Addressing Risk in the Maritime Industries

Maritime cybersecurity refers to the protection of computers and networks used in ports, terminals, vessels and related support systems. These systems must be protected from cyber threats (e.g., foreign intelligence, hacktivists, criminal elements, and terrorists) which could lead to operational, safety or security consequences. Cyber attacks could injure or kill workers, damage equipment, expose the public and the environment to harmful pollutants, and lead to extensive economic damage. Threat vectors include supply chain vulnerabilities, negligent users, wireless access points, removable media, and insider threats. Serious attacks have occurred, and the likelihood of further incidents is near certain. Securing the maritime infrastructure is therefore critical to maintaining national security and the economy.

Prior to September 11, 2001, maritime security was considered a necessary element of the management of the maritime community, yet it had a relatively low priority in actual practice. The terrorist attacks in 2001 altered the maritime security culture and made security a part of the normal operating environment.

A partial list of maritime computers and networks that require protection include transfer and load out racks, terminal automation systems, crane controls, cameras, voice communication networks, physical security access controls, environmental controls systems, warehouse management, tank management systems, vessel propulsion, navigation, ballast control systems, dynamic positioning systems, engine monitoring, and custody transfer systems. A focus for 2020 will be on developing regulations on testing and operating maritime autonomous surface ships (MASS).

The International Maritime Organization (IMO) published MSC-FAL.1/Circ.3 “Guidelines on Maritime Cyber Risk Management” for industry. The guidelines provide high-level recommendations on maritime cyber risk management to safeguard shipping from current and emerging cyber threats and vulnerabilities. It includes functional elements that support effective cyber risk management. The recommendations can be incorporated into existing risk management processes and are complementary to the safety and security management practices already established by the IMO. There are many other Presidential, national, and departmental policies and directives as well.

Many documents encourage the use of the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) as a standard for assessing and improving a facility’s cyber posture. Common themes in all the documents include documenting systems, identifying vulnerabilities, performing a gap assessment against existing guidelines or standards, performing a consequence-based risk assessment, developing short and long-term roadmaps, and maintaining a sustainable cybersecurity program to ensure a constant state of readiness.

aeSolutions, a recognized leader in OT cybersecurity, has the experience, the talent, and the services to help you develop your strategy, assess your risk, create a sustainable program, and remediate your gaps and vulnerabilities to meet your security and compliance objectives.  Learn more and to see how aeSolutions can help