Bridging the gap: from compliance to cyber resilience

The importance of looking beyond the IACS URs was also emphasised by Viasat subsidiary Inmarsat Maritime chief of staff Laurie Eve, who proposed three key areas where companies should “focus and invest, not only to meet new requirements, but also to go beyond compliance and build good cyber resilience.”

The first key area, people and culture, addresses the notion that people are the weakest link in cyber security.

“According to a 2023 report from the United States Coast Guard, as well as findings from Inmarsat’s security operations centres, phishing is the most common initial access vector in cyber attacks. Investing in people, therefore, should be an absolute no brainer,” commented Mr Eve.

He added that a company should focus on training and awareness, managing user privileges, investing in a quality management system and standards such as ISO 27001, assessing suppliers’ risk-management practices, and embedding cyber security in the organisation’s continuous improvement culture.

The second key area is network-connected systems and services. Given the number of attack surfaces on board a vessel and the ever-growing volumes of data moving between systems, many companies lack the time and resources to address all possible weaknesses.

“Having a plan is good; training, rehearsing, and improving the plan is better” 

Mr Eve said one solution is a risk-management approach in which the organisation assesses the risks, sets its risk appetite and implements security measures according to the costs it is willing and able to bear.

The third and final key area, according to Mr Eve, is an incident response plan (IRP). It is prudent to assume at some point there will be failures and a security breach, he added.

An IRP comprises a robust set of contingencies to keep the cost of business disruption to a minimum. It requires investment in backup and data systems as well as regular staff training. “Having a plan is good; training, rehearsing and improving the plan is better,” explained Mr Eve.

While these recommendations apply to all shipowners, Mr Eve acknowledged there are differences from small to large operators in terms of the budget and internal capability invested in cyber resilience.

“Inmarsat’s Fleet Secure offers a one-stop-shop for cyber-security requirements, which makes it a particularly good fit for smaller operators without the inhouse capability to put together their own solutions,” he said.

Combining three components – Fleet Secure Endpoint, Fleet Secure Unified Threat Management and Fleet Secure Cyber Awareness Training – the Fleet Secure portfolio provides the tools and facilitates a risk-management approach, supporting “compliance with the new requirements” and, more broadly, “increasing cyber resilience”, Mr Eve added.

IACS URs E26 & E27: Bridging the gap between regulation and implementation webinar is within Riviera’s extensive webinar library and available to view at any time to those who have registered.

Riviera’s Maritime Decarbonisation, Europe: Conference, Awards & Exhibition 2024, will return to Amsterdam, the Netherlands, 24-25 September 2024 to address critical environmental issues head-on. Focused on the industry’s energy transition, the conference offers a comprehensive forum for stakeholders across the maritime sector to explore solutions and strategies for achieving low-carbon shipping and zero-emissions shipping.