In today's digital age, the importance of information security and data protection cannot be overstated.
Even prominent IT companies that specialize in developing complex software, hardware solutions, internet platforms, and IoT devices often struggle to meet the ever-evolving demands of cybersecurity.
Recent incidents of data breaches and cyberattacks targeting well-known industries like Paypal, Cloudware, Microsoft, and others in 2023 have highlighted the widespread impact of such events.
These occurrences not only affect the companies themselves but also have implications for their users, which includes ourselves, our friends, and our family members.
It is projected that cybercrime will result in a staggering loss of $8 trillion by the conclusion of 2023, accounting for nearly one-third of the United States' GDP in 2022.
Moreover, the global impact of cybercrime is anticipated to grow by over 15% annually, reaching a staggering $10.5 trillion by 2025.
Table Of Contents
- The digitalization of maritime industry
- Definition of maritime cybersecurity
- Importance of cybersecurity towards maritime
- Ship automation system
- Types of cyberattack on maritime industry
- Generating counterfeit "man-in-the-water" signals
- Disseminating fabricated weather reports
- Attack on GPS and navigational technology
- ECDIS receiving inaccurate sensor data
- Failure of global navigation satellite system (GNSS)
- System disruption on radar
- Hacking into video surveillance systems (VSSs)
- Data breaches
- Recent cyber attack case studies on marine industries
- Factors causing cyber attack
- Lack of encryption
- Growing reliance on computer services
- Crews lack of awareness and training in cyber security
- Marine industry may exhibit complacency
- Costly to protect against cyberattacks
- Cyber risk management plans
- Identify potential threats
- Identify vulnerabilities
- Evaluating the level of risk exposure
- Creating measures for protection and detection
- Formulating contingency and incident response (IR) plans
- Improve employees' their understanding on cybersecurity
- Protecting from the inevitable future
The Digitalization Of Maritime Industry
The maritime industry is undergoing a significant transformation with the widespread adoption of digitalization, operational integration, and automation.
Shipbuilders and operators at the forefront of innovation are embracing cutting-edge technologies and systems to develop ships that surpass traditional designs flaws.
These modern vessels are equipped with advanced features like remote control, seamless communication, and enhanced connectivity, enabling them to operate efficiently in the ever-evolving maritime landscape.
These capabilities have been put to the test in various autonomous vessel projects. One notable example is the Mayflower, which aimed to be the first fully autonomous vessel to cross the Atlantic Ocean using Artificial Intelligence (AI) technology and solar energy.
While the initial attempt was unsuccessful, the vessel is scheduled to make another voyage across the Atlantic in 2022. Additionally, the Nippon Foundation plans to conduct a test of the first fully autonomous long-range commercial sail by February 2022.
Autonomous vessels and modern ships are equipped with an array of sensors such as radar, LiDAR, high-definition cameras, thermal imaging, and sonar, among others.
These sensors, along with interconnected Operational Technology (OT) systems, provide the ship's AI with a comprehensive view of its surrounding environment.
The progression of automation in the maritime industry spans from fully manned vessels to partially operated, remotely operated, partially autonomous, and fully autonomous unmanned ships.
As the shipping sector embraces Information and Communications Technology (ICT), there is a surge in cyber risks, amplifying existing vulnerabilities and introducing new ones.
Consequently, ensuring the safety and security of autonomous ships cannot solely rely on past knowledge and established practices.
A novel security approach is imperative, one that encompasses all onboard and onshore systems and their interplay.
This approach acknowledges the evolving nature of cyber threats and emphasizes the interconnectedness of diverse systems to safeguard the comprehensive well-being of autonomous ships.
Definition Of Maritime Cybersecurity
Maritime cybersecurity encompasses a comprehensive set of measures and practices aimed at safeguarding maritime organizations, their vessels, and their digital environments from cyber threats.
