Black Hats and High Seas
The maritime industry enables nearly eighty percent of worldwide trade. The miracle of free trade, the free flow of goods across nations simply could not happen without this vital sector. Cheap shipping enables the existence of our age, but along with its importance comes malice. Malicious actors have always sought to take advantage of the tons and tons of wealth crossing the seas; from the romantic privateers of the Age of Sail to today’s small-scale bands using motorized craft whizzing up and down the Straits of Malacca pilfering billions of dollars a year. Technology’s conveniences and efficiencies have also enabled the maritime industry to adapt. However, this has opened a new vulnerability: malicious actors need not have an armed crew or watercraft to inflict millions in damage, all they need is a computer and an opportunity.
Technology has allowed every industry to become more efficient and the maritime sector is no exception. Cybersystems for ships have made the otherwise tedious tasks of administration, accounts, maintenance planning, parts management, manuals and certificates, and permits, categorized as Information Technology; onboard measurements/control, data logging, navigation, and engine/cargo control, categorized as Operation Technology much simpler. Attacks on IT systems pose risks primarily to finance and reputation, while those targeting OT can pose severe risks to life, property, and the environment on top of reputation and finance.
Figure 1 Information and Operation Technology Risk Diagram
Source: DNV.com
Cybersecurity, therefore, has become more and more important for the maritime industry. The dangers are not merely theoretical for the industry, in 2017, industry leader Maersk suffered a catastrophic cyberattack that crippled its operations and cost USD300 million. There also have been substantial cyber breaches in Singapore-based marine services provider Swire Pacific Offshore, and South Korea-based HMM in 2021. Since the start of the COVID-19 pandemic, cybersecurity specialist Naval Dome has found a 400% increase in attacks on the global maritime industry and 900% over the past three years.
Comparable to the situation in the Straits of Malacca, the Asia-Pacific region’s opportunities come with risks; the region has the danger of being the most targeted area for ransomware. As a reality check, the maritime industry needs to step up. Simple antiviruses and network security controls are not enough in the face of determined and sophisticated malicious actors. Losses from cyber risk aren’t entirely sure to be covered under the terms of traditional marine insurance policies, giving rise to uncertainty and litigation. Finally, cyberattacks can and have led to damage to physical assets.
The industry has been moving towards meeting these threats. The International Maritime Organization has now released resolutions with regard to integrating cyber risk management into compliance requirements. Safety Management Systems are now requiring documentation regarding cyber risk assessment in line with the International Safety Management Code. The Oil Companies International Marine Forum (OCIMF) is also moving towards establishing minimum standards for cybersecurity in its TMSA3 self-assessment.
Safeguarding the world’s trade networks, and maritime travel is a key goal for everyone who seeks to preserve the current age of globalization. Maritime companies also must rise to meet the challenge with active solutions beyond policy compliance to protect their finances, reputations, the integrity of their vessels, and most importantly, the lives of their seafarers.