X-Industry

It is not just the frequency of the cyber-attacks, but also the severity can be critical, for example the Port of Nagoya in Japan that had to shut down operations for more than three days after a ransomware attack.  In addition, new critical vulnerabilities were published in major hardware and software commonly used by shipping companies: just in the last month we saw new critical vulnerabilities in major brands of firewalls, routers, internet browsers (practically all of them), operating systems and virtual machine infrastructure.

In this environment, it is no longer feasible to settle for a “firewall and antivirus” approach.  However, managing maritime cyber risks is not simple, and there are many unique challenges that are not always answered by traditional cyber solutions:

As the industry undergoes a digital transformation, most ships employ both new (digital) and legacy systems together, making it complex to manage all the assets on board one ship, not to mention managing a fleet of dozens and even hundreds of ships.[1]

The unique protocols, processes and behavior of maritime IT and OT make it hard to create a unified view of assets, vulnerabilities, and risks across a vessel and across an entire fleet.  As a result, mapping and then monitoring all assets and networks is a lengthy process and rarely done continuously, in real-time.

Most cyber solutions only protect part of the landscape so the IT manager or CISO needs to rely on multiple cyber solutions.  New maritime cyber regulations and requirements provide frameworks for establishing processes and for cyber resilience.  This is a very important step for maritime safety, but the processes create additional work for the IT and security teams.

Best Practices for Maritime Cyber Resilience - Traditionally, the perimeter approach was common for cyber security: firewalls to make sure no one unauthorized can enter the system, and antivirus so malware is not downloaded from the internet.  However, the digital landscape, especially aboard vessels, makes this no longer sufficient as many attacks bypass firewalls and anti-viruses using various exploits from equipment and application exploits to “social engineering.” 

Cyber security cannot cover all aspects, but we would like to focus on few measures that shipping companies can take to improve their cyber risk management:

#1 Start by creating a clear view of all your IT and OT assets on board all your vessels.  Mapping your landscape and identifying all your assets ensures you won’t be “sailing blind” in your risk analysis.  This is best done with an automated solution that can map and constantly monitor changes in your asset landscape.

*** Remember, cyberattacks usually come from the weakest link. ***

#2 After mapping your assets, you need to identify vulnerabilities.  This should be a combination of known vulnerabilities and testing for unknown ones (even if they result from misconfiguration and not inherent in the device/application).  Vulnerabilities can be found in applications, devices, operating systems, networks and network management, communication systems etc.  Each vulnerability also needs to be assessed for severity, in order to assess the risk it poses.  For example, known cyber vulnerabilities are cataloged with a severity score of 0 to 10, where 9.0-10.0 is considered a critical vulnerability and 7.0-8.9 would be a high severity vulnerability.

#3 Cyber resilience best practices are about managing vulnerabilities, because that’s the attack vector, and resolving vulnerabilities will usually involve third parties.  Many of the IT and OT assets are purchased for several vessels in parallel; Therefore, it’s much more effective to manage cross-fleet vulnerabilities rather than individual vessels and assets.

#4 Once you map your assets and vulnerabilities, you can start prioritizing handling of the various vulnerabilities.  A typical shipping company may identify hundreds and even thousands of vulnerabilities, so prioritization by severity is critical to make efficient use of your resources.

#5 The best way to identify unknown vulnerabilities is to constantly monitor asset and communications behavior in real-time.  Devices that transmit an unusual amount of information or communicate with networks they are not supposed to communicate with could indicate a breach.  One example was a ship where we installed our system and identified a vulnerable legacy OT asset that was connected to the internet intermittently, making it very hard to detect with periodical checks.

#6 Even with the best defense systems, breaches can happen, so prepare to minimize the damage.  The first measure is to segregate your networks so that a breach in one network or one group will not affect systems and devices connected to the other network.  In addition, establish cyber response processes you will need to do that anyway to comply with recent maritime regulation and requirements.

Protecting vessels from cyber threats is becoming more and more complex.  But there are modern solutions that can simplify this task.  By following modern cyber risk management best practices, you can optimize your budget while improving your cyber protection and resilience.

Our RedXray tool[2] helps to proactively monitor all cyber connection along the transportation supply chain.  RedXray is an analytic tool that can be used by an analyst to keep abreast of active indicators of compromise aimed at attacking a Port, Shipper, Trucking, Rail, and really any company along the Transportation Supply Chain.  It only takes one compromised company to spread malware to cause major disruptions and huge financial losses.    

Example of our current RedXray DashBoard:

This article is presented at no charge for educational and informational purposes only.

Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization.  For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com    

Weekly Cyber Intelligence Briefings:

• Reporting: https://www.redskyalliance.org/
• Website: https://www.redskyalliance.com/
• LinkedIn: https://www.linkedin.com/company/64265941 

Weekly Cyber Intelligence Briefings:

REDSHORTS - Weekly Cyber Intelligence Briefings

https://attendee.gotowebinar.com/register/5993554863383553632

[1] https://safety4sea.com/cydome-simplifying-maritime-cyber-risk-management/

[2] https://www.redskyalliance.com/