership team. If so, when do you report it and what do you say? Then, how regularly do you update them?
Effective cyber risk management approach actually starts with the leadership

Recent IMO guidelines and The Guidelines on Cyber Security Onboard Ships (version 3 produced by BIMCO et al) makes it very clear that “effective cyber risk management should start at the senior management level”.

Industry leaders in other sectors all concur. According to the annual Global Risks Report 2020 by the World Economic Forum (WEF), cyber-attacks pose an existential risk (just below climate change in terms of likelihood) to organisations the world over.

Developing emergency response plans with senior management early means you’ll already know what information they expect and when.
How does your leadership team perceive the level of cyber risk?

Siraj Shaikh, our Chief Scientist, and Kristen Kuhn, a Researcher at Coventry University, are working on an initiative addressing Cyber Readiness for Boards (CRfB) to uncover this, supported by the UK’s National Cyber Security Centre (NCSC) and the Lloyd’s Register Foundation. Initial findings suggest:

a key factor that drives a leadership team’s cyber risk perception is their trust in their organisation’s ability to respond to it. If you’re a Fleet IT Manager, that’s you and your team. And in many cases, this is likely to be overly-optimistic. Certainly, the ability to handle a cyber attack is rarely stress-tested in shipping, unlike in some other sectors .

the current focus for the shipping sector is on compliance. While timely, this doesn’t suffice to actually address cyber risk.

the responsibility for cyber risk still rests too heavily on IT or HSSEQ Managers.

Instead, cyber risk needs to be owned and managed as a core business risk, with ultimate accountability at the leadership level. If you are the IT or HSSEQ Manager shouldering that perceived responsibility, it is in your interest to get your leadership team to understand that.

What does a cyber-ready leadership team look like? The leadership team needs to more clearly understand the cyber risks the organisation faces, ensure there is sufficient budget to ensure cyber resilience and set clear roles and responsibilities to preserve business continuity. This includes knowing what their roles are during a cyber attack crisis.

This is where cyber drills are useful

The concept of a drill isn’t new to shipping. Safety drills have long been a requirement either by legislation or as part of a ship manager’s Safety Management System (SMS).

A scenario-based cyber exercise provides an ideal means for leadership teams to engage with and to rehearse for an effective response to a potential cyber-attack. The scenarios offer a creative license to run through both common incidents and also simulate low probability, high impact situations (also known as ‘black swan’ events). It is easy to write off the need to prepare for such black swan events. And yet, COVID-19 shows us how the lack of preparedness may pose an existential threat to an organisation. Indeed, other sectors have shown how ‘doomsday exercises’ have been important to them to cope with the current crisis.

Ultimately, the goal here is to build increased awareness and understanding of cyber risks in your leadership team. It prepares them for when (rather than if) a cyber attack occurs. The drill also helps you identify ways to improve your organisation’s ability to execute effective mitigation strategies.

How would they react?

What information would they need to make decisions?

Who do you need to communicate with and when?
Designing and running an effective “boardroom cyber drill”

Leverage IMO 2021 as an opportunity to encourage a drill. The upcoming deadline of 1 January 2021 to address cyber security as part of the SMS is an ideal opportunity to get senior buy-in. It brings with it direct responsibility for the board on cyber readiness. In fact, being able to demonstrate specific initiatives, such as a boardroom cyber drill, driving cyber readiness is part of evidencing a robust cyber risk management system.

Focus on business risks, not just technology risks. Gain clarity on what risks you want to raise and those that have a significant impact on your organisation. You can then link technology-related and cyber attack events back to those business risks; this is a key tip to designing meaningful scenarios for the drill. A structured mapping of business risks could be a useful resource for this purpose: the Cambridge Business Risk Hub provides a Taxonomy of Business Risks serving as a useful guide for such scenario writing, covering financial, governance, geopolitical, technological and environmental risks.

Do not focus purely on black swan events. While meaningful lessons can be gained from testing an extreme scenario, focusing the drill solely on such doomsday events may be counterproductive and lead your management team to conclude that cyber attacks are unlikely to impact your organisation. Consider an escalating drill that incorporates more commonplace cyber attack events.

