actively exploited in the wild.

Apache Software Foundation has released HTTP Web Server 2.4.51 to address an actively exploited path traversal vulnerability (CVE-2021-41773) that was only partially addressed with a previous release.

An attacker can trigger the flaw to map URLs to files outside the expected document root.

“A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root.” reads the advisory. “If files outside of the document root are not protected by “require all denied” these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts.”

The vulnerability affects only version 2.4.49, earlier versions are not impacted. A few days ago, Apache released Apache HTTP 2.4.50 to address the CVE-2021-41773

Immediately after the release of the Apache HTTP 2.4.50 experts disclosed that the exploitation of the flaw could lead to remote code execution when the mod_cgi module was loaded and the default “Require all denied” option was missing.

According to an updated advisory, Apache released version 2.4.51 to definitively fix the vulnerability. This new path traversal flaws is tracked as CVE-2021-42013.

“It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives,” announced Apache in an updated advisory. “If files outside of these directories are not protected by the usual default configuration “require all denied”, these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution.”

The vulnerability was reported by Juan Escobar from Dreamlab Technologies, Fernando Muñoz from NULL Life CTF Team, and Shungo Kumasaka.

The United States Computer Emergency Readiness Team (US-CERT) warns of ongoing active scanning of Apache HTTP Server CVE-2021-41773 and CVE-2021-42013 that could lead to imminent exploitation, for this reason, the US-CERT urges organizations to immediately patch their installs.

 

SOURCE READ THE FULL ARTICLE

Apache rolled out a new update in a few days to fix incomplete patch for an actively exploited flaw


The Dutch government announced that it will not tolerate cyberattacks that pose a risk to its national security and will employ intelligence or military services to counter them.

Cyberespionage and sabotage attacks, and also ransomware attacks against critical infrastructure and government offices will trigger the response of the Dutch authorities, explained Ben Knapen, Dutch Minister of Foreign Affairs.

 

ransomware

The Dutch Minister added that the response to severe cyber attacks could be escalated, an attack against a critical response will require the rapid reply of the cyber defense, a response that disregards diplomatic relations between the countries involved.

Knapen highlighted the difficulty of attributing a ransomware operation to a specific threat actor, it explained that it is very complex to demonstrate that a non-state actor carries out the operation on the explicit instruction of or under the control of a state. As a result, the legal attribution of an act of a non-state actor to a state is usually not easy.

“For several years, the threat of ransomware attacks has been increasing around the world. A broad explanation of this threat is included in the Cyber Security Assessment Netherlands (CSBN) 2021, which was shared with the Chamber in June by the Minister of Justice and Security. One of the conclusions of CSAN 2021 is that cybercrime can affect national security if an attack causes massive damage, for example by disrupting vital processes. In a number of cases, cybercriminals enjoy the protection of the state from which they operate or there is cooperation.” Knapen wrote in a letter to the Dutch Parliament. “Due care principle In situations where attribution appears not to be possible in a legal sense, it may be desirable to look into a possible violation of the due care principle in the context of state liability law. The principle of due care means that states are expected to take into account the rights of other states when exercising their sovereignty. States have a duty to act when they have knowledge of the use of their territory in a way that harms the rights of a third state. Failure to comply with this obligation is a violation of an international law obligation.”

 

SOURCE READ THE FULL ARTICLE

https://securityaffairs.co/wordpress/123113/security/the-netherlands-war-ransomware-operations.html?utm_source=rss&utm_medium=rss&utm_campaign=the-netherlands-war-ransomware-operations


There has never been a more important time to listen. “Seek first to understand,” is a lesson I picked up early in my career that has generally proved effective in many situations as a leader, colleague and employee. (Not to mention at home as a partner, father, and friend; it’s a versatile maxim.) Eighteen months into this pandemic, given that the experience and effects of COVID-19 are simultaneously something that is universally shared and individually experienced, it’s more useful than ever to listen before you leap.

I have found the most rewarding moments are when you listen not just as a leader but also as a learner. With so many sources of education available, it’s tempting to gloss over the one right in front of you: your team.