It includes:
- Deployment of effective tools
- Implementation of robust security policies and concepts
- Establishment of security safeguards and guidelines
- Adoption of risk management approaches
- Execution of proactive actions
- Provision of relevant training
- Adherence to best practices
- Assurance of security measures
- Utilization of advanced technologies
The goal of maritime cybersecurity is to ensure the resilience and integrity of maritime operations in the face of evolving cyber risks and challenges.
Importance Of Cybersecurity Towards Maritime
Globalization has led to a significant reliance on complex computer systems and global information networks by nations.
While this dependence brings numerous benefits, it also exposes the maritime sector to increased vulnerabilities and threats that can potentially compromise safety.
Certain systems within these ships are often susceptible to attacks due to their perceived lower importance in terms of security and performance.
The reliance of cyber-enabled ships on digital services makes them highly critical infrastructures.
From 2001 to 2017, there have been recorded instances of at least six incidents that directly impacted port operations. These attacks specifically targeted the cargo management systems utilized by port operators.
According to the 2022 PWC report on the transportation and logistic sector, the risks have escalated as companies have expanded their network of interconnected systems, particularly through operational technology (OT) and industrial control systems (ICS).
This increased connectivity has led to a higher probability of incidents that can have significant impacts not only on the targeted company but also on its customers and third-party entities due to supply chain and sector interdependencies.
In response to this scenario, ransomware actors have taken advantage of the situation and have launched aggressive attacks, frequently targeting transport and logistics firms.
(Source: Cyber Threats 2022: A Year in Retrospect )
Therefore, any malicious disruption to their operations can have severe consequences, including financial and environmental damage, as well as potential risks to human safety.
The data presented highlights the criticality of maritime cybersecurity in today's digital landscape.
As the maritime industry becomes more interconnected and reliant on technology, the significance of protecting sensitive data and ensuring the secure operation of vessels and maritime organizations becomes paramount.
The potential consequences of cyber threats in the maritime sector can range from operational disruptions and financial losses to compromising the safety of crew, vessels, and cargo.
It emphasizes the need for robust cybersecurity measures, proactive risk management, and a strong cybersecurity culture within the maritime industry to mitigate cyber risks effectively and safeguard the integrity and resilience of maritime operations.
Ship Automation System
Modern and autonomous ships have significantly improved safety at sea with the implementation of complex automated systems.
These systems encompass a wide range of critical components onboard ships, including navigation systems, radar, communication systems, and control systems for various electromechanical systems such as the main engine, generators, converter drives, and more.
Below listed are the variety of complex automated system:
- Electronic Chart Display and Information System (ECDIS)
- Global Positioning System (GPS)
- Global Navigation Satellite System (GNSS)
- Automatic Identification System (AIS)
- Global Maritime Distress System (GMDSS)
- Global Industrial Control Systems (ICSs)
- Very Small Aperture Terminal (VSAT)
- Propulsion Control Systems
- Video Surveillance System
- IT Network Systems
- Radar
With the growing complexity, digitalization, and automation of systems in the maritime industry, modern ships and vessels face a multitude of new challenges when it comes to ensuring the security and protection of their onboard IT systems.
In the maritime industry, there have been numerous reported cases of cybercrime, while many others remain undisclosed due to shipowners' reluctance to report them, fearing potential damage to their reputation.
Therefore, cybersecurity plays a critical role in safeguarding the safety of the crew, vessel, cargo, and ports within the maritime industry.
Types Of Cyberattack On Maritime Industry
The growing reliance on automation and IT systems in contemporary vessels offers a prime target for hackers and malicious individuals seeking to exploit vulnerabilities and carry out cyberattacks.
These attacks pose a serious threat, as they have the potential to cause catastrophic incidents and result in significant safety losses.
The consequences of such cyberattacks can be significant, ranging from compromising the safety and security of the vessel to causing operational disruptions and financial losses.
There are two primary categories of cyber attacks that can impact marine companies or ships: untargeted attacks and targeted attacks.
Untargeted attacks
These attacks aim to exploit potential vulnerabilities in multiple companies or ships. They are not specific to any particular target and are typically carried out in a broader scope.
