In many ways the global marketplace has once again become akin to the Wild West. And the bad guys seem to have the advantage.

 

Manufacturing is under attack. Health providers are under attack. Now, global supply chains are under attack. Specifically, the French maritime transport and logistics giant CMA CGM, recently disclosed a malware attack affecting servers on the edge of its network. The attack forced CMA CGM’s IT teams to cut Internet access to some applications to block the malware from spreading to other network devices.

According to Andrea Carcano, co-founder of IT/OT security provider Nozomi Networks, transportation organizations are rapidly evolving to improve their service levels and efficiency. As the same time, safety has never been more important, as risks from cyber threats increase. “Indeed, the World Economic Forum cites cyberattacks on critical infrastructure, including transportation, as the world’s fifth highest risk in 2020. The maritime industry in particular transports 90% of the world’s trade, and like other industries, is becoming increasingly connected, automated and remotely monitored,” says Carcano. “The level of system visibility and cybersecurity maturity in this sector is relatively low. Many ships contain devices and systems that their operators aren’t even aware of. Crews are not typically trained to identify phishing emails or manage network access control. While dramatic situations like a vessel being capsized via hacking are not out of the realm of possibility, they are still unlikely. Crew constantly observe ship behavior and have the ability to employ manual or safety systems to correct performance that is out of normal range. Driven by the needs to reduce risk, comply with international shipping standards, and meet insurer requirements, shipping companies are investing in cyber resiliency.

An important capability lies in identifying maritime assets and their communications, explains Carcano. “Networks should be monitored for vulnerabilities, threats, and unusual behavior that could indicate a cyberattack. Just as water always flows downhill, cybercriminals will always attack at the weakest part of a system,” he says. “The best defense has multiple reinforcing layers. The people using the system are oftentimes the weakest element, opting to click a link in an email that says URGENT or voluntarily giving up their credentials when somebody named IT Support asks nicely.  Make people aware of the threat of phishing attacks by training them to recognize suspicious messages.  Implement two-factor authentication whenever possible to minimize the risk of stolen credentials. Finally, be sure to have a robust response plan in place to contain and sanitize incidents as soon as possible should they happen.”

Armis CISO Curtis Simpson tells IndustryWeek, What makes Ragnar Locker ransomware stand out is that it is purpose built to first find and exfiltrate data accessible by the attackers, followed by encrypting and demanding a ransom for the stolen and encrypted data.

“Victims are notified that failure to pay ransoms will result in data being leaked online and to show that the threat is real, a subset of stolen information is typically posted online as proof. A recent example of such an attack is the CWT ransomware event from earlier this year, which also involved the Ragnar Locker ransomware. Due to the widespread impact and potential for stolen information being leaked if ransoms were not paid, CWT paid $4.5 million in ransom to recover their data and prevent the leak,” says Simpson. “Exfiltrating data and/or compromising devices such as those in our OT/ICS networks as part of a ransomware attack are modern techniques used by attacks to increase the likelihood of their ransom being paid, at least in part.”

 

SHIP IP LTD – Remote internal/external Vulnerability &

Penetration Testing

TRUST OUR NETWORK – WE GUARANTEE BEST PRICES!

READ MORE

Maritime Vulnerability and Penetration Testing

 

Source: industryweek