Contextualise the drill to your organisation. The scenarios need to be customised to meet the specific practices of your organisation. Do you technically manage your fleet and crew directly, or is some or all of it outsourced? What type of cargo, voyages and ports of entry are involved? How do the responsibilities and liabilities in the charterparty work? While the drill should be grounded in deep expertise in cyber security and organisational resilience, ultimately the scenarios need to be made accessible for the leadership team (in terms of content, format and presentation). It is also important to consider whether there are suppliers and partners that need to participate in the drill.

Collect and visualise some hard data and metrics. This will help you demonstrate cyber security weaknesses and visualise this to the board after the drill. It will also set a baseline for improvement. Critical dimensions to measure include:

How long did each part of the incident response take? There is no right answer for how long response should take, but measuring this sets up a discussion on how much risk the leadership team are willing to live with. If the drill is a tabletop exercise and measuring response times is not possible, then consider getting the participants to estimate how much time each response action is likely to take, challenging them on how realistic their answers are.

How clear were the roles and responsibilities during the drill? This is often where interesting debates and tension points can develop. Especially when there is a lack of clarity.

How clear were the lines of communication? Record what information is given to whom and when. This can be used later to improve protocols for communication.

What were the main gaps of information? Ask any executive that has lived through a cyber attack incident and they will tell you that the first three questions are normally: ”are we sure we have been attacked?”, “how badly are we affected?”, “how quickly can we recover?” Use the drill to discover how easily you can gather this intelligence.

Plan enough time to gain consensus on the lessons learnt. The key here is to capture insights from the discussions and tension points through the drill, which could later be a source of strategic guidance for the organisation to achieve operational cyber resilience. Consider using the metrics above to develop team report cards. These can then be referenced in future once incident response processes have been improved.

Document a report of the drill. The exercise and the lessons they derive should form part of your cyber risk management approach and SMS. The report may also serve as useful evidence for inspections and to build reputation with customers, demonstrating that you are taking proactive steps to managing cyber risks.
Source: CyberOwl

“Fraudulent emails designed to make recipients hand over sensitive information, extort money or trigger malware installation on shore-based or vessel IT networks remains one of the biggest day-to-day cyber threats facing the maritime industry.”

Dryad Global’s cyber security partners, Red Sky Alliance, perform weekly queries of  backend databases, identifying all new data containing Motor Vessel (MV) and Motor Tanker (MT) in the subject line of malicious emails.  Email subject line Motor Vessel (MV) or Motor Tanker (MT) keyword usage is a common lure to entice users in the maritime industry to open emails containing malicious attachments.

With our cyber security partner we are providing a weekly list of Motor Vessels where it is observed that the vessel is being impersonated, with associated malicious emails.

The identified emails attempted to deliver malware or phishing links to compromise the vessels and/or parent companies.  Users should be aware of the subject lines used and the email addresses that are attempting to deliver the messages.

Malicious Email collectino 22 Aug-29 Aug 2020

I

Top 5 Malicious Senders

In the above collection, we see malicious actors attempting to use vessel names to try to spoof companies in the maritime supply chain. This week we observed a wide variety of maritime-related subject lines. Some of the new vessel names used this week include “MT Tiger Spring” and the “MV Glory Forwarder” among others. Analysts continue to see multiple malicious emails from different senders using “JEBEL ALI LCL SHIPMENT” as part of the subject line. It is still unclear why this specific port is being leveraged in malicious email subject lines, but the specific use of “LCL” (Less than a Container Load) is appearing more often in malicious email subject lines.

Analysts observed the malicious subject line “Mix container 2 purchase orders” being used this week. This email appears to be a purchase order coming from a German food company to a Korean marine company. Emails coming from foreign countries can prevent a targeted victim from becoming immediately suspicious when there is incorrect spelling and/or grammar in the malicious email.

The malicious email appears to be sent from “kelly.mfc.china[at]mikado-foods[.]de” which does not appear anywhere publicly in open source data. However, Mikado Foods has “bonnie.mfc.china[at]mikado-foods[.]de” listed as a contact for Mikado Foods China Co., Ltd. The malicious sender appears to have sent malicious emails in July 2019 as well. At that time, attackers were targeting a Belarusian Bank BelVEB OJSC. The sender does not have any name listed in the email signature, only contact details.