Untargeted attacks typically involve various methods aimed at compromising a ship's systems and data.
These can include social engineering tactics, phishing attempts, scanning for vulnerabilities, and deploying ransomware to disrupt operations and demand payment.
Targeted attacks
In contrast, targeted attacks are specifically directed at a particular company or ship. They are often more challenging to prevent or deter as they involve a focused effort to breach the defenses of a specific target.
Examples of targeted attacks include:
- Spear phishing, which involves personalized and deceptive emails to trick individuals into revealing sensitive information
- Distributed denial of service (DDoS) attacks that overload a ship's systems to disrupt its services
- Subverting the supply chain to introduce malicious components
- Compromise the integrity of critical systems
The existing vulnerabilities in IT systems onboard ships can be exploited by malicious actors, creating potential cyber threats that include:
1. Generating counterfeit "man-in-the-water" signals
By instigating false "man-in-the-water" signals, malicious actors seek to divert attention and resources from actual emergencies.
Resulting in potentially leading to delayed response times and hindering rescue operations when genuine distress situations occur.
2. Disseminating fabricated weather reports
The transmission of counterfeit weather reports can misguide ships, compromising their route planning and increasing the risk of collisions, groundings, and overall maritime safety hazards.
3. Attack on GPS and navigational technology
Attackers have been able to reroute vessels undetected by spoofing GPS signals, bypassing system safeguards and alarms designed to prevent such unauthorized actions.
During a recent incident in South Korea, the deliberate jamming of GPS signals disrupted the reception of over 1000 aircraft and 700 ships for a period exceeding one week.
This interference caused significant disruptions to navigation systems, leading to operational challenges and potential safety risks for the affected aircraft and vessels.
4. ECDIS receiving inaccurate sensor data
Security vulnerabilities have been identified in ECDIS software, revealing potential risks that could be exploited by attackers.
These flaws could enable unauthorized individuals to delete or reinstall system files and even inject malicious content into the ECDIS.
Consequently, manipulated sensor data can be transmitted to the ECDIS, compromising navigation judgments and potentially leading to collisions.
5. Failure of global navigation satellite system (GNSS)
The failure of GNSS can have far-reaching consequences, extending beyond the disruption of navigation systems alone but other ship systems, such as the Automatic Identification System (AIS).
Cyberattacks can lead to complete control of critical operations, enabling a broader range of attacks and motivations for intruders.
6. System disruption on radar
During a cyberattack, radar systems can be manipulated to produce false echoes, providing inaccurate information about nearby objects. This can lead to ship collision accidents as operators rely on this data for navigation.
7. Hacking into video surveillance systems (VSSs)
Video Surveillance Systems (VSSs) play a crucial role in monitoring and safeguarding critical ship operations from potential threats like terrorists and pirates.
Unfortunately, these systems are susceptible to buffer overflow vulnerabilities. Exploiting such vulnerabilities allows intruders to track camera activities, overwrite passwords, and potentially crash the VSS system.
Moreover, this vulnerability can serve as an entry point for further cyberattacks, posing a significant risk to ship security.
8. Data breaches
Malicious actors may steal sensitive information such as crew details, cargo manifests, or operational plans, leading to privacy breaches and financial losses.
A notable cybersecurity incident occurred recently, involving the French shipping company CMA CGM. The company became the target of a ransomware cyberattack that had significant consequences.
During the breach, hackers gained unauthorized access to the company's IT systems, compromising sensitive data and disrupting operations.
The attack resulted in a significant data breach, potentially exposing customer information, operational details, and business-sensitive data.
Recent Cyber Attack Case Studies On Marine Industries
According to a research done on cyber security in the maritime industry, there has been a notable increase in reported cases of successful cybercrimes targeting the maritime industry in recent years.
Notably, even the world's largest maritime shipping companies, including A. P. Moller-Maersk, China Ocean Shipping Company (COSCO) Group, and Mediterranean Shipping Company (MSC), have experienced significant cyberattacks since 2017.
