MARITIME CYBER SECURITY MANUAL Archives

Capesize

Firmer sentiment across both basins pushed the Capesize 5TC route average above the $20,000 threshold this week, closing at $24,209. Activity in the Pacific gradually picked up midweek after a public holiday in Singapore on Monday. The West Australia to Qingdao iron ore trade climbed closer to $11, with fixtures reported at better rates towards the end of the week. Meanwhile, the market saw a lowering of vessels in ballast able to make end July dates – or even early August – loading in Brazil. Quite a few cargoes from Brazil and West Africa were fixed to Qingdao, with a China-Brazil round trip paying nearly $20,000 per day. In the North Atlantic, rates roared on both transatlantic and fronthaul trips. The latter remained as the most rewarding route pricing at $53,611 to perform a run from Continent/Mediterranean to the Far East.

Panamax

The Panamax market provided further losses this week and is showing little signs of abating. Despite a steady level of activity, this failed to stem the tide with both basins yielding significant losses. The Atlantic saw rates erode for a further successive week, as pressure from the nearby and committed ships continued to underpin the market. From East Coast South America, the focus this week was on end July arrival with APS load port rates now hovering around the $20,000 + $1,000,000 mark, but continued to ease throughout the week. Asia similarly witnessed another week of falls. Again a lack of demand on the longer round trips added further pressure to an already weak market. There were reports midweek of a 75,000-dwt delivery Japan achieving $16,000 for a NoPac round trip, but activity remained light as the market drifted. Like previous weeks, older and smaller units tended to soak up much of the limited Indonesia demand.

Ultramax/Supramax

Sentiment waned in most areas, with the exception being from the US Gulf. Rates remained relatively firm from there for both runs to the Pacific and within the Atlantic. Limited fresh enquiry elsewhere saw a build up of tonnage leading to downward pressure on rates. Little period cover was heard, but a 64,000-dwt open China was heard to have been covered $24,000 for one year. In the Atlantic, from East Coast South America, a 63,000-dwt was heard fixed at $18,000 plus $800,000 ballast bonus for a trip to China. From the US Gulf a 58,000-dwt was heard fixed delivery SW Pass redelivery Turkey in the mid $30,000s. There was a good supply of prompt tonnage in the Asian arena, with a 56,000-dwt open Indonesia now seeing in the low $20,000s for trips to China. Backhaul demand eased as well. However, a 63,000-dwt open Dafeng mid-July was heard fixed via Taiwan redelivery Continent with steels at around $30,000.

Handysize

East Coast South America made positive gains over the week with sources citing a lack of tonnage for end July as the main driving force. A 38,000-dwt was heard to have been fixed for a trip from South Brazil via River Plate to Morocco at $30,000. A 28,000-dwt open in Rio Grande fixed via River Plate to Greece at $22,000. The Mediterranean was also more active. A 35,000-dwt fixed from Canakkale via Black Sea to Tunisia at $16,000, whilst a smaller unit fixed a similar trip from Marmaras in the mid teens. In Asia, activity had been limited and sentiment remained soft. A 38,000-dwt was rumoured to have been fixed for a trip from CJK via Indonesia to Japan at $21,000 and a 40,000-dwt fixed from Lanshan via Japan to New Zealand at $15,000 with a cargo of cement.
Source: Baltic Exchange

IACS is pleased to announce the publication of its Recommendation on Cyber Resilience (No. 166). This single, standalone Recommendation consolidates IACS’ previous 12 Recommendations related to cyber resilience (Nos. 153 to 164) and applies to the use of computer-based systems which provide control, alarm, monitoring, safety or internal communication functions which are subject to the requirements of a Classification society. Part of the objective in consolidating the 12 Recommendations was to define responsibilities and harmonise and simplify the language used therein. This Recommendation has benefited from the valuable input of a wide range of industry partners contributing via the Joint Industry Working Group on Cyber Systems and covers the constructional aspects of the 12 previously published Recommendations. It provides information on matters such as reference guidelines and standards, terms and definitions, goals for design and construction, functional requirements, technical requirements and verification testing.

IACS Chairman, Arun Sharma, said ‘The publication of this important Recommendation marks a significant milestone in IACS’ work to support the maritime industry in the delivery of cyber resilient ships. I am pleased to note the significant cross-industry cooperation that led to its development and we look forward to maintaining that dialogue as we assess its practical implementation and effectiveness’.

This new recommendation is applicable to a vessel’s network systems using digital communication to interconnect systems within the ship and ship systems which can be accessed by equipment or networks off the ship. Robert Ashdown, IACS Secretary General, added ‘The network design forms the basis for a reliable and robust network. Issues such as compatibility of various devices, communication between devices, communication from various systems and sub systems, need due consideration during design phase. This Recommendation is an important step in addressing cyber resilience from the earliest stages of a vessel’s life.’

