MPA Tables Major Cybersecurity Collaboration

By Max Schwerdtfeger

The Maritime Port Authority of Singapore (MPA) has tabled a proposal to form and lead an initiative to increase maritime security called the ‘Port Authorities Chief Information Officer Cybersecurity Network” (PACC-Net).

The proposal was made at the 5th Edition of the Port Authorities (PAR) 2019 and the initiative will look to enhance cybersecurity awareness in the maritime sector and facilitate early sharing of cyber-attack information to counter threats.

To continue reading, please click here.

Source: porttechnology.org

Advertisements

Cyber Hack: Fortifying Maritime, Port Security

Andrew Kinsey

The United States Coast Guard Marine Safety Alert 06-19 (USCG MSA 06-19) outlines a February 2019 incident aboard a deep draft commercial vessel that called on the Port of New York / New Jersey after experiencing a significant cyber incident that impacted their shipboard network. 

The Safety Alert stated in part:
“An interagency team of cyber experts, led by the Coast Guard, responded and conducted an analysis of the vessel’s network and essential control systems. The team concluded that although the malware significantly degraded the functionality of the onboard computer system, essential vessel control systems had not been impacted. Nevertheless, the interagency response found that the vessel was operating without effective cybersecurity measures in place, exposing critical vessel control systems to significant vulnerabilities.”

To continue reading, please click here.

Source: marinelink.com

Sensible Cyber Security for Maritime

By David Rider

In 2012, as piracy in the Indian Ocean began to wane, a number of private security companies began to transition from armed security services into other areas of business. For some, this meant moving into a general Risk area. Others, meanwhile, noticed that the shipping and port industries were slow to capitalize on the digital revolution and realized that those same companies were also exposing themselves, unwittingly, to cyber threats. The lack of expertise in the area allowed some companies to begin offering services and, in short order, the more traditional cyber security providers followed them in to the maritime domain.

Quiet on the Water

As of October 2019, to the best of my knowledge, there has not been a single, dedicated hacking attack against a vessel at sea by malicious actors. While there have been rumours – specifically one from an American telco provider in 2016 – that hackers have teamed up with pirates to track high value cargoes, there has been no firm evidence.

Equally, the dire warnings of ships having their navigation systems hacked so they could be directed to ports where pirates or criminal gangs could then ransack them have so far proven to be little more than interesting worst-case scenarios (I don’t even want to begin discussing the logistics of this, because they’re enormous and far outwith the means of most pirate groups).

What has been noted, however, is a rise in spear-phishing of vessels at sea. This has become an increasing problem and prompted the US Coast Guard – widely seen as being at the forefront of maritime cyber security – to issue a series of warning and advice notices in July 2019. They warned that emails purporting to have come from the US Port State Control authority were being sent to ships and disseminating malware throughout vessel systems. They reported that a merchant vessel bound for the Port of New York began to experience “a significant cyber incident impacting their shipboard network.”

An investigation found that, “although the malware significantly degraded the functionality of the onboard computer system, essential vessel control systems had not been impacted.” Additionally, and perhaps unsurprisingly, they noted that the vessel was, “operating without effective cyber security measures in place, exposing critical vessel control systems to significant vulnerabilities.”

While incidents like this are a genuine cause for concern, more commonly, the maritime domain has seen malware introduced into ship systems by crew and third party providers by accident. While these incidents have been, in some cases, hugely expensive to put right – any delay to a vessel costs money – they have so far fallen short of the scare stories suggested by some parties.

This is not to dismiss or minimise the threat of an actual, focused attack by an APT group on a shipping line or vessel. It could happen. Indeed, it probably will. But it hasn’t happened yet for a number of reasons, the main one being, Why? Why attack a ship? If we assume that most cyber attackers are criminal rather than terrorist or hacktivist, then the motives for attacking a ship at sea begin to fall away; there simply isn’t any profit in it, and return on investment is important to cyber criminals. It’s like mugging a bank teller rather than emptying the cash drawer.

