Cyber security strategies
Updated 11 Oct 2019
Cyber security strategies need to take into account two very different types of target and reasons for attack – deliberate or unintentional. Financial gain is at the root of most cyber crime so it might be assumed that companies considered wealthy will be targeted as highest priority, but as many will be prepared to testify there is no lower limit and criminals will chase tens or hundreds of dollars just as readily as thousands or tens of thousands.
There has been so much publicity around computer frauds and things such as false invoices and unusual bank transactions that astute business people should not be fooled by such practices, but that is no guarantee that they will not. Bill of lading fraud has existed for centuries and still occurs regularly and although the ways in which paper frauds are perpetrated are well understood, the potential for new ways of defrauding with digital documents is massive and not well understood at all. This sort of fraud has big implications for shipowners because the value of cargoes usually far outweighs the value of ships.
To the old frauds can be added new methods such as ransomware attacks in which a piece of malware takes control of computer systems and the attacker only promises to restore control on payment of a ransom.
Financial fraud has an obvious driving factor but cyber attacks on computer networks can merely be malicious, perpetrated by hackers who gain some perverse pleasure from their delinquent activity.
A malicious attack on a ship operator can be very debilitating and prevent cargo bookings, production of cargo documents, payments of ship dues and supply invoices that could lead to an arrest of the ship and much more. Attacks on shore networks need to be addressed because of the financial loss and disruption to services but attacks to systems and networks on ships are a clear danger to life and property.
When it comes to protecting commercial information and even commercial assets, the onus is clearly upon the shipowner to establish needs and put appropriate measures in place. However, when it is security of ports, nations and safety of navigation that is threatened something more – or perhaps less – is needed.
The concept of e-navigation and the inevitable increase of electronics and software/firmware in systems and instruments pose risks that need to be addressed now before they have the potential to become the cause of a disaster. As previously mentioned, early computer use on ships was limited to the stowage and loading computer and word processors. Neither of these systems was connected to each other or to any other ship systems. However, since then shipping has seen the advent of integrated navigation systems and mandatory carriage of ECDIS, and with VDR data from all of the main systems are fed into one place with the possibility of contamination growing all the time.
There is no requirement under any aspect of SOLAS or STCW for crew to have training in IT with regard to anti-virus security or system recovery except under GMDSS where it is an option for ensuring system availability. It is certainly not part of the ship security officer’s role under ISPS or of the safety officer’s under ISM, even if the ISM Code does require essential systems to be available at all times.
Often the operating system of navigation equipment is proprietary and even if a seafarer has been given training in one system, there is no guarantee that his expertise would be useful in the case of a different maker’s equipment. System makers have naturally promoted the benefits of their equipment but have been less forthcoming on the potential for systems to be infected by viruses. For example, an ECDIS could be updated with electronic ‘Notice to Mariners’ data using a memory stick that may last have been used to download something entirely different from an internet site or another personal device that has been infected by a virus or bot.
If a virus or malware can so easily be introduced into a ship’s navigation systems with the result that alarms are not sounded when they should be or – in a worst case scenario – control of the ship is hijacked by someone on shore, it is no use relying on the ship operator having put in place appropriate safeguards. More to the point, ships that are unaffected by a cyber attack may be put at risk by another that is.
Communication systems and cybercrime vulnerability
Communication systems are another area where recent changes bring risks that perhaps were not thought of at the initial stages of rollout. For the past decade, two things have been promoted as the future – crew communications and equipment monitoring.
Crew communications obviously have a welfare element but the traffic in and out is not intended to be monitored by officers and if the virus protection or firewalls that may be in place are not regularly updated then a system can easily be compromised.
It is hard if not impossible to prevent crew from innocently opening attachments to e-mails which they believe to be genuine, but which may be malicious attempts to attack the system from which it is activated. However, if the problem of cybercrime continues to grow, ship operators may have no option but to limit crew communications in some way.
Equipment monitoring should not present a threat in itself but since it uses the communications system to send data, there is always a possibility that a compromised communication system could under some circumstances transmit corrupt data that could be interpreted as there being a problem that requires attention when no such situation actually exists. Where equipment monitoring also extends into the possibility to make remote adjustments to settings, then the possibility for more threatening situations arises.
Autonomous ships have become a topic of discussion over recent years and some trials have already taken place of controlling ships remotely. The term does not necessarily imply that ships will be unmanned but some projects under way do envisage that. Obviously an unmanned vessel – or even one where many systems are operating autonomously – will be reliant more on communications than would a ship with a crew who can take on the manual operation of the vessel.
Some have questioned whether the cargo community would be willing to load valuable cargo on ships that could, in theory, be hi-jacked over the airwaves and diverted. Proponents of autonomous ships think that is a very unlikely situation, although they have not committed to saying it could not happen. The main cause of concern is that if communication between the vessel and shore is lost, information could not be relayed in either direction.
Lost communications might result from a number of causes of which a cyber attack is just one. The attack need not be aimed at the shipping company or the ship but could equally be directed at power supplies or general communication systems.
As with autonomous ships, much has been written about the benefits of blockchain in shipping. Blockchain is a system in which a record of transactions made between parties are maintained across several computers that are linked in a peer-to-peer network. While this is obviously done by electronic communications, it does not actually improve the security of communications but could help prevent things such as bill of lading fraud or assist in transparency of supply chains.