Here are four examples where I recently learned from the people I lead. And remember, it doesn’t have to be a new piece of information to count as learning; the point is to be ready to adapt to something new.

1. Create a safe space

Demonstrate that you can hold a safe space for any kind of conversation. Be emotionally, mentally, and physically present (if you’re on video) to focus on the person in front of you, and what they want to talk about. Someone recently thanked me for creating a safe space after a conversation about a path to promotion, and while my initial response was to reply, “It’s a pleasure and it’s my job,” it made me think that if such a seemingly standard discussion requires a safe space, what about all the conversations currently not being had about more potentially sensitive topics?

It made me think about additional conversations we should be having about mental health, grief, anxiety, uncertainty, being overwhelmed, handling the return to work, among many others. As leaders, we must find ways to build trust and provide opportunities for our teams and colleagues to thrive.

2. Encourage open conversations

One of the ways to encourage more open conversation is to lean in. A usual weekly one-on-one coaching meeting recently opened with “How are you doing?” When I answered “Good!” the question came back, “How are you really doing?” I must have looked tired, maybe it was a Monday, either way it was an excellent question. It caught me off guard, as I was not really “Good,” rather more “Meh,” and we proceeded to have a really honest, open, authentic conversation both about some minor irritants I had experienced that day, and the importance of talking about such things together.

We are undergoing a seismic shift in our professional, social, and family lives. It’s one thing to say that “It’s OK to not be OK.” It’s quite another to model how this should work in practice. It’s OK to say you are not OK. Gently pressing on a topic in a non-confrontational way, perhaps with a time-bound get-out clause, can really open up a valuable discussion. The simple, but powerful, question: “How are you really doing, today?” Might help someone let off a little steam about current events and avert an explosion caused by bigger issues.

3. Get to know your team all over again

It can be hard to calibrate how much social interaction to try and foster as a distributed team all stuck WFH; weekly happy hours in crazy hats seems too much, never seems too distant. It’s impossible to get right, and it’s vital to try.

During a recent team discussion, someone randomly asked a teammate, a former Wall Street trader, about his opinion of our quarterly earnings call. The person asking the question did not know about his finance background, despite having been colleagues for almost two years. Once all the jokes had died down and we had agreed to stage a version of Mad Money on a subsequent team call, it made me think about all the connections that could break unless we protect them, such as small pieces of personal information that would get shared in an office or at a dinner, that help build familiarity (and inform team jokes and rituals).

Leaders need to find time for these group interactions and for one-on-one meetings that are more than just status updates. Another colleague advocates setting up quick introductory Webex meetings with people she meets in peripheral situations through the course of work to get to know them better, with no agenda except networking. Two years ago, I might have dismissed this as a distraction; now I think it’s vital and I do the same.

4. Listen to the most important member of the team: you

Whether you’re the leader, or the loudest person, or the longest-serving team member who everyone goes to for advice; whoever you are, check in with yourself. Make like a parent on a plane who is told to put their own oxygen mask on before attending to their family in case of emergency.

Self-care takes many forms and it’s worth remembering it can be as simple as taking one big meaningful breath. It could be the first breath of the morning, or between meetings to help context shift, or in the middle of a frustrating moment to help avoid being overwhelmed or when you walk out of your door for exercise. Whatever it is, whenever during the day it is, focus on your breath, fill your lungs to bursting, be in the moment, realize that there is always something to be grateful for (even if the only thing you can think of is the breath you are currently experiencing) and shut out the noise. Hold that breath for a moment, then a moment longer and then, as you exhale, let something go. Say goodbye to a worry or a negative thought and turn your mind toward things you’re grateful for.

I am grateful for the team I get to work with every day, and I love learning from them about how we can focus on the present, reflect on our past, and plan for our future.

At Cisco, we are leading a more inclusive future for all. To learn more about our open positions around the world, click here.

 

SOURCE READ THE FULL ARTICLE

https://blogs.cisco.com/security/4-keys-to-create-a-thriving-cybersecurity-team-for-long-term-success


Intelligence company applying AI to transform global maritime trade, is proud to announce that the US Patent and Trademark Office (USPTO) issued U.S. patent No 10,922,981 for its Risk Event Identification in Maritime Data and Usage Thereof. 

