Maritime Cyber Security Needs Shipping Companies to Focus

Maritime is one of the oldest industries and lifeblood of the global economy, accounting for the carriage of 90% of world trade. Ships and other vessels may seem like unusual targets for cyber-attacks, however cyber attacks have increased. 
 
The seaborne shipping industry's growing use of industrial control systems (ICS) and satellite communications has given hackers an entire new range of opportunities and cyber protection for shipping is lagging behind many other sectors, just as the threat profile has grown .
 
With  a  majority  of  the  world’s  goods  traveling  through  sea  lanes,  it  is  crucial for members of the maritime industry to understand the risks associated with the maritime  cyber  domain. Cyber security threats to shipping can be malicious actions such as hacking or infection of systems with malware or vessels lacking software maintenance, faulty user permissions, unauthorised access to systems and weak passwords. 
 
Regardless if malicious or benign, both above actions should be taken seriously as credible threats to vulnerabilities in IT or OT systems that can comprise an entire vessel and its crew and the incidence of attacks has increased markedly since the onset of the Coronavirus pandemic.
 
The maritime shipping industry's vulnerability has never been greater as the industry embraces digital transformation continues to accelerate , providing many more opportunities for hackers.
 
The disastrous SolarWinds malware attack, widely thought to be state-sponsored, is estimated to have infiltrated more than 18,000 targets with malicious code which initially lay dormant for some weeks and many leading US ad international companies companies are thought to have been attacked, as well as US Government departments and Microsoft. There is no reason to think that the maritime industry is unaffected and against this  background  of heightened risk and industry experts say that shipping needs to change its thinking. “We need to think security, not just compliance,” said Ben Densham, CTO of Nettitude, a cyber security company owned by Lloyd’s Register at a recent event.
 
Densham stressed the importance of continuous testing of cyber resilience. As remote connectivity and varying degrees of autonomy transform many long-established shipping business models, companies must focus on cyber risks and their possible impact, he said, because they pose a constant threat that runs through all aspects of business. Both cybersecurity and cyber safety are very important because of their potential effect on personnel, the ship, environment, company and cargo. Cyber safety covers the risks from the loss of availability or integrity of safety critical data and operations technology.
 
The US Government has recognised that although cyber security standards and frameworks are widely available, maritime and shipping businesses often lack the resources or expertise to implement them effectively, leaving them open to vulnerabilities which can be exploited to disrupt operations. 
 
To mitigate these risks, the following actions are planned to be activated:
  • Identify gaps in legal authorities and de-conflict government roles and responsibilities for the implementation of maritime cyber security standards.
  • The US Coast Guard will analyse cyber security reporting guidance between 2016 and 2020 to identify trends and attack vectors. The analysis will increase maritime sector situational awareness and decrease maritime cyber risk.
  • Develop and implement mandatory contractual cybersecurity requirements for maritime critical infrastructure owned, leased, or regulated by the Government to decrease cyber security risk because of supply chain attacks.
  • Develop procedures to identify, prioritise, mitigate, and investigate cyber security risks in critical onboard and shore-based systems.
 
Tripwire:    Seatrade-Maritime:     ICS Shipping:     MissionSecure:   Adv-Polymer:    CalhounNPS:   Image: 
 
You Might Also Read: 
 
Maritime Shipping Is A Prime Target In 2021:
 
 
« Cyber Criminals Publish Stolen Files
5G Could Be A Cyber Security Revolution »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

StickyMinds

StickyMinds

StickyMinds is the web's first interactive testing community exclusively engaged in improving software quality throughout the software development lifecycle.

StoneFly

StoneFly

StoneFly offers High Availability, high performance cluster and scale out storage, and backup and disaster recovery appliances.

Black Duck Software

Black Duck Software

Black Duck Hub allows organizations to manage open source code security as well as license compliance risks.

Bayshore Networks

Bayshore Networks

Bayshore Networks was founded to safely and securely protect Industrial IoT (IIoT) networks, applications, machines and workers from cyber threats.

PeCERT

PeCERT

PeCERT is the national Computer Emergency Response Team for Peru.

SEC Consult

SEC Consult

SEC Consult is a leading European consultancy for application security services and information security.

Digittrade

Digittrade

Digittrade develop and produce external encrypted hard disks and secure communications apps.

Swedish Board for Accreditation and Conformity Assessment (SWEDAC)

Swedish Board for Accreditation and Conformity Assessment (SWEDAC)

SWEDAC is the national accreditation body for Sweden. The directory of members provides details of organisations offering certification services for ISO 27001.

Andreessen Horowitz (a16z)

Andreessen Horowitz (a16z)

Andreessen Horowitz (known as "a16z") is a venture capital firm in Silicon Valley, California that backs bold entrepreneurs building the future through technology.

Hyperwise Ventures

Hyperwise Ventures

Hyperwise Ventures lead seed investments in startups in the cyber security and enterprise software spaces.

Firmus

Firmus

As the leading penetration testing services provider in Malaysia, Firmus evaluates the ability of your internal or external information assets to withstand attacks.

Infuse Technology

Infuse Technology

Infuse Technology provide the highest level of cybersecurity support, implementing practical solutions to protect against cyber-attacks, from simple phishing scams to complex data security breaches.

Green Enterprise Solutions

Green Enterprise Solutions

Green Enterprise Solutions are a Namibian company providing Information and Communication Technology (ICT) services to corporate Namibia.

Buguard

Buguard

Buguard is a multi-award-winning supplier of Application Security Assessments and GRC services.

XONA

XONA

XONA is The Zero Trust user access platform for the OT enterprise. Secure operational access to critical systems - from anywhere.

Metrics that Matter (MTM)

Metrics that Matter (MTM)

Metrics that Matter redefines how organizations approach cybersecurity by offering unprecedented insight into the value of their assets to criminals and tailored action plans to protect.