What is Maritime Cybersecurity?
Maritime cybersecurity is the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies used to protect maritime organizations, their vessels, and their cyber environment.
the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies used to protect maritime organizations, their vessels, and their cyber environment.
And according to the International Maritime Organization(IMO), maritime cyber risk refers to a measure of the extent to which a technology asset could be threatened by a potential circumstance or event, which may result in shipping-related operational, safety, or security failures as a consequence of information or systems being corrupted, lost or compromised.
Many of the globally connected networks and infrastructures at sea still leverage legacy technologies that were not built to be connected to the Internet. These complex networks include a blend of information technology (IT) and operational technology (OT) systems (we’ll cover those in the next section) used by internal crew and third-party vendors, extending the potential for a compromise by hackers or insider threats.
There was a time when connectivity on a vessel was minimal, and ship control engineers addressed security issues with air gapping to physically isolate a secure network from unsecured networks. By definition, an air-gapped system is neither connected to the Internet nor any other system. But now, using something as simple as a USB flash drive USB or unsecured Wi-Fi connection, a malicious hacker or even an inexperienced insider could infiltrate and infect critical systems. This development is especially concerning given the connectivity of modern maritime vessels.
Whether moving dry or liquid bulk, containers or cars, crude oil, products, or chemicals, the maritime industry is a critical backbone of our global economy. Protecting a vessel’s critical operations from cyber threats poses unique challenges with operation centers and fleets of numerous classes and vintages spread across the world, increasingly digitalized operations, and a complex environment merging IT with industrial control systems (ICS) and operational technology (OT).
How do IT and OT Cybersecurity Differ?
Operational technology (OT) is hardware and software that detects or causes a change through the direct monitoring and control of industrial equipment, assets, processes, and events. In contrast, information technology covers the entire spectrum of technologies for information processing, including software, hardware, communications technologies, and related services.
Before we delve into the cybersecurity challenges affecting the maritime industry, let’s take a step back and examine some of the differences between IT and OT systems. Some of the differences in system requirements include:
Differences in System Requirements
IT System Requirements | OT System Requirements | |
|---|---|---|
| Performance |
|
|
| Availability/Reliability |
|
|
| Risk Management |
|
|
| System Operations |
|
|
| Resource Constraints |
|
|
| Communications |
|
|
| Component Lifetime |
|
|
| Component Location |
|
|
From a cybersecurity perspective, OT and IT are different in several ways. On staffing, there is a cybersecurity specialization on the IT side. Professionals have been specifically trained and certified in application security, network security, or other security disciplines. In OT, those tasked with security are usually operational technology people. As part of their day job, they have to also deal with security—it’s an add-on, not a specialization.
OT and IT are different, especially in attack outcomes. An attack on IT could lead to data theft, while an attack on OT could lead to injury or loss of life, asset damage, or environmental impact. Traditional cybersecurity measures fail to protect vessels from cyber-attacks and leave the OT network exposed, falling short on providing the visibility and protection required for cyber-physical processes underlying in the maritime industry. And with the convergence of IT and OT, organizations must balance the use of traditional IT security tools at the network and endpoint layer with specialized security tools designed for OT requirements.
What are the Cybersecurity Challenges Affecting the Maritime Industry?
Many of the common cybersecurity challenges that affect the maritime industry mirror those in other industries that deal with IT networks:
- No clear understanding of all systems and devices on the OT network across a fleet or operation
- Lack of visibility into each vessel’s OT networks
- Lack of real-time monitoring or segmentation of the OT network
- Inadvertently connected IT and OT networks
- Use of unsecured wireless networks
- 24/7 remote access granted to third-party OEMs
- Lack of visibility into third-party OEM networks (black box)
- Poor physical security controls
- Lack of cybersecurity awareness among the crew, employees, and contractors
Potential Maritime Cybersecurity Attacks
Cybersecurity is not just about preventing hackers from gaining access to systems and information. It is also about protecting digital assets and data, ensuring business continuity, and ensuring that the maritime industry is resilient to external and internal threats. It is crucial to keep ship systems safe from physical attacks and to ensure the integrity of supporting systems.
The complexities associated with vessels and tankers make them vulnerable to high-impact attacks. Cyber incidents can last for hours, days, or weeks. When one ship is impacted, it can often spread malware to sister vessels via the corporate network. Some of the potential attacks that can cripple a vessel’s operations include:
- An attack on an OEM network or third-party supplier that spreads to their client’s on-vessel OT network
- An attack on a satellite provider that gains access to a vessel’s IT/OT network
- Exploited cyber vulnerabilities that grant access to a vessel’s OT network and provide various attack options, including:
- GPS/navigation system attack
- Open/close critical valves
- Propulsion and rudder control
- Ballast control
- Ransomware/Malware
- Gain full administrative privileges.