The patent relates to technology for identifying risk events for vessels by analyzing raw maritime data and constructing a vessel activity overview for each vessel. Patterns in vessel behavior are identified to indicate the occurrence of risk events, which can be validated by comparing them to other vessel’s behavior or using raw maritime data. This technique can identify risk events, including compliance risk, security risk, safety risk, and others, using reduced resources without increasing false positive metrics.

“We are pleased to have reached the remarkable milestone of having been granted this patent by the USPTO,” said Ami Daniel, CEO and Co-Founder of Windward. “Across the maritime trade industry insurers, banks, shipowners, and energy companies alike have been using manual methods to assess risk. At Windward we are revolutionizing maritime risk identification by developing proven, and now patented, methods of analysis to provide accurate and timely risk assessments which are then used by maritime professionals for decision support.”

Windward’s Maritime AI is powered by hundreds of behavioral analytics models and over 10 billion data points, giving its customers the power to make smarter decisions, faster. Windward’s AI analyzes existing behaviors to predict in real-time which companies and vessels are likely to be high risk, and which are safe to conduct business with. Windward’s solution is easily integrated into existing workflows, enabling businesses to look to the future and optimize business practices.

 

Source: prnewswire


The Belgian Shipping Code, applicable since September 2020, regulates under its chapter 2.5.2 which requirements ports and port facilities (such as commercially operated port terminals) must comply with in terms of maritime security.

 

 

Each port facility must, among other things, appoint a security officer and draw up a security plan, which must be submitted for approval to the competent minister charged with the North Sea.

 

 

Since the Port of Antwerp is considered an international hub for illegal traffic in drugs e.g. cocaine, the fighting of which is understandably a top priority for both the local and national authorities, the importance of maritime security has only increased in recent years. The Belgian seaports are also a point of attention in the context of the increased pressure from illicit migration.

 

 

In this context, the Minister responsible for the North Sea announced at the end of September 2021 stricter rules in the field of port security, which are expected to include increased attention to camera surveillance, increased restrictions on terminal access, and stricter penalties for intruders (who may face up to fifteen years in prison).

 

 

Undoubtedly, all stakeholders in carriage of goods from, to or via the Belgian ports will sooner or later be confronted with the above and will have to strike the right balance between the smooth continuing of their trade operations on the one hand, and compliance with the new security measures on the other hand.

 

 

Ciska Servais (administrative law department) and Ruud De Houwer (maritime and transport law department) combined the expertise of their teams and assisted the FPS Mobility and Transport in 2020 and 2021 in administrative summary proceedings concerning port security and port security plans. They will continue to closely monitor all new developments in this respect.

 

Source: astrealaw


With an established presence throughout China’s “near seas” in East Asia and further abroad in the North Pacific on fishery patrols, the possibility of additional long-distance deployments by the CCG should be seen as a matter of when and not if. This is especially true in waters where Chinese interests and citizens are threatened but the cooperative look of the CCG’s white hulls presents a more appealing optic than the more confrontational appearance of China’s People’s Liberation Army Navy’s (PLAN) gray hulls. One such location is off the west coast of Latin America in the Eastern Pacific on counter-narcotic patrols due the increasing problem of illegal drugs from Latin America making their way across the Pacific to Chinese consumers.

The expansion and modernization of China’s maritime forces, in particular the PLAN, has received a great deal of attention. The PLAN is also the largest navy in the world with an overall battle force of over 360 ships, including more than 130 major surface combatants and more than 60 submarines along with its own aviation arm of more than 300 land-and sea-based fixed and rotary wing aircraft of all types. The PLAN is an increasingly modern and flexible force capable of conducting a wide range of peacetime and wartime missions at expanding distances from the Chinese mainland. From counter-piracy patrols in the Gulf of Aden, to hospital ship deployments to Latin America, to submarine patrols in the Indian Ocean, and long-range operations in the Central Pacific, the PLAN is an increasingly global force. It now operates in all of the U.S. Navy’s numbered fleet areas of responsibility in support of China’s expanding interests.