Operational aspects that were included in the superseded 12 Recommendations have been identified and grouped under a separate annexure. Following the publication of this consolidated Recommendation the earlier 12 Recommendations have been officially deleted by IACS.

IACS will continue to work with its industry partners and look for their feedback regarding its practical implementation and effectiveness. Based on the experience gained from the practical implementation of this Recommendation IACS will assess the suitability of using it as the basis for a Unified Requirement on Cyber Resilience.

Link for downloading Rec 166 (New Apr 2020): Recommendation on Cyber Resilience

Source: http://www.iacs.org.uk/news/iacs-launches-single-standalone-recommendation-on-cyber-resilience/

Maritime cyber security, threats, trends, and relevant safeguards

Milan – Even more than within other sectors, across the maritime domain’s evolving landscape of real-time connectivity requirements, which provides data in order to optimize maritime operations and customer experience, there are increasing vulnerabilities onboard vessels, potentially leading to ever more disruptive incidents; in what follows, Giuseppe D’Agostino, Associate Cybersecurity & Privacy Partner at PwC, talks about the subject.

Maritime cyber security

Cyber Security is increasingly becoming a topic of great interest across all economic sectors. After all, the statistics speak for themselves: 30% of businesses believe there’s a high probability they could be target of a cyber attack (source: PwC Digital Trust Insights 2018); proceeds from cyber crime, particularly those of drug smuggling operations, are estimated to be close to 3,000 billion dollars (source: Serious & Organized Crime Threat Assessment); around 15% of companies indicated they had uncovered over 50 cyber incidents over the past year (source PwC Digital Trust Insights 2018), marking a trend that’s on the rise.

Figures regarding the consequences of cyber attacks are equally dire. For instance, data breaches at Yahoo in 2016, and at Equifax in 2017, resulted in 320 million dollars being knocked off its sale price, and in a 32% drop in its share value, respectively. Danish shipping and logistics giant Maersk fared not much better, following an attack employing NotPetya ransomware. It’s estimated that the significant impact on business that followed that incident translated to around $300 million in lost revenue. Analysis of concrete incidents such as these sheds some understanding on the potential economic aspects of a cyber attack, and indeed quantifies them.

The introduction of new technologies has opened new vulnerabilities for enterprises, which, therefore, require innovative approaches to cyber security. An overview of the global picture shows that by 2020 some 50 billion devices will be interconnected (Internet of Things), a trend that is reflected across the maritime domain, with exponential growth expected in the use of wearable devices and integrated sensors; 100% of new cars will, moreover, be connected by 2022; similarly the piece of news that stands out in the maritime sector has to be the upcoming launch of the world’s first autonomous ship, the Yara Birkeland.

Cyber criminals will try to exploit the vulnerabilities that new technologies inevitably carry, and companies are starting to plan for new control regimes as these new developments are rolled out. An analysis of this data clearly shows an increase in vulnerabilities and threats regarding Cyber Security, which results in a need to develop and implement a holistic approach to cyber security incidents, by acting on three separate levels: prevention, identification, and response.

In terms of prevention, for example, it is essential to integrate the principles of security and privacy within evolving business models, such as developing new services and systems (security by-design and by-default). Many studies have shown how the costs for the mitigation of a vulnerability grow exponentially as time elapses; solving a security bug in the development phase, for example, is clearly much easier and cheaper than working on a system in full operation. Another aspect related to the prevention of security incidents concerns external suppliers.

Maritime cyber security

The services provided by companies are becoming increasingly integrated within complex and geographically dispersed value chains, in which relations and data exchanges with third parties assume a predominant role. A company’s security, therefore, hinges on the security of the entire value chain. In addition, less structured suppliers increasingly constitute an entry point for attackers, making no company, however mature, immune from an attack.

No matter how effective the countermeasures implemented may be, it’s essential to be able to detect attacks in a timely manner. An example of how companies are addressing this need is in the setting up of ad hoc structures to perform monitoring and alerting; these structures are usually termed Security Operation Center (SOC) and are responsible for the collection, correlation and analysis of data in order to generate alerts and detect possible security breaches.

The GDPR, particularly the measures concerning data breach (which oblige violations of personal data to be reported within very short times), gives even greater emphasis to the importance of effective monitoring. The response to incidents, that is the containment and restoration of the components impacted, is crucial for damage containment. It is important to make use of adequate professional skills that can contain the incident quickly, ensure the collection of exhaustive data that can stand up in court, and understand the root cause as soon as possible, to ensure that it will not happen again in the future (lesson learned).

Figures show that in this context there are considerable possibilities for improvement, given that it’s estimated that, on average, it takes 197 days time to identify a data breach, and 69 days to contain it (source: 2018 IBM – Cost of a Data Breach Study). The growth in threats and attacks has made cyber threats one of the top 5 priorities for CEOs. In fact, firms often feel unprepared, and 57% of firms in Italy consider action in the field of Cyber Security & Data Protection a priority (source PwC Digital Trust Insights 2018).

