Maritime cyber security, threats, trends, and relevant safeguards
Milan – Even more than within other sectors, across the maritime domain’s evolving landscape of real-time connectivity requirements, which provides data in order to optimize maritime operations and customer experience, there are increasing vulnerabilities onboard vessels, potentially leading to ever more disruptive incidents; in what follows, Giuseppe D’Agostino, Associate Cybersecurity & Privacy Partner at PwC, talks about the subject.
Maritime cyber security
Cyber Security is increasingly becoming a topic of great interest across all economic sectors. After all, the statistics speak for themselves: 30% of businesses believe there’s a high probability they could be target of a cyber attack (source: PwC Digital Trust Insights 2018); proceeds from cyber crime, particularly those of drug smuggling operations, are estimated to be close to 3,000 billion dollars (source: Serious & Organized Crime Threat Assessment); around 15% of companies indicated they had uncovered over 50 cyber incidents over the past year (source PwC Digital Trust Insights 2018), marking a trend that’s on the rise.
Figures regarding the consequences of cyber attacks are equally dire. For instance, data breaches at Yahoo in 2016, and at Equifax in 2017, resulted in 320 million dollars being knocked off its sale price, and in a 32% drop in its share value, respectively. Danish shipping and logistics giant Maersk fared not much better, following an attack employing NotPetya ransomware. It’s estimated that the significant impact on business that followed that incident translated to around $300 million in lost revenue. Analysis of concrete incidents such as these sheds some understanding on the potential economic aspects of a cyber attack, and indeed quantifies them.
The introduction of new technologies has opened new vulnerabilities for enterprises, which, therefore, require innovative approaches to cyber security. An overview of the global picture shows that by 2020 some 50 billion devices will be interconnected (Internet of Things), a trend that is reflected across the maritime domain, with exponential growth expected in the use of wearable devices and integrated sensors; 100% of new cars will, moreover, be connected by 2022; similarly the piece of news that stands out in the maritime sector has to be the upcoming launch of the world’s first autonomous ship, the Yara Birkeland.
Cyber criminals will try to exploit the vulnerabilities that new technologies inevitably carry, and companies are starting to plan for new control regimes as these new developments are rolled out. An analysis of this data clearly shows an increase in vulnerabilities and threats regarding Cyber Security, which results in a need to develop and implement a holistic approach to cyber security incidents, by acting on three separate levels: prevention, identification, and response.
In terms of prevention, for example, it is essential to integrate the principles of security and privacy within evolving business models, such as developing new services and systems (security by-design and by-default). Many studies have shown how the costs for the mitigation of a vulnerability grow exponentially as time elapses; solving a security bug in the development phase, for example, is clearly much easier and cheaper than working on a system in full operation. Another aspect related to the prevention of security incidents concerns external suppliers.
Maritime cyber security
The services provided by companies are becoming increasingly integrated within complex and geographically dispersed value chains, in which relations and data exchanges with third parties assume a predominant role. A company’s security, therefore, hinges on the security of the entire value chain. In addition, less structured suppliers increasingly constitute an entry point for attackers, making no company, however mature, immune from an attack.
No matter how effective the countermeasures implemented may be, it’s essential to be able to detect attacks in a timely manner. An example of how companies are addressing this need is in the setting up of ad hoc structures to perform monitoring and alerting; these structures are usually termed Security Operation Center (SOC) and are responsible for the collection, correlation and analysis of data in order to generate alerts and detect possible security breaches.
The GDPR, particularly the measures concerning data breach (which oblige violations of personal data to be reported within very short times), gives even greater emphasis to the importance of effective monitoring. The response to incidents, that is the containment and restoration of the components impacted, is crucial for damage containment. It is important to make use of adequate professional skills that can contain the incident quickly, ensure the collection of exhaustive data that can stand up in court, and understand the root cause as soon as possible, to ensure that it will not happen again in the future (lesson learned).
Figures show that in this context there are considerable possibilities for improvement, given that it’s estimated that, on average, it takes 197 days time to identify a data breach, and 69 days to contain it (source: 2018 IBM – Cost of a Data Breach Study). The growth in threats and attacks has made cyber threats one of the top 5 priorities for CEOs. In fact, firms often feel unprepared, and 57% of firms in Italy consider action in the field of Cyber Security & Data Protection a priority (source PwC Digital Trust Insights 2018).
In conclusion, the following 5 basic steps should form the basis of a strategic security program: 1. Ensure that Cyber Security strategy is aligned with business objectives and is adequately supported by the company management. 2. Identify the most critical data resources, and prioritize investments through risk analysis to anticipate threats. 3. Be aware of threats (Intelligence), their motivations, resources and methods of attack, to reduce the time between detection and response to an incident 4. Evaluate Cyber Security of third parties and partners across the value chain, ensuring compliance with security policies and procedures 5. Provide training for employees and collaborate with others to raise awareness of Cyber Security threats and response techniques. Increasing knowledge and understanding of the threats and actions to be taken will allow companies and enterprises to improve their resilience. The ability to respond effectively to these challenges will increasingly be a key distinguishing factor in the future, which will reward companies able to provide reliable cyber-ready services on the market, thus turning measures aimed at avoiding risks into true business opportunities.
Maritime cyber security, threats, trends, and relevant safeguards
