In recent years, cruise liners and their associated infrastructure rely more heavily on the interconnectivity of IT systems and operational technology (OT) systems, creating a robust digital environment to successfully execute their missions.
However, as ships become “smarter” and more interconnected, the risks of cyber attacks increase, which can negatively impact the business. The U.K. Government’s Transportation Department recently issued a warning in the “Cyber Security for Ships” code of practice in 2017 regarding the growing vulnerabilities in the maritime industry. It stated that computer system hacks could, at worst, endanger human life. If the hack were a terrorist motive, this could certainly threaten lives.
In addition to dangers posed by terrorists, the cruise line’s customer data could be stolen and misused. For example, if passengers’ data, such as a bank card or other personal information, has been uploaded to an online system – perhaps for the purpose of making their stay more personalized and automated – then a data breach of this system could enable criminals to commit identity fraud upon the victims, also causing legal liabilities and reputational risks to the cruise line.
While cruise liners have a proven ability to successfully compete with other holiday destinations, this advantage will quickly diminish if passengers feel unsafe. Clearly, to maintain customer confidence in the cruise lines, it is paramount for maritime enterprises to define a clear and secure strategy relating to IT/OT convergent cyber security.
The maritime industry has previously failed to recognize the risks of cyber attacks. However, as cruise ships becoming floating digital worlds of their own, it is crucial that cruise lines recognize and address the emerging threats and risk outcomes, for the sake of passenger safety and overall industry integrity.
BUSINESS IMPACT /REPORT FOCUS
This Maritime Cyber Threat Intelligence report focuses on the convergence of IT and Operational Technology (OT), and other risks associated with CLIENT, its subsidiaries and its industry competitors. Based on open source intelligence sources and ship visits, CLIENT extensively uses OT systems that are critical to daily operations. In recent times, the vectors of attack relative to the cruise line industry
have expanded from traditional IT systems to the OT attack surface. This trend has materialized because, traditionally, OT devices were (and still are) built with simplicity and functionality in mind, not security. However, due to their criticality for operations, indicators of compromise (IoC) and identified vulnerabilities in OT systems should drive immediate analysis and serious remediation efforts.
Our Fortress IntelX Security Operations Team can confirm, via non-intrusive tests conducted in recent weeks, that possible attacks on OT
network targets can be executed upon the CLIENT infrastructure from third-party network connections. This scenario highlights the need for vigilance in the organization’s “Third-Party Risk Management” efforts (i.e. policies and procedures). CLIENT, its subsidiaries and operating companies, span the globe; therefore, the overall IT/OT technical footprint is extremely large and complex, requiring systems to monitor and manage both Third-Party Risk and associated vulnerabilities in the shipboard and shoreside OT environment.
The tangible effects of a cyber attack or a breach of the OT networks (e.g., system stoppage) could cripple vessels and reduce the company’s profit by millions of dollars per day. Considering multiple subsidiaries and facilities owned by CLIENT, large-scale attacks could cause significant financial and reputational damage to the brand. Also, OT incidents could have a downstream effect in supply chain and distribution networks, further heightening the damage to the company.
THREAT INTELLIGENCE NOTABLE FINDINGS
- Utilizing our cyber threat intelligence tools and processes, our expert analysts monitored and ranked competitors and brands. See Appendix B for details. Highlights of this analysis include the following:
- Breaches occur more frequently within the leisure industry, as indicated by news reports from industry sources. All cruise ships have installed multiple point-of-sale (POS) terminals. If left unsecured (e.g., with no antivirus), accessible to the internet and on a primary infrastructure network, this condition enables a popular attack vector via WiFi hacking or a phishing campaign.
- Maritime OT systems often lack any built-in encryption or authentication codes, which allows attackers to assess cruise ships as a “soft option” for attack, be it for state-sponsored motivations, ransom or just criminal mischief.
- A major misconception with cybersecurity is thinking that proactive security measures are too complicated and expensive; however, this belief shows little understanding of the return on security investment. Also, many people misjudge whether there are adequate safeguards already in place. This misjudgment is fed by a general perception that being the target of a cyber attack is very unlikely – hence they tend to de-prioritize necessary expenditures to apply safeguards. Yet the reality is eye-opening: the exploitation of technology for nefarious means will always take place in some form, be it at sea or on onshore.
SHIP IP LTD – Remote internal/external Vulnerability &
Penetration Testing
TRUST OUR NETWORK – WE GUARANTEE BEST PRICES!
READ MORE
Source: fortressinfosec
