Cybersecurity and the Maritime Industry

Cybersecurity and the Maritime Industry

“Shall we play a game?”

When the supercomputer named Joshua in the 1983 movie “War Games” asked that question, the world saw just how vital cybersecurity could be. In this case, a high school kid looking to play a game nearly destroyed the world through nuclear war. Could it be that easy?

Via engadget.com

Mathew Broderick’s character in the movie was smart, but there was no indication that he was a genius or anything.

As we all know, in Hollywood, anything is possible, and realism is not essential to the end product.

But the movie is a shining example of how vital cybersecurity can be. It’s probably not that easy to accidentally kick of World Warr III by playing a game of Global Thermonuclear War, but a lot of damage can occur via cybersecurity intrusions.

As computers have worked their way into the fabric of society, the importance of appropriate security measures has become more and more prevalent. The global cost of cybercrime last year was over $600 billion.

That number speaks to all cybercrime, but some industries get hit harder than others. Recent years have seen a rise in cybercrime related to the maritime industry.

A 2017 BBC article references a medium-sized shipping firm whose system got hacked. Messages from the finance department were monitored. When the company requested a payment, the hackers changed the banking information. The payment ended up going to the hackers rather than the company.

The company lost several million dollars before they caught wind of the issue.

That is just one example of many possible attacks. It is hard to judge just how prevalent they are since companies are not too eager to publicly admit their customer’s data may have gotten compromised. But there are several attacks that have made the news:

  • Last June, shipping giant Maersk was the victim of an attack that cost the company around $300 million.
  • Some pirates have gone hi-tech and will hack a shipping manifest to learn precisely where the cargo they want is located so they can steal it with ease. According to a report about just such an incident: “They’d board a vessel, locate by barcode specific sought-after crates containing valuables, steal the contents of that crate – and that crate only – and then depart the vessel without further incident.”
  • A vessel moored at an Asian port was hit with ransomware and made inoperable for some time after the switchboard (which manages the ship’s power supply) shut down.
  • Oil rigs have been shut down thanks to hackers. One was found to be so compromised by malware that it had to be shut down for 19 days.
  • Navigation systems like Electronic Chart Display (Ecdis) have been compromised due to malware. Pirates have been known to hack ECDIS and other navigation systems to locate targets. The practice is common enough that some ships will turn these systems off to hide their locations.
  • Hackers working with drug smugglers ran an operation out of the Port of Antwerp where the smugglers would hide the drugs in a container—one of the hundreds on the ship. The hackers would use the Port’s tracking system to locate the containers they were interested in finding.

How does this happen?

Hackers are responsible in some of the cases, of course. With ships becoming more and more automated as well as ports, the opportunity certainly exists if a hacker chooses to tackle the challenge. But many companies are not that worried about ships getting attacked.

A spokesperson for Maersk had this to say when asked (via Reuters):

“Yes, we consider cyber risk a threat, but vessels are no more vulnerable to such attacks than onshore systems and organizations. We are taking this risk seriously and ensuring that we are protected against such threats.”

But even if they don’t take the potential threat to ships seriously, they should. CyberKeel, a cybersecurity firm, tested the cyber defenses of the 20 largest container ships in the world in 2014. They found 16 of them to have serious issues (Reuters).

The question of how remains. While hackers do play a role when it comes to shipboard intrusions, often they are self-inflicted. Crew members carry on the malware on a USB-drive, and when they plug it in, the malware spreads.

This also occurs when crew members plug in devices of their own to the ship’s system.

Via Wikimedia.com

What can companies do?

The risk may not be as serious as Global Thermonuclear War. But the potential damage some malware or a hack could cause is unlimited. So, what does a shipping company need to do to keep from being a victim of cybercrime?

It starts with training. Once you develop a strategy for combatting cybercrime, make sure that all personnel gets appropriately trained and adhere to the strategy. Don’t just put up posters and send out memos. Conduct training sessions and make sure people understand the potential threat and how easy it can be to become a victim.

The crew will not like it, but ships may need rules prohibiting plugging personnel devices into ship’s system. Unused USB ports should be covered up as much as possible. Computers should go into a secure sleep mode shortly after being left unattended.

Additional measures should get implemented for those who engage in billing and with finances.

Companies in need of a little help on how to protect themselves can look to the guidelines recently released by the Baltic and International Maritime Council (BIMCO) and the International Maritime Organization (IMO). Companies doing business with members of the EU will also have to be compliant with the General Data Protection Regulation (starting in May 2018).

All three are intended to help protect companies from cyber intrusions and to help them protect their customer’s data.

Most of all, companies need to report intrusions. It may feel like protecting the integrity of the company. But it is making it easier for the bad guys to win. Problems are best solved when the parties working on them know exactly what they need to solve.

We better get control of the issue now

If we don’t, the potential issues that a lack of cybersecurity could cause may become dangerous.

The Yara Birkeland is an autonomous cargo ship scheduled to go online in 2020 off the coast of Norway. A Chinese company is working on one and hopes to have it ready to launch in 2019. The Defense Advanced Research Projects Agency developed an unmanned submarine, the Sea Hunter, which the Navy’s Office of Naval Research has taken possession.

Unmanned vessels could soon become a reality out at sea. Discussions are in progress to allow unmanned ships to cross the ocean.

For that to happen, companies are going to need some pretty sophisticated systems. That and satellite access for remaining in communication with those systems while they are in transit. That means a brilliant hacker could learn where something is stored on board ship, and maybe even steal the ship!

Companies working on such vessels are undoubtedly working on keeping their systems as safe and secure as possible. But if there is anything that Hollywood has taught the world about cybercrime, it’s that there is someone capable of breaking into anything.

We will not know if that person is up to no good until it is too late.

Scroll Up