Two years to go. The International Maritime Organization (IMO) encourages ship owners and managers to have incorporated cyber risk management into ship safety by the 1st of January 2021. But what does that mean? And how to address maritime cyber risks?
Digitalization
The maritime sector is on the verge of a digital disruption. Digitalization is increasingly considered one of the key solutions to the many significant challenges the sector is facing, ranging from overcapacity, low margins, regulatory pressure, and lack of efficiency, to new digital demands from customers. Although digital transformation of the maritime sector is still in its infancy, it’s safe to assume that digitalization will have a major impact on operations and existing business models in the years to come.
But fast-moving changes do not come without risk. Industrial automation and control systems that were once isolated and deemed secure, are increasingly being connected to corporate networks and the Internet. Individual devices across enterprise Information Technology (IT) and Operational Technology (OT) networks – from smart digital equipment and tools to navigation, engines and more – will present potential new pathways to cyber attacks and incidents on vessels.
First steps towards regulation
This has driven IMO to issue the Resolution on Cyber Risk Management. The resolution “encourages administrations to ensure that cyber risks are appropriately addressed in safety management systems” by 2021.
While that does not sound too obligatory, potential implications of inappropriate cyber risk management are obvious, as it may lead to, for example:
- Increased (unforeseen) expenses;
- Operational loss due to incidents;
- Safety and personnel damage;
- Limited competitive edge.
But potentially, consequences are more widespread. Lack of compliance with these requirements may also lead to increased insurance fees, port access denial and even detention of ships, again meaning huge financial losses for their owners.
It is expected that, though for now just a recommendation, the IMO Guidelines can become the GDPR for the maritime sector: that regulation where noncompliance potentially affects your license to operate – and that regulation that seems difficult to get a grip on.
As cyber security may not be the core business of most maritime organisations, proper guidance on efficiently incorporating cyber risk management is needed. This is where KPMG offers its global expertise on cyber security advisory and digital risk management for the maritime sector.
Addressing cyber risk
KPMG’s solutions aim at letting maritime organisations manage cyber risk in the way that is intended in, for example, the IMO Guidelines on Maritime Cyber Risk Management and the BIMCO Guidelines on Cyber Security Onboard Ships. This includes:
- Identify: To be able to identify and manage risks and turn them into business advantages, you first need to understand your connected landscape and identify the most relevant threats and highest risks for your environment.
- Protect: Once you understand your maritime IT and OT landscape and the impact and risks of the different systems within, you can take appropriate measures to protect it where relevant.
- Detect: Having identified and designed the controls and measures to protect your environment, it is important to monitor them. By monitoring network traffic, logs and end-points, you can better detect cyber incidents.
- Respond: When an incident happens, getting back to business as usual is key for your business continuity and safety. Hence, cyber response processes should be ‘second nature’ for your organization.
- Recover: After the heat of the incident is over, and business is as usual, it is time to gain an understanding of the situation and evaluate the current security measures to prevent similar incidents in the future. At this stage you will need to answer stakeholder questions about the incident and identify lessons learned.
Sailing high wind with cyber security will enable you to harvest benefits from digitalization and reduce unnecessary costs. Today’s cyber risk posture in the maritime sector, as well as upcoming regulations, demand a strong approach towards identifying those cyber risks that matter most, and addressing them in the most cost-effective way. This asks for scalable and data-driven solutions to automatically identify and address risks.
Source: linkedin
