2.2 Vulnerabilities in the Maritime Sector
The number of ships that have on-board Internet access has increased dramatically in
the last decade.
8 Connection of the ship networks to the Internet creates a serious
hazard, as this potentially makes every commercial vessel a target for cyber
criminals.
Also, ships today are more dependent upon computers and computer software to
operate and control various systems on board. For example, in the context of ship
operations bridge systems such as Electronic Chart Display and Information System
(ECDIS), Automatic Identification Systems (AIS) and GPS are often used. Similarly,
main and auxiliary propulsion systems increasingly rely on computer systems to
function efficiently. Such systems on board are also connected to other systems
owned by a ship owning company; thus hacking the onboard systems of a vessel
could potentially have an impact on many systems and might even lead to a shutdown of a whole host of systems, resulting in a disruption of massive scale and
significant economic losses.
9
Given that any vulnerability in the systems of a commercial ship could potentially
expose the shipowning corporation to significant cyber risks, two other factors that
might exacerbate the problem need to be mentioned. It is a very widely held view
that the crew on-board most commercial vessels are not fully aware of the scale of
cyber risks that can affect the systems of the ship; various surveys indicate that a
huge proportion of crew members has received limited or no cyber training from
their employers.
10 Therefore a crew member who uses illegally copied software on
his smart phone could easily infect the system of a vessel with the latest virus simply
by charging the battery of his phone using the ship’s system. Also, firms specialising
in building cyber resistance for shipping corporations warn that most organisations
are using out-of-date firewalls and anti-virus protection and such software is not
updated regularly in a systematic manner in many organisations, thus exposing
systems to enhanced cyber risks.
8 For example, whilst in 2008 only 5200 commercial ships had on-board Internet access, today
(in 2018) this number is at 40,200 (data obtained from CyberKeel).
9 In fact, this was the case when A.P. Moller Maersk faced a cyber attack in July 2017. The company
opted to shut down a number of systems to contain the issue. A similar approach was adopted by
COSCO when the company faced a similar cyber attack in July 2018.
10 https://safety4sea.com/survey-finds-lack-of-maritime-cyber-security-training-amongst-crews/
(last tested on 31 December 2018).
630
B. Soyer
The number of ships that have on-board Internet access has increased dramatically in
the last decade.
8 Connection of the ship networks to the Internet creates a serious
hazard, as this potentially makes every commercial vessel a target for cyber
criminals.
Also, ships today are more dependent upon computers and computer software to
operate and control various systems on board. For example, in the context of ship
operations bridge systems such as Electronic Chart Display and Information System
(ECDIS), Automatic Identification Systems (AIS) and GPS are often used. Similarly,
main and auxiliary propulsion systems increasingly rely on computer systems to
function efficiently. Such systems on board are also connected to other systems
owned by a ship owning company; thus hacking the onboard systems of a vessel
could potentially have an impact on many systems and might even lead to a shutdown of a whole host of systems, resulting in a disruption of massive scale and
significant economic losses.
9
Given that any vulnerability in the systems of a commercial ship could potentially
expose the shipowning corporation to significant cyber risks, two other factors that
might exacerbate the problem need to be mentioned. It is a very widely held view
that the crew on-board most commercial vessels are not fully aware of the scale of
cyber risks that can affect the systems of the ship; various surveys indicate that a
huge proportion of crew members has received limited or no cyber training from
their employers.
10 Therefore a crew member who uses illegally copied software on
his smart phone could easily infect the system of a vessel with the latest virus simply
by charging the battery of his phone using the ship’s system. Also, firms specialising
in building cyber resistance for shipping corporations warn that most organisations
are using out-of-date firewalls and anti-virus protection and such software is not
updated regularly in a systematic manner in many organisations, thus exposing
systems to enhanced cyber risks.
8 For example, whilst in 2008 only 5200 commercial ships had on-board Internet access, today
(in 2018) this number is at 40,200 (data obtained from CyberKeel).
9 In fact, this was the case when A.P. Moller Maersk faced a cyber attack in July 2017. The company
opted to shut down a number of systems to contain the issue. A similar approach was adopted by
COSCO when the company faced a similar cyber attack in July 2018.
10 https://safety4sea.com/survey-finds-lack-of-maritime-cyber-security-training-amongst-crews/
(last tested on 31 December 2018).
630
B. Soyer