Furthermore, the maritime industry experienced a significant surge in cyberattacks in 2020, with a reported increase of 400 percent.
Specifically, attacks targeting ships and port systems saw a staggering 900 percent increase over the previous three years.
These statistics highlight the alarming reality that the maritime sector has become a prime target for malicious cyber actors.
These attacks are typically motivated by various factors, including:
- Gaining unauthorized remote control over ships and vessels
- Stealing valuable and sensitive information for future attacks
- Intentionally disrupting the ship's operations by compromising critical components and rendering automated systems inoperable
Ransomware and phishing are prevalent tactics and methods of compromise that are widely present in the maritime transportation sector (MTS).
These two types of cyber threats have affected numerous entities within the industry.
Maersk’s NotPetya incident
Maersk, a prominent shipping company, encountered a severe disruption to its business operations when the NotPetya malware infiltrated its systems in 2017.
The malware spread through an infected Ukrainian tax-preparation software called MeDoc. Maersk had to invest over $300 million in restoring its operations, which took approximately ten days to complete.
This significant expenditure was necessary to address the damage caused by the cyberattack and implement necessary repairs and remediation measures.
COSCO incident
COSCO Shipping Lines experienced a cyber attack that disrupted its internet connection at its offices in America in 2018.
The incident resulted in the malfunctioning of local email and network telephone systems. As a precautionary measure, the company opted to suspend its connections with other regions to conduct a thorough investigation.
Additionally, the cyber attack had an impact on COSCO's terminal operations at the Port of Long Beach.
MSC malware attack
Mediterranean Shipping Company (MSC) has experienced a malware attack, resulting in the disruption of its digital tools and website.
The incident specifically affected the company's data centers in Geneva, leading to a network outage. As a consequence, MSC's digital booking tool, myMSC, was temporarily unavailable.
However, the company's agents worldwide swiftly adapted to alternative methods to ensure a seamless cargo flow during the disruption, maintaining uninterrupted operations.
HMM Cyber Attacks
HMM, the national flagship carrier of South Korea, has recently experienced a cyber attack targeting its email server. This incident has significantly affected the company's email communication system.
HMM became the fifth container shipping company to face information security threats following a series of cyber attacks on other major shipping companies including CMA CGM, MSC, COSCO Shipping, and Maersk.
Safeguarding email systems and implementing comprehensive cybersecurity protocols are crucial for protecting sensitive information and ensuring the smooth functioning of operations in the maritime industry.
However, despite these concerning trends, the industry and its regulatory bodies have been relatively slow in adopting substantial and comprehensive measures for addressing these cybersecurity challenges.
This gradual response underscores the need for more proactive and systemic changes to safeguard the maritime industry against cyber threats.
Factors Causing Cyber Attack
Despite the increase in usage of digital platforms in the maritime industry, there is a noticeable hesitation to adopt preventive security measures, thereby leaving shipowners and operators vulnerable to cyber attacks.
The following are FIVE factors why the maritime industry is more susceptible to these attacks than it might realize:
1. Lack of encryption
The maritime industry relies on various networks to transmit data collected and processed by interconnected information systems. Networks like SHIPNET and SAFENET are commonly used.
These technologies are susceptible to security vulnerabilities due to inadequate attention given to authentication and encryption methods in the design and configuration of communication links.
Modern vessels incorporate computer systems with specialized hardware and software solutions to automate various functions such as navigation, propulsion, and fuel supply.
These systems offer real-time and dependable information to the crew, enhancing response times and reducing personnel expenses.
By providing a comprehensive view of the vessel's status, these computer systems optimize operations and contribute to improved efficiency and cost-effectiveness.
Outdated and potentially vulnerable systems are accessible on the internet. Additionally, the integration of shipboard IT systems with onshore facilities amplifies the risk of continuous and systematic threats.
The modern shipping industry's financial, legal, and remote monitoring requirements drive the need for IT systems and network connectivity.
However, these systems expand the attack surface for security teams to defend and create additional entry points that hackers could exploit.