The ongoing, real threat is and will always be found at a company’s head office. How the company deals with that will decide what any attacker does next. Outside the realm of hacktivism, criminals are looking for a payday, and that means they’re going to be looking for any vulnerability which can give them access to company bank accounts.

In the last few years, I’ve seen numerous reports of highly specific and convincing email fraud attempts against shipping companies, ports and ship brokers. In several instances, the hackers have infiltrated a company’s systems and then sat dormant, often for months, waiting for their opening. In one case, this involved sending spoofed emails to a client and redirecting payment of hundreds of thousands of pounds to the hacker’s bank accounts. Fortunately, thanks to quick-thinking staff, the fraud was discovered and the banks and police were able to stop the transfers. But this isn’t always the case.

Directed attacks remain a significant threat to any company, regardless of the business sector, and maritime is no different.

Shipping has so far managed to avoid the massive headline-grabbing attacks such as the $4.2 million stolen from an Oklahoma pension fund, or the $47 million initially stolen from networking firm, Ubiquiti in 2016, but the sector remains highly exposed due to a number of factors.

The Push for Efficiencies

As the maritime industry embraces digitization and the efficiencies and cost savings that come with it, security can often be taken for granted. Unfortunately, as those systems evolve, so do attackers. Their methods become more advanced and the paydays bigger. For example, phishing emails have been with us since the dawn of email. The question is how your company deals with them. There are a few questions you should ask yourself, or senior management:

• Does your company have a dedicated Chief Information Security Officer (CISO)?

• Are you a small organization reliant on third party software and consultants?

• Has your administrative staff been trained to recognize a phishing attempt?

• Are they aware of the risks of social engineering?

• Are they regularly updated with the latest threats and attacks in your sector?

If the answers to those questions are all Yes, then here’s another: does this extend to your crew on the water? Do your vessels employ specific measures to counter and combat attack or contamination?

Deep Fakes are Here

The persistent threat to most companies is the Business Email Compromise (BEC) or CEO Fraud. The good news is that it’s relatively easy to mitigate in most companies. The bad news is that it’s becoming highly sophisticated, thanks to ‘deep fakes’.

In September 2019, it was reported that a gang of cyber thieves had managed to steal $243,000 from a UK energy firm in a complex BEC attack that used an AI-generated voice of the company’s German parent firm’s CEO to authorize the transfer of funds. During the course of just three phone calls, the AI was convincing enough for the criminals to pull the fraud off. And, as the media reported at the time, “After the transfer, the funds were moved to Mexico and then to other countries, making the funds harder to track. No suspects have been identified.”

How would your company deal with such an incident? Are large financial transfers subject to face-to-face scrutiny with senior management? Well, they should be. You can no longer rely on a phone call or email to confirm that a transfer of funds has actually been authorized by senior management. Nor should you.

The threats to vessels at sea are more easily apparent. BIMCO has noted a number of incidents where malicious software was introduced to ship systems by accident, often by third parties contracted to check or even update specific bridge equipment, but crew introduction remains the more obvious route. Again, this is easily countered by enforcing strict protocols; blanking off USB ports and ensuring no crew equipment is plugged in to any ship computer systems being the most obvious. Again, training courses and refreshers should be offered to all crew, as well as more practical software protection.

Following the reported spear-phishing incidents this summer, the US Coast Guard suggested that basic cyber security practices be adopted by ships. These include:

• Implement network segmentation.

• Create network profiles for each employee, require unique login credentials, and limit privileges to only those necessary

• Be wary of external media

• Install anti-virus software

• Keep software updated

Basic, common sense moves designed to make breaking in to or disrupting your ship systems a little harder. Yet it’s surprising how few vessels adopt even these recommendations.

Mitigate and Educate

The good news is that over the last few years, maritime cyber specialists have entered the market and maritime cyber insurance policies have matured. Templar Executives, a UK cyber security specialist, teamed up with Wärtsilä to create the International Maritime Cyber Centre of Excellence (IMCCE), which consists of the Templar Cyber Academy for Maritime (T-CAM) and a Maritime Cyber Emergency Response Team (MCERT). Through its Cyber Academy, Templar now offers training for companies operating in the maritime domain, from C suites to crew and port officials, while the MCERT, with its 24/7 operations centre, is intended to share information on new attack vectors and prevent as many incidents as possible. As a result, it’s now being picked up by marine insurers, with Lampe & Schwartze in Germany partnering with Templar to launch a new Ship Owners Marine Cyber Cover.