Notably, the email greets the specific target by their name which makes it more likely that this is a spearphishing attack. In the email message, the attacker tells the target to find 2 attached purchase orders, but there is only one attachment. The email also instructs the target to “please load (the first purchase order) and then (the second purchase order).” Often malware works in stages, so it is possible the attackers are attempting to get the target to activate the malware in a certain order.

The targeted email address does not appear publicly in open source. The targeted domain is used by Argo Marine Total, which is a maritime inspections and logistics company out of Korea. It also does not clearly indicate which department/division the email would be sent to. It is common for these types of malicious “purchase orders” to target the billing/accounting department to steal sensitive data or commit other cyber-attacks against the company.

If the target were to open the document titled, “M I K A D O® foods.doc,” they would activate HEUR:Exploit.MSOffice.Generic malware on their machine which in this case exploits CVE-2017-11882. This is one of the most common observed exploits leveraged by attackers. The malware can surreptitiously receive commands from a command and control server run by attackers. Using this access, attackers can exfiltrate sensitive company information including passwords, and financial data.

Analysts observed another malicious email subject line being used “RE: Request flight booking for MV. SEA FUTURE off signers at INCHEON, KOREA.” This email is disguised as a “flight booking” request for the MV Sea Future off signers. This is likely a reference to travel arrangements for crew changes. Due to CoViD-19, this type of request would not be completely uncommon. This vessel is currently in the East China Sea.

The email is being sent from “Ms. San San” at accounts2[at]princehr[.]com. Prince HR Services is a staffing service based in Delhi, India. The sending email does not appear in the Red Sky Alliance breach data, so it is more likely that this user is being spoofed. The email seems relatively professional and addresses “Ms. So Mi” which indicates this is a targeted attack as opposed to a spam campaign template which typically addresses “Dear Sirs/Ma’am.” Because of COVID-19, international crew changes has been a contentious issue and is a very good lure.

The referenced document is titled “661081608860286.doc.” When opened, the file activates TrojanDownloader:O97M/Emotet!rfn which installs the infamous Emotet malware. Red Sky Alliance continues to observe an increase in Emotet activity since July. First identified in 2014, this malware can steal sensitive banking, financial, and user information including passwords. As with many of the Emotet samples observed, the malware deletes the original Word document to make detections more difficult.

The target email is “crew[at]withuskor[.]com”, yet is specifically addressed to “Ms. So Mi.” Analysts were unable to find this particular employee listed anywhere in open source. Often attackers will target users with elevated privileges, but in the case of Emotet malware, the attackers are often looking for employees with access to financial data in order to steal the data and turn a profit.

These analysis results illustrate how a recipient could be fooled into opening an infected email.   Doing so could cause the recipient to become an infected member of the maritime supply chain and thus possibly infect victim vessels, port facilities and/or shore companies in the marine, agricultural, and other industries with additional malware.

Fraudulent emails designed to make recipients hand over sensitive information, extort money or trigger malware installation on shore-based or vessel IT networks remains one of the biggest day-to-day cyber threats facing the maritime industry.  These threats often carry a financial liability to one or all those involved in the maritime transportation supply chain.   Preventative cyber protection offers a strong first-line defence by preventing deceptive messages from ever reaching staff inboxes, but malicious hackers are developing new techniques to evade current detection daily.  Using pre-emptive information from Red Sky Alliance-RedXray diagnostic tool, our Vessel Impersonation reports, and Maritime Blacklists offer a proactive solution to stopping cyber-attacks.    Recent studies suggest cyber-criminals are researching their targets and tailoring emails for staff in specific roles.  Another tactic is to spoof emails from the chief executive or other high-ranking maritime contemporaries in the hope staff lower down the supply chain will drop their awareness and follow the spoofed email obediently.  Analysts across the industry are beginning to see maritime-specific examples of these attacks.

Pre-empt, don’t just defend

Preventative cyber protection offers a strong first-line defense by preventing deceptive messages from ever reaching staff inboxes, but malicious hackers are developing new techniques to evade current detection daily. Using preemptive information from Red Sky Alliance RedXray diagnostic tool, our Vessel Impersonation reports and Maritime Blacklists offer a proactive solution to stopping cyber-attacks. Recent studies suggest cyber-criminals are researching their targets and tailoring emails for staff in specific roles. Another tactic is to spoof emails from the chief executive or other high-ranking maritime contemporaries in the hope staff lower down the supply chain will drop their awareness and follow the spoofed email obediently. Analysts across the industry are beginning to see maritime-specific examples of these attacks.