Matching the PLAN’s impressive modernization is the growth of the CCG. The modern CCG is the result of the 2013 consolidation of four legacy maritime law enforcement agencies. With a combination of the agencies’ older ships, repurposed PLAN ships, and increasingly new construction, the CCG has rapidly grown into the largest maritime law enforcement agency in the world. The white-hulled ships of the CCG are now a common sight throughout China’s “near seas” within the first island chain, particularly in contested waters near features such as Scarborough Reef, the Senkaku Islands, and Second Thomas Shoal as well as near foreign drilling rigs and survey operations. Backed up by the PLAN and the ships of China’s Maritime Militia, the CCG is Beijing’s tool of choice for intimidating rival maritime claimants throughout the region. However, with 140 ocean-going ships of 1000 tons or greater—including 60 ships of 2500 tons or greater—the CCG has more than enough capacity to expand its operations beyond regional waters.

 

Source: maritimecyprus


When plotting a course on the open ocean, conditions rarely allow a navigator to chart a straight line home. Hazards below the surface of every ocean and the unpredictability of weather systems require a crew to consistently reassess the vessel’s position and adjust maneuvering to reach its destination safely. Both the captain and the crew are expected to navigate using all means available, a lens that should apply to approaching recommendations to reduce cybersecurity risks for the MTS as a whole: actors within the MTS must be capable of tapping into every available resource.

The approach to maritime cybersecurity must ultimately be holistic; even if every component of the MTS was cyber secure, the interconnection of the subsystems might not result in a secure MTS. Taking the steps necessary to build a secure maritime domain will require a better understanding of the cybersecurity-threat landscape, coupled with a segmented view of MTS infrastructure. This will allow developers, policy makers, owners, and regulators to match the best policy levers with particular maritime systems, and achieve better cybersecurity outcomes across the entire MTS.

This report puts forward twelve recommendations—split into three overarching themes—to help better secure all subsystems of the MTS from evolving cyber threats. First, stakeholders operating within the MTS must raise the baseline for cybersecurity across the maritime industry and shipping communities. Knowing is half the battle, and stakeholders must develop a sector-specific cyber risk framework, a global intelligence clearinghouse, and a common cyber-incident threat matrix, while pushing for an active, industry-wide vulnerability disclosure policy.

Second, MTS stakeholders must deepen their understanding of maritime cybersecurity and associated risks by building cross-sector linkages, especially through new professional and international exchanges between academia, industry, and government. Stakeholders must design MTS cyber-specific educational certifications to support these new workforce initiatives, with the goal of upskilling the industry and attracting talent into a cyber-aware MTS. Developers and the maritime industry must collaborate on eradicating systemic software vulnerabilities from MTS software. Lawmakers and regulators must complement these efforts by ensuring that MTS receive adequate resources to improve cybersecurity.

Third, executives and high-level stakeholders in the public and private sectors globally must prioritize cybersecurity as part of their broader risk management efforts, leveraging increased security measures and appropriate risk mitigations to help support long-term improvements in cybersecurity. MTS stakeholders should assess risk by relating their cybersecurity maturity to those of other sectors, like energy, better integrating cybersecurity with traditional maritime insurance coverage, and finally, improving cybersecurity proactively through multistakeholder simulations.

The bulk of these identified actions build on or integrate existing programs, such as the US Department of Energy-backed Cyber Testing for Resilient Industrial Control Systems (CyTRICS) program,1 run across four national labs and the Department of Transportation (DOT) Maritime Administration (MARAD) 2021 Port Infrastructure Development Program (PIDP).2 These programs are embedded in broader lines of policy effort and come with well-established relationships—both virtues over starting from scratch.

The maturity and effectiveness of contemporary approaches to cybersecurity in the MTS fail to reflect the vital role maritime transportation plays in supporting global commerce, diverse energy systems, and national security. Cyber threats will only continue to metastasize, accelerating both in quantity and consequence. Navigating through such turbulent waters requires an all-hands-on-deck approach—both in the United States and beyond—to improve the collective cybersecurity of the MTS.