The hope is that moves such as this will lead to companies reporting cyber intrusions and attacks in a timely manner. At present, there are no firm figures for maritime cyber security incidents; shipping companies are, in general, loathe to admit to them for a variety of commercial reasons. Anonymous reporting will certainly make that easier, as companies such as CSO Alliance hope. However, speed is key. It’s crucial that a company under attack share the information in order to allow others in the sector to bolster their own defences. In this case, sharing is definitely caring.

The Innocent Bystander

Of equal concern is the potential knock on effect from a wider malware attack. Few people in the maritime domain will be unaware of the NotPetya incident that affected Maersk in 2017. To call it massive would be an understatement. More worryingly, Maersk was simply unfortunate collateral damage in an attack that spread around the world and saw the company forced to rebuild its network of 4,000 servers and 45,000 PCs at a cost running into hundreds of millions of dollars.

The financial blow alone should be a salutary warning to most companies, but the fact that it happened as part of a domino effect should be more sobering. Your company doesn’t have to be directly targeted to be impacted.

Threat mitigation is good, but threat prevention is always better. These days, there are few excuses for any company not to adopt a robust cyber security policy for its land- and sea-based operations, particularly given the scale of the threat and its financial implications.

As the shipping industry begins to look seriously at the prospect of autonomous vessels, these same problems persist and insurance underwriters are already taking note. It will be interesting to see how the industry adapts to the challenges posed. The IMO will certainly be watching. As will the cyber criminals.

Autonomous Shipping – Cyber Hazards Ahead

By Jeffery Mayger

If autonomous vessels are the future of maritime shipping, then cyber threats may be its Achilles heel. 

Congested shipping, restricted visibility, limited maneuverability, and intensive docking activities all contribute to port hazards – 42 percent of EU reported marine accidents (injury/death/damage to ships) took place in port areas and 44 percent of workboat fatalities occurred on Tugs. Autonomous shipping should provide numerous benefits including increased safety by relieving crewmembers of unsafe and repetitious tasks. Yet, with cyberattacks threatening every industry, this nascent technology is a large target. If autonomous vessels are the future of maritime shipping, then cyber threats may be its Achilles heel.

To continue reading, please click here.

Source: marinelink.com

The Maritime & Port Security ISAO and Templar Executives Launch Maritime Cybersecurity Awareness eLearning Course

To kick-off National Cybersecurity Awareness Month (NCSAM) activities, the Maritime and Port Security Information Sharing and Analysis Organization (MPS-ISAO) and Templar Executives Ltd. are delighted to announce a strategic partnership and the launch of a new Maritime Cyber Security eLearning course. This industry tailored training allows customers to increase the cyber security competence of their workforce. It also provides a new baseline standard for cyber security awareness across the maritime industry, a mandate from the International Maritime Organization (IMO) required to be in effect by 2021.

The MPS-ISAO is a non-profit established to advance global maritime and port critical infrastructure cyber resilience headquartered at the Kennedy Space Center in Florida. Templar Executives, is a U.K.-based organization and founder member of the International Maritime Cyber Center of Excellence (IMCCE) encompassing the Maritime Cyber Emergency Response Team (MCERT) and Templar Cyber Academy for Maritime (T-CAM). Both MPS-ISAO and Templar Executives are trusted cyber security partners to the maritime industry. Recognizing the need to increase cyber security awareness across the industry, the partners have developed market leading content that delivers a well-rounded understanding of cyber security principals tailored to mariners, and all those involved the maritime industry, in an easy to consume format.

The Maritime Cyber Security eLearning course content covers a range of topics – from an Introduction to Maritime Cyber Security to Best Practices and Top Tips. It includes a short assessment for learners to test their knowledge and is also perfectly suited for shipboard low bandwidth communication requirements and mobile devices.

