As ships get bigger, with more automation, fewer crew members, and more connectivity, the attack surface of a modern commercial vessel is becoming as complex and diverse as that of a connected car or commercial aeroplane.
We have ex-ships officers and engineering staff on the team here, so we have first-hand experience of the unusual networks and communications found on board.
Don’t risk your ships security to a penetration tester that doesn’t understand shipping; we’ve come across other consultancies that have broken critical systems on board whilst trying to test their security, as they simply didn’t understand what they were testing.
What does a ship look like to an attacker?
The complex systems involved in shipping offer rich pickings to the hacker, pirate and thief. Load theft, smuggling stowaways, narcotics, arms, even crippling or sinking a vessel are very real threats.
Maritime insurance often specifically excludes losses as a result of ‘cyber’ incidents, so it’s very important to check your cover.
From satcoms, mobile data and Wi-Fi through to propulsion and loading systems, this is what a hacker sees when they look at a ship. Many of these systems can be comprised, causing financial loss and safety issues.
Tactical Advice
Tens of vendors are involved in connected systems on ships, from Dell providing desktop PCs, to satcoms gear for Internet, chart systems, MMI, control systems, radar systems etc. This is a recipe for security disasters.
Here are a few basic issues you could check for yourself:
Check your satcom terminals for default, weak or blank admin passwords. Make sure the latest software is running on ALL of your terminals.
Check the network isolation and segregation between bridge, engine room, crew, Wi-Fi and business networks.
Check Wi-Fi networks for strong encryption and strong passwords. Make sure that business systems are particularly well protected.
Demand evidence from your technology suppliers that the systems they provide to you are secure. Remember, if you don’t ask for security, you probably won’t get it!
Sit down and think about how you might attack your ships network, given your knowledge of your systems. That’s what the hacker does, so pre-empt them and defend better.
Don’t forget your people. Officers can become fixated on digital navigation systems on the bridge. These can be hacked and manipulated, so don’t forget to look outside.
SHIP IP LTD – Remote internal/external Vulnerability & Penetration Testing
TRUST OUR NETWORK – WE GUARANTEE BEST PRICES!
READ MORE
https://shipip.com/new/maritime-vulnerability-and-penetration-testing/
