The cyber security in maritime is a matter to be mulled upon. The experts suggest the risk from a hostile attack on ship’s system which allows the vessel to be operated remotely by the pirates and misguiding it to a port of their own choice. It may cause a catastrophic navigation error, a phishing attack or ransomware on the Master’s PC. As of 2018, the global implementation of robust maritime cyber security policy is essentially non-existent.
IMO recommendations
IMO recommends the enforcement of cyber security in maritime. The guidelines provide high-level recommendations on maritime cyber risk management to safeguard shipping from present and future cyber threats and vulnerabilities. The recommendations on cyber security can be incorporated into existing risk management processes and are complementary to the safety and security management practices already established by IMO.
The maritime cyber risk hints to a measure of the extent to which a technology asset could be threatened by a potential circumstance or event, which may result in shipping-related operational, safety or security failures as a consequence of information or systems being corrupted, lost or compromised.
Maritime Cyber security survey results
Near about 70% of senior maritime sector administrators in the US believe, the sector is prepared to respond to cyber attacks, whereas half of that number believes their own businesses are ready. Out of 126 senior maritime administrators polled in a survey by US-based law firm Jones Walker, only 36% said their business is prepared to face the attacks of cyber.
According to the survey, the small and medium-sized companies are farther less prepared when compared to larger companies to counteract to the cyber security breach. The small-sized companies lack even in the most fundamental protections, exposing them to huge potential losses. 92% of small companies and 69% of medium-sized companies’ confirmed that they have no cyber insurance. The larger companies reported having cyber insurance. Almost 80% of large US maritime sector companies (with more than 400 employees) reported encountering a cyber attack within the past years.
When asked regarding the companies’ greatest cyber security exposure, the various respondents from large companies focused on external threats. The Medium and small companies offered a more mixed assessment of current threats. A worrying level of complacency among maritime industry is spread when talking of cyber security.
The consequences of financial aspects can be crippling. The companies that had been breached off in cyber security are more prepared now on. However, 36% of small company cyber attack victims are still unsure about the reasons behind their breaches. On the whole, only 10% of the survey respondents reported against the cyber attack over the past 12 months. While 12% reported that they have been successful in managing to tend off the pirates during the same time frame.
Nearly 80% of large US maritime industry companies (with more than 400 employees) reported facing a cyber attack within the past year.
Years back, the attacks like piracy were a common threat and so physical defences are well understood. In contrast to that, the modern cyber and cyber-physical attacks aimed at ships are significantly less understood. Therefore, less preventable with current codes and practices.
The stealth ability and long attack duration’s relating to cyber-attacks increase the number of cyber threats in general. The breach in maritime cyber security leaves an impact on business disruption, theft of information, finance, and cargo. It also damages the reputation, goods, and environment.
The maritime sector is a major role-player of global trade infrastructure and transportation. Furthermore, the significant amount of shipping-based travel crossing national lines creates an interesting geopolitical dimension to maritime cyber security, due to separate nations and their policies. Such policies are influenced by a nation’s economic and environmental factors. Shipping being a different mode of transportation poses a unique cyber security problem. Ships have an entirely different system, different trip durations (months Vs hours), cargo volume etc.
From passenger ships to large container vessels sailing on international waves, the vast majority vessels share two fundamental functions: navigation and propulsion. Both of which are supported by a plethora of hardware and increasingly advanced software controls. The standard navigation systems like Global Positioning Systems (GPS), Automatic Identification Systems (AIS), and Electronic Chart Display and Information Systems (ECDIS) have increased physical safety through international regulation. However, with their technological advances comes a new threat to the cyber security attack to exploit ships and the sailors. Once the spoofing (providing wrong data) or the jamming of the transmission is done the vessels are directed to false destinations. The alteration in the routes of the ship is done the attackers, to smuggle the drugs and other illegal goods. The criminal smuggling activities in the past few months are on a high list.
Recognizing the threats
However, there is the only limited availability of credible evidence to support claims of hacks at sea. The real threats at the sea come from a lack of crew training. The crew members’ awareness of using their own devices at work (Bring Your Own Device, or BYOD) is essential. As plugging those into ship systems to charge them may possibly result in a malware. It might have been inadvertently carrying onto the vessel.
Mitigating the risk – train your staff
Ensuring the bank accounts to avoid the cyber attacks or exposure of network is a big threat. The way to mitigate cyber attacks is training. The minor changes like enforcing a zero tolerance on BYOD may be a help to keep the cyber security intact.
To separate crew and administrative or operational networks, blanking the unused USB ports and keeping the monitors turned away to prevent the “shoulder surfing” and a rule to keep the computers at into secure sleep mode when left unattended. The staff dealing with the accounts and additional rules may be required to ensure the vulnerabilities of phishing and social engineering (whale attack) may be lessened.
In November 2016, Europe’s largest manufacturer or wires and electrical cables, Leoni AG, lost £34 million in a whale attack, when cyber criminals tricked finance staff into transferring money to the wrong bank account.
Similar attacks take place every week. In the last six months, the shipping industry has seen several incidents in the sector, ranging from a data breach at Clarksons through to the damage done to Maersk by the WannaCry NotPetya variant sabotage/ransomware incident, which the company believes cost it as much as $300 million.
Conclusion
The maritime is clearly trailing other sectors in critical national infrastructure and needs new approaches for the regulations. Several short terms training and new systems in long-term would be required.
The Unique factors in the shipping industry, particularly dynamic changes in maritime technology, and economy, social, and environmental elements, present significant cyber security challenges to protect this critical and most significant international infrastructure.
The guidelines and a mandatory policy from IMO can have significant, positive impact in real-world situations in combating both known as well as unknown cyber threats and thus that is the only rising hope for the cyber security in the maritime.