2. Growing reliance on computer services
According to Marsh & McLennan Companies, the maritime sector is increasingly dependent on computerized systems that are ill-prepared to address the evolving threats of the 21st century.
According to Israeli cybersecurity consultancy Naval Dome, there was a significant surge in attempted hacks during the period between February and June 2020.
They reported a staggering 400% increase in these cyber attack attempts, which coincided with the maritime industry's increased reliance on technology and remote work practices due to the COVID-19 pandemic.
With the growing connectivity of ships and offshore units, as well as the utilization of numerous internet-connected computer programs, the vulnerability of these systems is expanding.
This heightened reliance on technology creates an open door for potential hackers, leaving the maritime industry susceptible to cyberattacks.
3. Crews lack of awareness and training in cyber security
A survey conducted by NSSLGlobal involving 571 crew members highlighted that 64% of them acknowledged their responsibility for the security of on-board IT systems.
However, the majority of maritime employers do not provide adequate support to help crew members understand the risks they face and how to effectively mitigate them.
Moreover, issues can arise with onboard equipment and hardware, particularly when not all crew members possess comprehensive knowledge of their operation during disruptions or emergencies.
This lack of familiarity and knowledge towards their operation can result in more severe consequences and hinder effective vessel operations.
The 'human factor' is widely recognized as the primary risk in cybersecurity at sea, with the majority of attacks targeting people rather than IT infrastructure.
According to research conducted by IBM, human error is identified as the root cause in 95% of cybersecurity breaches.
This means that if human error could be completely eliminated, it is estimated that 19 out of 20 cyber breaches could have been prevented.
4. Marine industry may exhibit complacency
The maritime industry can sometimes exhibit complacency when it comes to cybersecurity.
This complacency arises due to various factors such as lack of awareness, limited resources, and underestimation of the potential risks.
Peter Hinchliffe, Secretary General at the International Chamber of Shipping, acknowledges that the maritime industry is gradually realizing the importance of cybersecurity.
With the rapid advancement of technology in ships, there is a growing need for comprehensive guidelines and contingency plans to address the evolving cyber threats.
5. Costly to protect against cyberattacks
Many companies in the maritime industry perceive cybersecurity preventive measures as costly and unnecessary.
They often underestimate the likelihood of a cyber attack and, as a result, question the value of investing in safeguards.
HOWEVER…
The reality is that the financial consequences of a cyber attack can far outweigh the initial investment in cybersecurity. The potential damage to operations, reputation, and the potential for legal liabilities can be significant.
It is crucial for companies to understand that cybersecurity is not just an expense, but a strategic investment to protect their assets, maintain business continuity, and safeguard their reputation in the long run.
BUT wait…
What if there’s a better and cheaper solution for this issue?
Athena Dynamics Academy, launched by the reputable cyber security advisory company Athena Dynamics, is now offering an accessible online course that delves into various aspects of cybersecurity.
This course provides the opportunity to acquire valuable cybersecurity knowledge at your convenience, with the flexibility to learn anytime and anywhere.
Upon successful completion of the course, participants will receive a certificate of completion, showcasing their commitment to enhancing their cybersecurity skills.
Don't miss this chance to expand your cybersecurity expertise with Athena Dynamics' accessible and comprehensive online course!
Cyber Risk Management Plans
To safeguard against such risks, it is imperative for the maritime industry to prioritize robust cybersecurity measures to protect the integrity of ship operations and ensure the safety of crews, vessels, and cargo.
It is crucial for the maritime sector to remain vigilant and implement robust cybersecurity measures to mitigate these risks and protect against potential cyber threats.
The Cyber Risk Management plans and procedures of the company should complement the existing security risk management requirements stated in the ISM Code and the ISPS Code.
Moreover, it is important to foster a safety culture that incorporates cybersecurity at all levels, from top management onshore to onboard personnel.
By recognizing cybersecurity as an integral part of the safety culture, the company can ensure the secure and efficient operation of its ships.
