How to secure ships, seafarers against growing cyber threats

Mr Schellenberger says ship operators, owners and managers need to increase their investment in training crew and onshore managers need to identify cyber risks and react correctly to prevent security breaches.

“Around 80% of cyber incidents are crew induced,” he said. “Seafarers still use USBs and cyber risks are increasing. Many incidents involve people looking for ways around IT system safeguards.”

Basic ways shipowners can improve their cyber health and reduce risk on ships include separating OT and crew communications; updating software on ship computers; locking USB ports; and offering training to raise awareness of online dangers.

“These are low-hanging fruits,” said Mr Schellenberger. “But if training programmes are there, many are still tick-box exercises with seafarers having to do those,” he said. “They are hellishly boring and do not reflect the risks crew encounter.”

Other risks are from keeping the same passwords for months and years, not updating IT networks or having specialist IT personnel in management offices or on ships.

“If systems are 15 years old, how much have they been updated?” Mr Schellenberger asked. “Owners are reluctant to include cyber security as part of their operating budget or pay for risk mitigation; this is disturbing,” he continued.

“Global fleets are made up of small and medium-sized owners without dedicated IT structures. They cannot afford cyber security or IT specialists, which means they could be in trouble.”

Awareness and solutions

At least 60% of the world’s shipowners are doing the minimum in cyber security. But the whole industry needs to be aware of online dangers and improve cyber resilience.

Mr Schellenberger said all owners should use IT specialists to regularly clean their networks, improve crew awareness training, perform drills simulating cyber breeches and infections, and involve executives when planning how to react to a cyber incident.

There is also a greater need for proactive threat monitoring using real-time monitoring tools for both IT and OT systems to improve threat detection and response.

Webinar poll results

Attendees were asked to vote on a series of poll questions during the webinar. Here is a summary of the results.

When it comes to cyber security in the maritime supply chain, which best describes your organisation’s current stance?
Proactive: 50%
Reactive: 25%
Compliant: 25%
Passive: 0%

In your view, are current training programmes (both on shore and on vessels) sufficiently immersive and relevant, or do they primarily serve as tick-box exercises?

Training is immersive and relevant: 50%

Training is mostly a tick-box exercise: 12%
Training is a mix of both: 38%

Which area do you consider the greatest cyber risk to your maritime operations?
IT systems (such as business networks and email): 29%
OT systems (such as cargo handling and navigation): 14%

Third-party vendors and suppliers: 0%

Human error or lack of awareness: 57%

Does your company have sufficient internal IT expertise (both in the office and on board) to address today’s challenges and the increasing risk profile?
Yes, we have sufficient expertise in both areas: 25%

Sufficient expertise in the office, but not on board: 50%

Sufficient expertise on board, but not in the office: 0%

No, we do not have sufficient expertise in either area: 25%

What is the main barrier to improving cyber security in your organisation?

Lack of budget: 15%

Lack of expertise: 14%

Complexity of regulations: 14%

Resistance to change: 57%

Which of the following would most improve your confidence in your company’s cyber resilience?

More frequent and realistic cyber incident simulations: 63%
Stronger regulatory guidance and clarity: 13%
Greater transparency from technology vendors and service providers: 24%
Enhanced training and awareness for all personnel: 0%

(source: Riviera Maritime Media)

On the panel of Riviera’s Securing the digital waterway: a proactive approach to maritime supply chain cyber risks webinar were (left to right): Liberian Registry senior vice president for fleet communications and technology, Kyle Hurst and Novamaxis director and founder Peter Schellenberger.