Despite the recent years’ NSA spying revelations, numerous international malware attacks and North Koreas’ hacking of Sony Pictures, maritime cyber-security is not an issue at the forefront of many ship-owners and managers minds.
However, whilst the maritime industry might not seem a likely target, reports of successful cyber-attacks are not unknown. Take, for example, the Port of Antwerp, where hackers working with a drug-smuggling gang repeatedly breached digital tracking systems to locate containers holding large quantities of drugs. They then dispatched their own drivers to retrieve the containers ahead of the scheduled collection time.
After two years, the operation was eventually shut down and there were no major repercussions for the Port of Antwerp or the companies involved. However, according to security experts at Trend Micro, these companies were extremely fortunate. Using the same techniques, it would not be difficult for criminals to cause chaos at sea. By simply accessing and manipulating a vessel’s AIS, hackers could prevent ships from providing movement information, cause AIS users to detect vessels in false locations or make “phantom” structures or vessels appear.
Other examples of an industry at risk include a drilling rig being hacked and forced to suspend operations, as well as a container line’s entire database of cargo information, including container number, location, place of origin, being erased. Furthermore, instances of maritime and offshore companies that have potentially fallen victim to cyber-attacks may be under-reported, as companies may fear appearing to have allowed confidential information to be compromised.
While maritime cyber-security is an issue that falls outside MTI’s traditional domain, we are in a position to use our platform to raise awareness of the issues at the executive level. Adopting good “cyber-hygiene” will dissuade opportunistic attacks and prevent accidental security compromises.
Developing and implementing such policies will require a top down approach within a company. At the most basic level a company should:
• Set strong user access controls
• Set strong network access controls
• Perform regular backups
• Keep software up to date
Training employees on how to recognize cyber-attacks and implementing policies on computer hard-ware usage, particularly the use of USB memory sticks, are further steps a company should consider.
Doing what you can to secure your networks and taking the time to integrate cyber-security into your risk management and crisis communications procedure, are the two most strategic things you can do to ensure you can respond effectively to maritime cyber-security threats and in doing so, protect your reputation as a secure service provider.
Source: mtinetwork