Source: Dryad Global

ZKCyberStar will provide cyber security solutions, guidance, methodology and training to the maritime industry. This comes as shipowners need to comply with changes in ship safety management systems as required through amendments to IMO’s ISM Code, which come into effect from 1 January 2021.

The company was formed in response to growing threats to shipping companies from cyber attacks, such as the attack on the Carnival group in August.

Zim, which operates a fleet of container ships, is deploying its experience and long-standing co-operation with cyber-security experts Konfidas to establish ZKCyberStar.

This will increase cyber readiness and ensure business continuity for shipping lines in the event of a cyber attack and provide cyber risk management to help shipowners protect their business from cyber events.

These are becoming more frequent in the maritime industry as owners, operators and managers adopt digitalisation on ships.

ZKCyberStar will provide services to support operational cyber-security readiness, including cyber and regulatory postures, strategy and planning, awareness and executive training.

It will provide response capabilities, supply chain risk management, ongoing threat intelligence, regulatory alerts and briefings.

ZKCyberStar will be led by Zim global intermodal division manager Ronen Meroz as chief executive, international cyber-security expert Ram Levi and Konfidas co-founder and chief operating officer Eli Zilberman Caspi.

Zim president and chief executive Eli Glickman said ZKCyberStar was formed because of the growing importance of cyber security to shipping lines. “We are uniquely positioned to tackle cyber threats in our industry,” he said. “In recent years, I was approached by global companies seeking advice regarding cyber threats.

“I decided to create ZKCyberStar to support and advise organisations in our industry using our long-standing co-operative relationship with the top cyber-security expert team of Konfidas,” said Mr Glickman.

Mr Levi said the maritime and logistics industries have witnessed an unprecedented rise in cyber attacks in recent years.

“Those attacks serve as a wake-up call for an industry that is critical to modern trade and commerce,” said Mr Levi.

“As we move towards heavily networked and increasingly automated systems, cyber security must be a top priority.”

Risks to shipping and ports was discussed in depth during Riviera’s Maritime Cyber Security Webinar Week. Use this link to view these events in Riviera’s webinar library, and this link to view details of upcoming events including a Maritime Cyber Risk Management Forum in November

September 2, 2020: Israeli carrier ZIM has announced the establishment of a new subsidiary company, ZKCyberStar, in co-operation with cybersecurity experts Konfidas.

The new company will offer a full range of cybersecurity services, tailor-made for the maritime industry, to increase cyber readiness and ensure business continuity in the event of a cyber-attack.

ZKCyberStar will provide a suite of services to support operational cybersecurity readiness, including cyber and regulatory postures, strategy and planning, cyber awareness and executive training, incident response capabilities, supply chain risk management, ongoing threat intelligence, regulatory alerts and briefs, and more.

The ZKCyberStar solution employs a unique methodology designed and developed specifically to achieve maximal readiness for and protection against a maritime cyber-attack, according to a statement.

ZKCyberStar will be led by the current ZIM global intermodal division manager, Ronen Meroz as CEO, the international cybersecurity expert and former secretary of the Prime Minister of Israel’s national cyber initiative task force, Ram Levi and the co-founder and COO of Konfidas, Eli Zilberman Caspi.

“I have decided to create ZKCyberStar to support and advise organisations in our industry, using our long-standing co-operative relationship with the top cybersecurity expert team of Konfidas,” commented Eli Glickman, ZIM president and chief executive.

Cyber-attacks have been a long-standing challenge for the industry, which has been magnified by the Covid-19 pandemic, according to ZIM, which believes that the ongoing digitalisation of the maritime industry has increased the sector’s exposure to cyber-attacks that can cause significant disruptions at great cost.

“The maritime and logistics industries have witnessed an unprecedented rise in cyber-attacks in recent years,” Levi agrees and warns, “Those attacks serve as a wake-up call for an industry which is critical to modern trade and commerce.”

Source: Container News

Israeli carrier ZIM is branching out with a new revenue stream, debuting today ZKCyberStar, a cyber security consulting company created in partnership with Tel Aviv-based Konfidas.