This entails integrating cybersecurity measures within the existing safety practices and procedures, aligning them with the company's overall risk management framework.
Such an approach enables comprehensive mitigation of cyber risks while maintaining a strong commitment to safety.
Identify potential threats
Cyber risk in the maritime industry varies based on the company, ship, operation, and trade. Organizations should consider specific aspects of their operations that may increase vulnerability to cyber incidents.
Motives for exploiting vulnerabilities range from unintentional human error to deliberate malicious actions by disgruntled employees.
Understanding these risks and motivations is vital for implementing effective cybersecurity measures.
Identify vulnerabilities
To ensure cybersecurity in the shipping industry, it is advised for companies to conduct a thorough assessment of potential threats and evaluate the resilience of their systems and onboard procedures.
This assessment will help identify key risks and develop a strategy to mitigate them.
Standalone systems are generally less susceptible to external cyberattacks than those connected to uncontrolled networks or the Internet.
It is important to carefully consider the connections between critical onboard systems and uncontrolled networks to minimize vulnerabilities.
Evaluating the level of risk exposure
Senior management within a company should take the lead in conducting cyber risk assessments, rather than immediately delegating the task to specific individuals or departments.
Heightening cybersecurity and safety measures may impact standard business procedures and operations, requiring senior management to evaluate and make decisions regarding risk mitigation.
It is important to recognize that initiatives related to cyber risk management may extend beyond IT systems and involve business processes, training, vessel safety, and the overall organizational structure.
Additionally, efforts to enhance cyber awareness may necessitate changes in how the company interacts with customers, suppliers, and authorities, requiring senior management to determine the approach and drive these relationship changes.
Creating measures for protection and detection
The primary objective of a company's risk assessment and cybersecurity strategy is to minimize risk to a reasonable level.
This entails implementing necessary measures at a technical level to establish and uphold a predetermined level of cybersecurity.
Furthermore, it is essential to determine how cybersecurity will be managed onboard and to assign responsibilities to the master, responsible officers, and, when relevant, the company security officer.
By clearly defining these roles and responsibilities, the company can ensure effective cybersecurity management throughout its operations.
Formulating contingency and incident response (IR) plans
It is crucial to recognize that cyber incidents may persist if not properly addressed.
For instance, if malware infects the emergency chart display and information system (ECDIS), activating the backup ECDIS could lead to another cyber incident.
Therefore, it is recommended to have a well-defined plan for cleaning and restoring infected systems.
Disaster recovery (DR) plans should be an integral part of a comprehensive maritime security plan.
These plans encompass preserving cyber data for forensic purposes, as well as restoring and safeguarding operational technology (OT) processes and ship controls.
Regular exercises and updates of these plans, both at sea and on shore, are essential. It is important to involve any third-party system providers in the planning and execution of these exercises.
Any insights gained from past cyber incidents should be used to enhance response plans for all ships in the company's fleet, and consideration should be given to developing an information strategy for such incidents.
Improve employees' their understanding on cybersecurity
Indeed, there is a significant lack of awareness among workers regarding the importance of learning cybersecurity.
This lack of awareness contributes to the overall vulnerability of organizations and their systems to cyber threats. It is crucial to address this issue and emphasize the significance of cybersecurity education and training.
Organizations should take proactive measures to educate their employees about cybersecurity risks, best practices, and the potential impact of cyberattacks.
Training programs can help employees understand their role in maintaining a secure work environment, recognizing and reporting potential threats, and following cybersecurity protocols.
Protect Marine Industry From The Inevitable Future
The maritime industry is increasingly targeted by cybercriminals due to its critical infrastructure status.
Successful cyberattacks can lead to ship shutdown, data disclosure, AIS manipulation, and facilitation of criminal activities.
Therefore, protecting IT and OT systems in modern ships is crucial, including the implementation of new security standards.
However, challenges persist, especially with autonomous vessels. Efforts should focus on robust cybersecurity measures, threat detection, and industry collaboration to enhance resilience against cyber threats.
