A new report warns of increasing cybersecurity threats to the maritime industry. The Global Maritime Consultants Group’s (GMCG) Marine Cyber Security white paper, published on December 24, warns of attacks which may originate via email, denial of service, impersonation or various other means and sets out measures that the maritime industry can take to protect against and prevent such attacks.

The industry has recognized cybersecurity as a major threat and to some extent is playing catch-up with other industries, particular when compared to other forms of transportation. To help address the need for increased action against cyber attacks, the International Maritime Organisation (IMO) has introduced a new code which from January 1 2021 requires ship owners and managers to assess cyber risk and implement relevant measures across all functions of their safety management system.

GMCG warns that one of the simplest ways of threatening and corrupting a ship’s system is for an employee to open an infected email. “In doing so it can cause the recipient of the targeted email to become an infected member of the maritime supply chain. This can then result in the electronic virus being downloaded and passed on through the systems associated with the ship, its land-based operations and often with financially crippling effects. Most of these fraudulent emails are designed to make recipients hand over sensitive information or trigger malware installation on shorebased or vessel IT networks.”

The report says the first step for ship owners is to have a recognized plan that identifies cybersecurity objectives that are relevant for safe ship operations. “These checks and balances should also encompass anyone connected with the ship’s operations, both in-house and external. It is also vital to create an inventory list of all safety and business-critical systems and software which will be needed in the first instance to define and create a cyber risk assessment.”

Communication systems, ship propulsion and power control systems, cargo management systems, passenger services, and the ship’s bridge system are all vulnerable areas and the report also recommends ensuring that public network connections are kept entirely separate from the ship’s and maritime land-based networks.

A coalition of maritime organizations* recently updated a set of cybersecurity guidelines for the industry. Issued in December, the fourth version of the Guidelines on Cyber Security Onboard Ships includes general updates to best practices in the field of cyber risk management, and as a key feature, includes a section with improved guidance on the concept of risk and risk management. The improved risk model takes into consideration the threat as the product of capability, opportunity, and intent, and explains the likelihood of a cyber incident as the product of vulnerability and threat.

“In recent years, the industry has been subjected to several significant incidents which have had a severe financial impact on the affected companies,” said Dirk Fry, chair of BIMCO’s cyber security working group and Director of Columbia Ship Management Ltd.

“While these incidents have had little or no safety impact, they have taught us some very important lessons which have been incorporated into the new version of the guidelines,” added Fry.

*The following organizations produced the fourth edition of Guidelines on Cyber Security Onboard Ships: BIMCO, Chamber of Shipping of America, Digital Containership Association, International Association of Dry Cargo Shipowners (INTERCARGO), Interferry, International Chamber of Shipping (ICS), INTERMANAGER, International Association of Independent Tanker Owners (INTERTANKO), International Marine Contractors’ Association (IMCA), International Union of Marine Insurance (IUMI), Oil Companies International Marine Forum (OCIMF), Superyacht Builders Association (Sybass), and World Shipping Council (WSC).

Source: hstoday