Eli Glickman, ZIM president and CEO, commented: “ZIM is uniquely positioned to tackle cyber threats in our industry. In recent years, I was approached by global companies seeking advice regarding cyber threats, and I have decided to create ZKCyberStar to support and advise organisations in our industry, using our long-standing cooperative relationship with the top cyber security expert team of Konfidas.”

Ram Levi, Konfidas founder and CEO, said: “As we move towards heavily networked and increasingly automated systems, cyber security must be a top priority. Our unique partnership with ZIM, a global leader in container shipping, will enable ZKCyberStar to provide strong client-driven cybersecurity solutions with global expertise and implementation.”

Levi is a former secretary of the prime minister of Israel’s National Cyber Initiative Task Force.

Earlier this month ZIM detailed a new artificial intelligence-based screening software it has created to detect and identify incidents of misdeclared hazardous cargo, something it is keen to licence to its peers. It has also been leading the way in developing e-bills of lading for the shipping industry with ZIM president Glickman determined to make the carrier a digital leader among container carriers.

Glickman, who headed up utility Israel Electric before being appointed ZIM boss three years ago, described how he wants to make ZIM “a start up of the container shipping industry” in an earlier interview with Splash.

Israel is already home to one of the best known maritime cyber security consultants, Ra’anana-headquartered Naval Dome.

Among high profile cyber attacks in recent months, Mediterranean Shipping Co (MSC) was struck over the Easter weekend while Australia’s Toll Group has suffered not one, but two hacking incidents this year.

Speaking in the wake of his company suffering its second cyber attack in the space of just three months, Thomas Knudsen, group managing director at Toll, said this May cyber crime posed “an existential threat for organisations of all sizes, making it more important than ever for business, regulators and government to adopt a united effort in combatting the very real risk it presents the wider community”.

The increasing number of cyber incidents against commercial vessels and port authorities has led the US Coast Guard to publish updated guidelines for mitigating cyber risks and vulnerabilities in the shipping sector.

In March 2020, the US Coast Guard issued new “Guidelines for Addressing Cyber Risks at Maritime Transportation Security Act (MTSA)-regulated facilities”. The Guidelines are intended to assist facility owners and operators in complying with the requirements to assess, document, and address system and network risks.

The Maritime Cybersecurity Guidelines were mandated by the increasing number of cybersecurity incidents on shipping companies as well as port facilities. But the root cause behind all US Coast Guard efforts to raise awareness of imminent cyber threats is the expanding maritime cyber threat landscape because of the proliferation of emerging technologies and the digitalization of devices onboard vessels. Heavily digitized vessels introduce new cybersecurity vulnerabilities that increase operational risk.  Exploitation, misuse, disruption, or simple failure of cyber systems can cause injury or death, harm the marine environment, disrupt vital trade activity, and degrade the ability to respond to other emergencies.

The European Union also enforces maritime cybersecurity requirements

These risks are even more crucial to national economies because the shipping sector is part of the national critical infrastructures. For example, the European Union has recognized the importance of commercial vessels to the EU digital market and has mandated the operators and owners of the vessels to abide by the security requirements of the Network and Information Systems Security Directive (NIS Directive).

To address these challenges and risks, national and transnational organizations have developed sets of best practices and recommendations. ENISA, the European Union Cybersecurity Agency, published in November 2019 the report “Port Cybersecurity – Good practices for cybersecurity in the maritime sector.” The United Kingdom Department of Transport released in January 2020 a practice guide on “Cyber Security for Ports and Port Systems.”

Effective maritime cybersecurity is mission-critical 

Today more than ever, Facility operators use computers and cyber-dependent technologies for communications, engineering, cargo control, environmental control, access control, passenger and cargo screening, and many other purposes. Not just operational technologies are computerized but also facility safety and security systems such as security monitoring, fire detection, and general alarm installations increasingly rely on computers and networks.

Maintaining effective cybersecurity is no longer just an IT issue but is rather a fundamental operational imperative in the 21st-century maritime environment.

According to Nir Ayalon, the CEO of Cydome, a maritime cybersecurity solution company, “Commercial vessels can no longer rely on an IT cyber solution and ensure the full coverage on all operational systems to be resilient from cyber-attacks. We at Cydome acknowledged the importance of having a holistic cybersecurity solution to address all risks of highly digitalized vessels and help vessel operators be compliant with cybersecurity requirements. Cydome’s unique cybersecurity solution is positioned on board of both IT and OT systems to provide a wider spectrum of defense against different types of cyber-attacks (both internal and external threats). Clients that use Cydome solution receive a better picture of their current assets onboard and use it to improve the vessel’s cybersecurity and safety at sea”.