In conclusion, the following 5 basic steps should form the basis of a strategic security program: 1. Ensure that Cyber Security strategy is aligned with business objectives and is adequately supported by the company management. 2. Identify the most critical data resources, and prioritize investments through risk analysis to anticipate threats. 3. Be aware of threats (Intelligence), their motivations, resources and methods of attack, to reduce the time between detection and response to an incident 4. Evaluate Cyber Security of third parties and partners across the value chain, ensuring compliance with security policies and procedures 5. Provide training for employees and collaborate with others to raise awareness of Cyber Security threats and response techniques. Increasing knowledge and understanding of the threats and actions to be taken will allow companies and enterprises to improve their resilience. The ability to respond effectively to these challenges will increasingly be a key distinguishing factor in the future, which will reward companies able to provide reliable cyber-ready services on the market, thus turning measures aimed at avoiding risks into true business opportunities.

Maritime cyber security, threats, trends, and relevant safeguards

SOURCE : THEMEDI TELEGRAPH

Maritime Cyber security

The University of Plymouth has created a cyber security research lab that focuses on challenges faced by the shipping industry.

The £3 million ‘Cyber-SHIP‘ lab will complement the university’s existing maritime facilities which includes a simulator dedicated to training professional sailors.

The lab is a transformational step towards developing a national centre for research into maritime cyber security, according to Professor Kevin Jones, the executive dean for science and engineering and principal investigator for the project.

Jones believes that the lab will support a range of research and training that cannot be achieved with simulators alone. These will also facilitate the development and delivery of new maritime cyber provision for graduates, postgraduates, and industry.

“Cyber attacks are a Tier1 National UK threat. But, although the maritime sector is advancing technologically, it is not well protected against cyber or cyber-physical attacks and accidents,” he said.

“Worth trillions, it has an unmatched reach across international waters, which exposes people and goods to a diverse range of factors, putting the shipping industry at high risk. As such, this facility has never been more timely.”

The lab has been developed in partnership with shipping equipment manufacturers, port operators, shipbuilders, classification agencies, and insurance companies. Some of the areas it will look at include the cyber risk of autonomous ships, maritime cyber risk assessment, and the scope and impact of evolving tech on international shipping.

The project, which has been funded by Research England will last for three years with the hope that it will be self-sustaining by then. It aims to bring together a host of connected maritime systems currently found on an actual ship’s bridge. Cyber security experts will then assess these systems for vulnerabilities and identify the technology and skillsets needed to make them more secure.

The lab will feature cutting edge maritime technology including radar equipment, a voyage data recorder, an electronic chart display and information system, an automatic identification system, and communications devices.

SOURCE ITPRO

Maritime Cyber Security – Five key cyber questions and challenges facing the maritime industry!

To wrap up this year’s National Cybersecurity Awareness Month series, Lt. Cmdr. Brandon Link with the Office of Port & Facility Compliance poses five key questions maritime professionals can consider when deciding how to manage risks to cyber systems.

Cyber systems are prevalent in our daily lives. We face an ever-increasing amount of cyber influence in how we live, work, and operate. The Marine Transportation System (MTS) uses cyber systems in all aspects of operations. With the convenience and improved performance offered by technology come continually-evolving questions and challenges. Cyber threats are real and pose considerable risks requiring attention and action at all organizational levels.

Below are five key cyber questions and challenges facing the maritime industry and how you can begin assessing and reducing risk:

1. How much should I invest in cybersecurity and cyber risk management? The answer varies from organization to organization. Cybersecurity should be viewed as an investment, not a cost. You are in the best position to evaluate your company’s cyber footprint to determine where risks are highest. The National Institute of Standards and Technology (NIST) Cybersecurity Framework and Coast Guard/NIST Cybersecurity Profiles are a few resources available. The Coast Guard continues to work on further guidance to assist in cyber risk management efforts, including the upcoming Navigation and Vessel Inspection Circular (NVIC) 05-17, Guidelines for Addressing Cyber Risks at Maritime Transportation Security Act Regulated Facilities.

2. We have a closed system with an air gap between our network and outside influences. Am I still at risk? Does the system have access control/authentication procedures to prohibit unknown or unauthorized access? Can an equipment vendor access that system remotely, even for seemingly harmless activities such as program updates? Can the system be accessed in person, connecting via laptop or other equipment, introducing an avenue for malicious access? To answer these questions, it is important to know and understand the landscape of, and access to your cyber systems.

