Tackle the cyber-security awareness gap to strengthen the human firewall

Mr O’Rourke agreed training must be tailored to the vessel type, and suggests classification societies run tabletop exercises with shipowners and managers because of the legislation and the statutory compliance that goes along with cyber security.

Shipowners, operators, managers, third parties, vendors, shore and onboard staff and national authorities such as coastguards all require this type of training.

In his presentation, he outlined vulnerabilities and security weaknesses identified on cruise ships and ferries from regular inspections. The most common were not securing operational technology (OT), sharing too much secure data with third parties, including classification societies, vessel and port state inspectors and vendors, and having printed sensitive information, such as passwords, of onboard equipment on display.

“Information shared with third parties needs to be controlled,” said Mr O’Rourke. “OT networks should be air-gapped and should not be left connected. An area of concern is where OT and IT interact.”

Mr O’Rourke added shipowners must secure onboard OT in restricted areas and limit access to server rooms, control cabinets and bridge areas. “Do not leave areas open,” he said. “Do not have passwords on display, and there should not be handover notes left on notice boards.”

Much of the soft security improvements cover cultural changes, and sharing experiences without overloading seafarers with information. “It is not just on board as not everything can be driven onto masters and engineers,” said Mr O’Rourke.

“Shoreside must take responsibility, and with vendors, the onus is on them to demonstrate compliance and security.”

"Attackers are using social engineering and more advanced technology"

Mr Michaloliakos said the maritime industry is increasingly dependent on technology and faster connectivity, with more ships connected to cloud-based platforms providing access to onshore managers and third parties. “We are more connected than ever for upgrades and updates but we are also open to fraud,” he said.

“We have regulations that are changing, making it harder for companies to remain compliant; and as more money is being invested in ships, they are becoming more attractive to attackers.”

TMS is investing in cyber security, including hardening infrastructure, implementing advanced threat protection, improving risk assessments and using a cyber-security centre.

But these offer only limited protection for staff and seafarers, who are increasingly targeted by cyber criminals.

“Attackers are using social engineering and more advanced technology, human reactions are unpredictable,” said Mr Michaloliakos. “There is a gap between knowledge and action.”

He thinks shipping companies need to understand how employees feel about cyber security and endeavour to improve their awareness.

“We need to go from readiness to cyber comfort,” Mr Michaloliakos added. “Training needs to be tailormade as one solution does not fit all.”

Shipowners and managers need to invest in cyber-security culture and engage more with seafarers and shore-based staff. “We need to measure the culture by doing cultural assessments and support employees,” he continued. “The cyber-security culture needs to be embraced among the ecosystem.”

Webinar poll results

Attendees were asked to vote on a series of poll questions during the webinar. Here is a summary of the results.

What is the biggest challenge in strengthening the human firewall in maritime cyber security?

Overcoming the lack of cyber-security awareness and skills among employees: 31%

Adapting training and awareness programmes to the unique needs of the maritime industry: 27%

Securing buy-in and support from senior leadership and decisionmakers: 19%

Keeping pace with the rapidly evolving cyber-security threat landscape: 15%

Measuring the effectiveness and return-on-investment of cyber-security awareness initiatives: 8%

Which of the following is the most critical aspect of a maritime cyber-security strategy?

Implementation of advanced threat protection technologies: 9%

Conducting regular cyber-security assessments and audits: 6%

Establishing a dedicated maritime cyber-security operations centre: 3%

Developing and maintaining a strong cyber-security culture: 67%

Collaboration with industry partners and information sharing: 15%

What is the most significant driver for the increasing focus on cyber security in the maritime industry?

Regulatory requirements and compliance pressures: 23%

Growing reliance on digital technologies and connectivity: 37%

High-profile cyber incidents and attacks on maritime targets: 20%

Evolving business models and digital transformation initiatives: 9%

Pressure from customers, insurers and other stakeholders: 11%

What is the biggest challenge in developing a holistic approach to maritime cyber security?

Aligning the diverse roles and responsibilities of stakeholders: 27%

Balancing operational efficiency with security requirements: 27%

Keeping pace with the rapidly evolving threat landscape: 19%

Attracting and retaining qualified cyber-security professionals: 15%

Securing adequate budget and resources for comprehensive measures: 12%

Which group within a maritime organisation requires the most indepth and specific cyber-security training?

Executive management and decisionmakers: 15%

Operational staff, such as ships’ crew and port workers: 33%

IT support and system administration personnel: 19%

Cyber-security specialists and incident responders: 33%

Third-party vendors and system integrators: 0%

What is the most critical phase of a cyber-attack timeline for preventing a successful breach?

Initial email delivery and filtering: 47%

Website visiting and download prevention: 3%

USB scanning and secure usage policies: 13%

Software installation and execution control: 20%

Post-incident detection and response: 17%

Source: Riviera Maritime Media

On the Strengthening the human firewall: Tackling the cybersecurity awareness gap in maritime webinar panel were P&O Ferries fuel and energy efficiency programme manager Martin O’Rourke, TMS Group head of ICT and cybersecurity services Michalis Michaloliakos and University of Plymouth lecturer in cybersecurity Rory Hopcraft

 

---

Riviera’s Vessel Optimisation Webinar Week will be held 17-20 June to showcase AI-powered weather routeing, ECDIS, data analytics and new approaches to fuel optimisation. Use this link for more information and to register for these webinars