“The maritime industry has needed a course like this for a long time, because traditional learning formats which required classrooms or videos were a challenge for individual mariners to complete given the diverse operating environments throughout the industry,” said Scott Dickerson, the MPS-ISAO’s Chief Strategy Officer. “We are offering this eLearning course to the entire maritime community which meets the need across industry to provide awareness and track individual training completion.”

Dickerson continued, “Adversaries are targeting port and maritime critical infrastructure every day, so there is an urgent need to increase cyber security competency across the industry – from the very smallest to the very largest of organizations. Because the maritime industry is a globally interconnected ecosystem, cyber security best practices can no longer be optionally implemented. Protecting critical maritime infrastructure requires an all-hands approach and a cultural shift in our thinking to consider both the safety and security of maritime operations. We encourage everyone in the industry to understand what’s at risk and embrace their role as guardians.”

“Templar Executives is delighted to be partnering with MPS-ISAO to provide exclusive content for an enhanced Maritime Cyber Security eLearning course, delivered through the Templar Cyber Academy for Maritime,” stated Anu Khurmi, Managing Director for Templar Executives’ Global Services division. “The IMO has announced a series of important cyber security measures for shipowners, ship operators and ports within the ISM code which must be addressed by 2021. These include requirements that stakeholders must ’raise awareness on the Cyber risk’; and ’embed a culture of Cyber risk awareness’. Our joint eLearning course is easy to access and assimilate and provides a cost effective and sustainable response to delivering training and education that supports the awareness agenda. It also contributes to the up-skilling of individuals in an industry that is digitalizing at pace and which needs to develop a more sustainable and robust cyber resilience capability across the entire ecosystem.“

Christy Coffey, MPS-ISAO VP of Operations, added, “Since the MPS-ISAO’s inception in 2016, we have had a mission objective to improve cyber security knowledge across the maritime transportation system. MPS-ISAO customers are really enthusiastic about the eLearning course launch, and Templar Executives have been such a wonderful partner for our ISAO. We begin on-boarding existing MPS-ISAO customers with the eLearning October 7th.”

All maritime stakeholders are encouraged to participate in the partners’ Maritime Cyber Security eLearning course opportunity. Please direct Maritime Cyber Security eLearning course inquiries to info@mpsisao.org.

Information about National Cyber Security Awareness Month is available at the Department of Homeland Security’s website: https://www.dhs.gov/national-cyber-security-awareness-month.

Source: einnews.com

Safety At Sea And BIMCO Publish Cyber Security White Paper

Safety at Sea, its parent company IHS Markit and its partner BIMCO, have been conducting surveys for years and the white paper, supported by ABS Advanced Solutions, combines an analysis of four years (2016-2019) of survey findings and feedback from experts and matches them to cyber behaviour and investment trends observable in the wider maritime industry.

Gathering knowledge of cyber security is an important tool and will benefit the entire industry.

“BIMCO takes cyber security very seriously and we are continually working on raising awareness among shipowners about cyber risks and how to prepare for cyber incidents” says Aron Sørensen, head of Maritime Technology & Regulation at BIMCO.

To continue reading, please click here.

Source: hellenicshippingnews.com

Examining Autonomous Ships’ Vulnerability to Piracy

By Thibaut Eude

Autonomous ships are a hot topic in the maritime sector; piracy and armed robbery too. Since the beginning of the year, according to the IMB, almost 100 attacks have been committed against ships all around the world. 2018 saw a marked increase in attacks compared to the past few years. 

Here is an attempt to describe an autonomous ship hijacking scenario.

The scenario

In 2025, an autonomous ocean-going container ship is chartered on a busy commercial line between China and Europe. The vessel is a level four autonomous ship according to the IMO classification [1] . The vessel is underway, and she is now passing through Malacca Strait. All sensors and artificial intelligence (AI) processes are working hard to avoid collision with others vessels, keep water under the keel and maintain the vessel on track [2]. 

To continue reading, please click here.

Source: maritime-executive.com