U.S. maritime industry warns its port, where there is inadequate cyber-security, to wake up to the dangers posed by ship docking, reports FTI Journal.
Malware and malicious cyber tools
Potentially destructive malware and malicious cyber tools pose a threat to the critical infrastructure of cargo vessels.
In February 2019, the Port Authority of New York and New Jersey alerted U.S. Coast Guard (“USCG”) authorities about a U.S.-flagged cargo ship that intended to dock in New York.
The alert was in response to the ship’s reporting “that they were experiencing a significant cyber incident impacting their shipboard network” as a result of being infected with malware.
Intrusions across global maritime sector
Although the initial investigation concluded that the ship’s control systems were not affected, the incident is indicative of an increase in intrusions across the global maritime industry and the exploitation of easy targets due to their lack of security controls and staff awareness.
The event was the second such USCG maritime alert in three months, casting a harsh light on the industry’s lack of preparation for attack on its digital infrastructure.
Lack of basic cyber-security
In fact, a subsequent investigation of the same ship by a joint USCG and Federal Bureau of Investigation team revealed that the vessel did not employ even the most basic cyber-security practices.
It relied on a single crew password for accessing the ship’s computer system, for instance. USB drives used to transfer ship and cargo data were unscanned for malware, and there was no basic antivirus protection.
It’s very well likely that the infection was spread far beyond the individual vessel through its connection to port facilities in Pakistan, India, Oman and the holding company’s networks.
Cyber-security measures
The unprepared state of the maritime industry to combat cyber threats does not portend well. FTI Cybersecurity sees several trends on the horizon including these four:
- Changes to regulations for implementing basic cybersecurity practices will cause liability to fall on ship operators and parent companies.
- Increased liability and litigation for cyber disruptions originating from one entity will affect another entity.
- Unsecured maritime facilities and vessels will accelerate the potential for a “cyber contagion.”
- A cyber incident will involve destruction or damage to physical assets and/or injury to shipboard or maritime facility personnel.
Amazingly, despite a 2010 report from the U.S. Government Accountability Office that identified the need for cyber threats to critical infrastructure to be addressed, the maritime industry still has not given this significant issue adequate attention almost a decade later.
Battling cyber threats
Today’s ships are essentially floating data systems that are sitting ducks for cyber criminals to pick off with ease.
Without immediate action to mitigate risk and combat cyber threats, the significant financial losses already occurring in the industry will only escalate.
Making matters worse, any business disruption also has the potential to cause physical destruction, endangering people and property.
Need for employing cyber-security policies
As vessels become even more connected internally and across the global logistics environment, implementing basic cybersecurity policies and practices is imperative for improving operational efficiency and continuity.
Those shipping companies that make the effort to implement change in the near future will be better prepared and will likely find the proactive stance a business differentiator that boosts client confidence.
Did you subscribe to our daily newsletter?
It’s Free! Click here to Subscribe!
Source: FTI Journal