The US Coast Guard instructs Commercial vessels’ operators and owners to perform a Facility Security Assessment (FSA) to assess and document risks and cybersecurity vulnerabilities associated with their computer systems and networks. Identifying and assessing cybersecurity vulnerabilities is the foundation of an efficient cybersecurity program. You can’t protect what you don’t know.

When cybersecurity vulnerabilities are identified in the Facility Security Assessment, an owner or operator may demonstrate compliance with the regulations by providing its cybersecurity mitigation procedures in a variety of formats. The information may be provided in a stand-alone cyber annex to the FSP or incorporated into the FSP together with the physical security measures.

While vessel owners need not identify a specific technology or business model, they are required to provide documentation to show how they are addressing the cybersecurity risks identified. Facility operators may elect to demonstrate mitigation of identified vulnerabilities by employing the many available best practices, such as the NIST Cybersecurity Framework.

The ultimate goal of cybersecurity programs in the shipping sector should be cyber resilience, to ensure business continuity and reliable operations even after a cyber-attack. Cyber resilience has emerged over the past few years because traditional cybersecurity measures are no longer enough to protect organizations from sophisticated and persistent cyber-attacks. Both cybersecurity and cyber safety are important because of their potential effect on personnel, the ship, environment, company, and cargo.

Source: informationsecuritybuzz

This circular provides information on the requirement to incorporate maritime cyber risk management in the safety management systems (SMS) of companies operating Singapore-registered ships.

Cyber risk management refers to the process of identifying, analysing, assessing, and communicating a cyber-related risk and accepting, avoiding, transferring, or mitigating it to an acceptable level, considering costs and benefits of actions taken to stakeholders.

Maritime cyber risk refers to a measure of the extent to which a technology asset is threatened by a potential circumstance or event, which may result in shipping related operational, safety or security failures as a consequence of information or systems being corrupted, lost or compromised. The goal of maritime cyber risk management is to support safe and secure shipping, which is operationally resilient to cyber risks.

As affirmed in Resolution MSC.428(98)1, an approved SMS should take into account cyber risk management in accordance with the objectives and functional requirements of the ISM Code2, MPA will require cyber risks to be appropriately addressed in the company’s SMS no later than the first annual verification of the ISM company’s Document of Compliance after 1 January 2021.

In line with the guidance presented in MSC-FAL.1/Circ.3, to consider cyber risks as being appropriately addressed in SMS, the ISM company is required to demonstrate that they have appropriately incorporated the five functional elements to address maritime cyber risks, namely:
a. Identify: Define personnel roles and responsibilities for cyber risk management and identify the systems, assets, data and capabilities that, when disrupted, pose risks to ship operations;
b. Protect: Implement risk control processes and measures, and contingency planning to protect against a cyber-event and ensure continuity of shipping operations;
c. Detect: Develop and implement activities necessary to detect a cyberevent in a timely manner;
d. Respond: Develop and implement activities and plans to provide resilience and to restore systems necessary for shipping operations or services impaired due to a cyber-event;
and
e. Recover: Identify measures to back-up and restore cyber systems necessary for shipping operations impacted by a cyber-event.

ISM companies of Singapore-registered ships are reminded to review the identified risks to its ships, personnel and the environment and to establish appropriate safeguards to ensure that maritime cyber risks are appropriately addressed in the SMS, and that the five functional elements stated in para 5 have been incorporated into their risk management framework.

MPA has co-funded several maritime cyber security courses under Maritime Cluster Fund and Training@MaritimeSingapore. MPA is also aware that Recognised Organisations (ROs) have developed maritime cyber security training courses and relevant consultancy services to assist ISM Companies in developing and preparing their cyber risk management strategy and procedures. Companies may visit www.mpa.gov.sg or approach the ROs for more information on such training and services…

(For information about operations in Singapore, contact GAC Singapore at singapore@gac.com)

Source:  Maritime and Port Authority of Singapore Shipping Circular No.15 of 2020 dated 13 August 2020