 

Source: atlanticcouncil


September 30, 2021 marks World Maritime Day and this year’s theme is all about recognising seafarers: “Seafarers: At the core of shipping’s future”.

This theme was chosen by the International Maritime Organization (IMO) following a year of action for seafarers, who play a vital role as key workers for global supply chains but are facing unprecedented hardship due to the COVID-19 pandemic.

IMO secretary-general Kitack Lim stated: “Shipping drives world trade and that trade simply does not happen without seafarers. While the challenges of automation and digitalisation – not to mention decarbonisation – will drive change in shipping, we will always need well-trained and motivated seafarers. We must ensure a diverse and expert workforce for the ships of the twenty-first century and beyond.”

During 2021, the IMO has interviewed several seafarers about topics of importance to them and the future of the sector. The profiles (on the IMO website and social media channels (Twitter, Facebook, LinkedIn and Instagram) spotlight issues related to the human element of shipping, including the safety and security of life on board ships, seafarers’ well-being, and the importance of ensuring an appropriately trained and qualified workforce, ready to meet the challenges and opportunities of digitalisation and automation.

This year IMO will launch a new annual initiative to unite the maritime community and raise awareness of the vital contribution of shipping to the world by bathing the IMO building in blue light on World Maritime Day.

John-Kaare Aune, Interim CEO, Wallem Group said: “With this year’s World Maritime Day addressing the integral role of seafarers in shaping the future of shipping, I, and everyone at Wallem, would first like to thank and salute all seafarers for the crucial work they are doing in the present.

“In what has been the most challenging period in recent history for many of us, these brave women and men have sacrificed more than most, facing unthinkable circumstances to ensure the global supply chain remains intact, the wheels of trade keep turning and our supermarket shelves stay stocked.

“Changing the narrative is only the beginning. Shipping companies will also have to cooperate with local governments and schools to recruit the brightest talents and develop them for seagoing positions, providing them with the tools and training they need to manage the ships of the future. Moreover, to inspire loyalty, the industry will have to deliver on its promises, with companies listening to their crew more closely than ever and making seafarer well-being their absolute priority.”

Speaking about the impact of digital technologies on seafarers, Eero Lehtovaara, head of regulatory affairs at ABB Marine & Ports stated: “Over the last five years, and particularly during the last 20 months, digital technologies have transformed lives ashore, both at home and at work. World Maritime Day 2021 therefore provides a timely opportunity to explore how digital and autonomous technologies can transform the working lives of our seafarers while also raising both safety standards and operational efficiency.

“A whole new range of digital and autonomous technologies have also been developed which can assist seafarers in their routine work schedules and support them in emergencies. These wide-ranging systems are available to ease the workload of both navigators and engineers, and to raise safety standards by enabling personnel to manage their time more effectively and to make better decisions.

Many of these digital systems have already been well tried and tested, and new solutions are being developed fast. Step by step, offering new and better ways to operate vessels.”

The 2022 World Maritime theme is ‘New technologies for greener shipping’. This theme will reflect the need to support a green transition of the maritime sector into a sustainable future, while leaving no one behind.

 

Source: thedigitalship


The issue cyber security becomes increasingly important for maritime shipping as significant part of the global logistics chain. Just one of the latest attacks was with the malware “NotPetya” in 2017 where the shipping company Maersk alone suffered damages of several hundred million Euros, which made clear how immense the magnitude of cyber-attacks can be in maritime shipping.

Sea-going ships fall victim to cyber-attacks more and more often because they are floating data processing centres. And these data processing centres can get attacked. Which means that for example navigational systems used on board ships do not just make them susceptible to disturbances but also connect them to the internet and thus create doorways for computer hackers.

Cyber hazards also lurk in ports. Admission systems, cargo handling, steering systems for cranes and the SCADA software often used in industrial steering systems turn ports into highly connected IT systems. The more steering and navigational systems at land and sea become interconnected with other networks und entertainment systems, the easier it becomes for third parties to gain access via IT interfaces along this chain of systems.