3. What are the greatest threats to my cyber systems? A direct cyber attack can come from a malicious actor, either internal or external. Cyber threats can also arise from accidental corruption, like an employee unknowingly connecting a corrupted device (smart phone, “thumb” drive) to a USB port. Risks can increase due to improper system configurations or failure to stay current on software updates. Having policies in place to account for these issues, and ensuring employee awareness, can greatly reduce risks.

4. I think our organization is the victim of a cyber attack or incident. Who can I notify? The National Cybersecurity and Communications Integration Center (NCCIC) is a 24/7 cyber situational awareness, incident response, and management center serving as the national nexus of cyber and communications integration for the Federal Government, intelligence community, and law enforcement. A cyber incident that does not impact physical security or include a pollution event can be reported to the NCCIC at 1-888-282-0870, who will then forward the report to the National Response Center (NRC), meeting the reporting requirements in 33 CFR 101.305, if made aware that you are calling as a Coast Guard-regulated facility. Reports of suspicious activity or a breach of security, and incidents affecting physical security or including a pollution event should be reported to the NRC at 1-800-424-8802.

5. We need to address cyber risks in our organization, where do we begin? There is no single solution that will work the same for every company, but there are steps that will help get you on the path toward an improved cyber posture:

Increase cybersecurity training and awareness at all levels of your organization.
Understand and educate the workforce on the difference between Information Technology (IT), the storing, retrieving, transmitting, and manipulating of data, and Operational Technology (OT), the hardware and software that detects or causes changes in processes through monitoring or control of physical devices (the “Internet of Things”).
Establish positions, teams, or workgroups that are cyber threat-focused. Integrate your IT workforce’s corporate knowledge of systems with the OT workforce and others who possess expertise in your company’s operations.
Conduct an assessment to see where cyber threats exist, and identify ways to mitigate those risks. Incorporate cyber risk management into existing policies and procedures, including the Facility Security Plan. Conduct exercises that test your organization’s cyber threat resilience.
Identify your local Area Maritime Security Committee, particularly those with a dedicated cybersecurity subcommittee, or other opportunities that allows for the sharing of knowledge and experience. What affects your organization could affect others, so information sharing is crucial to combating threats.

Managing cyber risks will continue to be an ongoing effort requiring time and attention. The most significant threats and highest priorities may not remain the same from month-to-month or even week-to-week, so staying informed could mean the difference between a strong cyber posture or becoming victim to a cyber incident or breach.

Source :

10/30/2017: Nat’l Cybersecurity Awareness Month – Five key cyber questions and challenges facing the maritime industry

MARITIME CYBER SECURITY MANUAL

Following latest developments in our industry and various guidelines published by BIMCO, USCG Cyber Bulletins and TMSA 3 – element 13 we have develop a generic MARITIME Cyber Security Manual which can be used by all Shipping Companies as a best practice .

SHIP IP LTD have develop a Maritime Cyber Security manual to provide a risk management solution for Shipping companies and their vessels against various Cyber incidents.

Cyber incidents with negative effects to companies reputation or even results to economic effects when delays to services provided by their vessels.

Needless to point that Cyber Security is now part of TMSA 3 – Element 13 and all companies operating Tankers should immediate consider to develop or include to their existing Safety Management system, procedures , contingencies plans ( offices and vessels), define hazards,threats and risks when it comes to Cyber incidents.

Our Manual in word format with following content for sure with small changes will fit to your companies setup and will cover all regulations and international requirements :

Definitions

Understanding the cyber threat
Assessing the risk
Determination of vulnerability
Risk assessment ( Bridge equipment,Comms,Propulsion,Cargo Systems,Welfare Systems etc.)
Reducing the risk
Technical cyber security controls
Procedural controls
Defence in depth

CYBER SECURITY POLICY
OFFICE & VESSEL contingency plans

Investigate cyber incidents ( forms and procedures )
Response plan
Recovery
Investigate cyber incidents

ALSO we will provide you FREE of charge in word format a travel
policy as required by TMSA 3 Stage :
3.1 A travel policy is in place to minimize security threats to personnel.

In case you like more details or even you would like to order our manual,please submit contact form below and we will get in touch with you soon.

You can now purchase our manual and pay via Paypal or any major credit card, please click button below to redirect to the relevant page, as soon as you complete payment we will send you secure link to download it :

Dry Bulk Market: Capesize Market Firms This Week

New recommendations on building cyber resilient ships

Maritime cyber security, threats, trends, and relevant safeguards

Maritime Cyber security lab launched for UK shipping industry

Maritime Cyber Security – Five key cyber questions and challenges facing the maritime industry

Maritime Cyber Security Manual in Compliance with BIMCO – USCG

MARITIME CYBER SECURITY MANUAL

News

What is ESG? The Impact of ESG on shipping companies (MARITIME ESG)

Sustainability in Shipping Industry, ESG Performance Reporting (MARITIME ESG)

ESG in the Shipping sector (MARITIME ESG)

Quick Menu

Company DETAILS