Cyber security on OSVs: detection has improved, response has not

CyberOwl global head of sales, Richard Wagner, told the conference that, in the last 12-18 months, the number of cybersecurity incidents has grown significantly. “There are now a whole range of different regulations and compliance requirements that are increasingly difficult to understand and manage,” he told delegates. “Whereas it seemed that it might get easier to manage risk on your vessels, it’s actually becoming harder to do so.”

Mr Wagner said the number and severity of incidents has increased, and there were around 1,500 incidents in the last six months alone. He said malware is one of the key causes for incidents, accounting for 64% of them. 

“What we have seen is that, despite the controls, despite the policies and the good intentions, malware is still entering assets in the offshore and shipping sectors,” he said. 

“USBs and other removable devices account for around 50% of incidents. Although the policies and documents are there, training isn’t working.” As Mr Wagner also explained, CyberOwl has also seen a significant increase in incidents as a result of phishing. Once again, the training and education is there, but its not working as it should.

According to Mr Wagner, the type of malware used is changing too. He said a lot of incidents used to take the form of ransomware, but around three-quarters of the malware that arrives on a vessel that bypasses controls is now designed to persistently evade detection. 

“That is really important,” he said, “because it’s not about immediacy, it’s about waiting to take consequential action. If we think about this in terms of the offshore oil and gas industry and offshore vessels, some of the technology on this kind of asset is far more complex than on many other, simpler vessels.

“Dynamic positioning and hydrocarbon processes can be put at risk. If these kinds of systems are affected, the risk profile alters significantly,” he said, citing examples including one in which malware affected a mobile offshore drilling unit’s DP system, resulting in drift and temporary well shut down, and another in which GPS interference turned one voyage into a six-month legal dispute. 

In a third example, multiple vessels in one fleet received phishing emails. Around 50% of recipients on the vessels opened attachments and although most were blocked, in one case it was not and the malware harvested browser, VPN, email and FTP credentials.

Detection has improved, Mr Wagner concluded, but response has not. On average, he said, it takes 57 days to resolve a cyber security incident, so the question is no longer ‘how likely is it that someone will attack me?’ but, when they do, ‘what is my potential exposure?’