Since this year, IMO has made it mandatory for shipping companies to protect against cyber risks. Ship operators have to integrate the relevant measures into their existing ISM systems. The BG Verkehr, the BSH and the BSI aid German shipping companies in this task. In the joint ISM Circular on “ISM Cyber Security”, these three authorities offer practical tips on the topic cyber security. Sabine Kudzielka, CEO of the BG Verkehr, emphasizes: “The experts of our Ship Safety Division are happy to support shipping companies to establish an individual cyber risk management in their enterprise. Our experts used to serve at sea themselves and know what is relevant on board.”

The Federal Maritime and Hydrographic Agency (BSH) points out its competences regarding cyber security: “The BSH is responsible for the verification of security systems on board ships flying the German flag. Furthermore, we work together with partners in scientific research on our technology development platform in the BSH system laboratory to find solutions that can prevent unauthorized access to ship systems”, explains the president of the BSH, Dr. Karin Kammann-Klippstein.

The BG Verkehr, the BSH and the BSI have agreed upon an intensification of their cooperation regarding maritime cyber security. Based on an administrative agreement, they want to sensitize shipping companies for the topic “information security”, provide support and carry out joint projects. “We want to share knowledge of and experiences with information security with shipping companies and German maritime enterprises and be a part in shaping the digital change in the shipping industry successfully,” Dr. Gerhard Schabhüser, vice president of the BSI, gladly announces. “This administrative agreement in an important step towards this goal.”

In addition, the BG Verkehr and the BSH will become a member of the alliance for cyber security and keep the BSI informed about IT security incidents in maritime shipping to create a more accurate overview of the situation. Moreover, joint publications such as guidance and checklists will get developed.

 

Source: deutsche-flagge


South Korea’s Daewoo Shipbuilding & Marine Engineering Co. (DSME) plans to help shipowners tighten their cybersecurity preparedness after securing certification for a new smart ship solution.

As cases of cyberattacks in the maritime industry increase, the South Korean shipbuilder said it intends to start installing its DSME Smartship Solutions (DS4) in ships after winning an approval from the American Bureau of Shipping (ABS).

DS4 is designed to protect the data and software of ships from hacking and will be installed in more than 30 vessels. With the approval, DSME can install the solutions into ships without an additional cyber security assessment.

“We believe this certification will serve as a cornerstone to advance the era of autonomous ships,” said Choi Dong-kyu, DSME’s R&D institute head.

DSME will become the first shipbuilding company to obtain ABS’ product design assessment (PDA) certification in the field of cyber safety.

South Korea is determined to be a global frontrunner in developing autonomous ships. The technology had been touted as the next generation of high-value-added ships, designed to replace the crew’s decision-making with intelligent and autonomous systems through the convergence of artificial intelligence, the Internet of Things, big data, and sensors.

However, the push towards smart ships faces risks from cyberattacks. Globally, cases of cyberattacks targeting shipping companies, ports authorities, and ports infrastructure have been on the rise. DSME was itself targeted in June, when hackers attempted to breach the company’s computer systems.

Ransomware attacks on shipping firms tripled between 2019 and 2020, with the world’s four largest shipping companies – Maersk, Mediterranean Shipping Company, CMA CGM, and COSCO – all falling victims over the last four years.

MSC suffered a network outage in April 2020 from a malware attack, while CMA CGM was hit with a ransomware attack in September 2020. Even the International Maritime Organization was recently targeted by a cyberattack, forcing some of its services offline.

“To date, most cyber incidents involving shipping have been shore-based incidents, such as attacks against ports and shipping companies themselves. But cyber threats to vessels will increase as more ships are linked to onshore navigation and performance management systems,” said the Safety and Shipping Review 2021 report by Allianz.

 

Source: maritime-executive


Company DETAILS

SHIP IP LTD
VAT:BG 202572176
Rakovski STR.145
Sofia,
Bulgaria
Phone ( +359) 24929284
E-mail: sales(at)shipip.com

ISO 9001:2015 CERTIFIED