Maritime Shipping Is Badly Exposed

A recent US Coastguard safety alert issued  caught the attention of the broader maritime industry, from the US Navy to multinational shipping companies. The alert documented an incident in February where a deep draft vessel on an international voyage sailed into the Port of New York and New Jersey with its shipboard network impaired from an active cyber-attack. 
 
The team of cyber experts who responded to the incident found that “although the malware significantly degraded the functionality of the onboard computer system, essential vessel control systems had apparently not been impacted.” 
 
Not surprisingly, they also found that the vessel was “operating without effective cyber security measures in place, exposing critical vessel control systems to significant vulnerabilities.”
 
Cyber Pirates and Zombie Ships
The maritime industry has been discussing how emerging attack surfaces could increase the risk of cyber-attacks capable of crippling ships, or even potentially hijacking autonomous vessels at sea, and the incident brought those conversations to the forefront.
 
Key public and private interests have been actively aware of the challenges created by increasingly connected and automated vessels, and together they have done a good job of engaging with cyber-security vendors to address emerging risks for connected hull, mechanical and electrical (HM&E) systems. However, there is a glaring area of vulnerability on the port management side that has not been fully discussed or addressed: connected systems at our nation’s ports.
 
Rise of the Robo Harbor-Master
Port authorities manage the flow of ships in and out, and the flow of cargo off and on each of those ships. Currently, these processes are primarily human directed, an incoming ship will typically check in with a harbormaster and its freight is signed for on paperwork. 
 
It’s a process rife with inefficiencies, and nations and cities are actively working to automate port systems.
The key is establishing identity and tying that identity to the supply chain, taking images of each ship’s serial number, then attaching that marker to its cargo, the dockworker checking it in, and down the chain to the truck that pics up each container. 
Most of the IoT systems now being put in place to digitise these process have not been built with security in mind and are very easy to penetrate.
 
If those systems can be compromised, then high-risk security events could happen, such as having a bad actor tell the system to permit specific containers to pass through a port unsearched. This is how a lot of contraband gets into the country.
With great connectivity comes great risk
 
In order to secure port authorities, two significant challenges must first be addressed.
 
1. Port operations typically fall under municipalities and are governed with fixed, low budgets, meaning they lack the spend and manpower to manage the kinds of dynamic threats that arise through automating processes. The technology costs of automating processes are high, but ports are increasingly able to justify the spend by pointing to what will be saved through the resulting efficiency improvements. 
 
What ports frequently fail to recognise is that the skillset needed to manage the complexity that comes with such a move frequently look very different than what staff can manage. 
 
2. There is great potential for efficiency by marrying the identity of a ship to its cargo to the dockworker checking it in to the truck picking up the cargo, but linking those together is very difficult. The only way to do it is through automation, but that connectivity creates a lot of risk that ports are ill-equipped to deal with. 
 
Cyber security risks aside, there is no framework for establishing accountability throughout the process. Who will be responsible for making sure what is in a container remains in that container?
 
Today, there are no standards and no oversight organisation tasked with creating a standardisation process.
 
Interconnected Systems require Zero Trust
Digital transformation requires all systems and sensors to be interconnected to achieve the desired business automation. The approach to interconnecting these on a shared network should use a ‘zero trust’ approach to segmenting network connectivity. 
 
HelpNetSecurity
 
You Might Also Read:
 
Cyber-Attacks On Maritime Oil Tankers:
 
 
« Extra-Terrestrial Hacking
Proactivity Is Key To Effective Cybersecurity »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

SureCloud

SureCloud

SureCloud is a Governance, Risk and Compliance (GRC) and Cybersecurity Solutions provider.

ForgeRock

ForgeRock

ForgeRock, the leader in digital identity, delivers comprehensive Identity and Access Management solutions for consumers, employees and things to simply and safely access the connected world.

Phoenix Contact Cyber Security

Phoenix Contact Cyber Security

Phoenix Contact Cyber Security is a leading manufacturer of network security appliances for use in industrial environments.

FinalCode

FinalCode

FinalCode offers a file encryption and file-based enterprise digital rights management (eDRM) platform.

Safe Security

Safe Security

Safe Security (formerly Lucideus) provides Cyber risk assessment services and platforms to multiple Fortune 500 companies and governments across the globe.

Atlantic Security Conference (AtlSecCon)

Atlantic Security Conference (AtlSecCon)

Atlantic Security Conference is a non-profit, annual, information security conference located in Halifax, Nova Scotia, Canada.

IPification

IPification

IPification is a highly secure, credential-less, network-based authentication solution for frictionless user experience on mobile and IoT devices.

Chainlink

Chainlink

Chainlink expands the capability of smart contracts by enabling access to real-world data and systems without sacrificing the security and reliability guarantees inherent to blockchain technology.

Cyber Lockout

Cyber Lockout

Comprehensive ransomware insurance and preventative cybersecurity technology solution, working together to help protect businesses 24/7/365.

Mainstream Technologies

Mainstream Technologies

Mainstream Technologies is an information technology services firm specializing in custom software development, managed IT services, cybersecurity services and hosting.

Across Verticals

Across Verticals

Across Verticals is a boutique cyber security consulting firm that specializes in holistic, deeply technical and end to end cyber security advisory services based on industry best practices.

Hexens

Hexens

Hexens introduces a whole new approach to cybersecurity solutions. Indisputable skills and a unique super-focused perspective on every single case are the values we create.

WheelHouse IT

WheelHouse IT

WheelHouse IT secures, manages, and advances businesses with innovative, cost-effective IT solutions.

Sprocket Security

Sprocket Security

Sprocket Security protects your business by monitoring the cybersecurity landscape and performing continuous penetration testing services.

Corix Partners

Corix Partners

Corix Partners is a Boutique Management Consultancy Firm focused on assisting CIOs and other C-level executives in resolving Cyber Security Strategy, Organisation and Governance challenges.

Hughes Network Systems

Hughes Network Systems

Hughes are industry leaders in networking technologies and services, innovating constantly to deliver the global solutions that power a connected future for people, enterprises and things everywhere.