Article by Pelion Consulting
With cybercrime becoming a growing global issue, can you afford not to be cyber aware, and, what does it even mean to be cyber aware?
Maybe the ship or yacht you’re working with has experienced some kind of cyber-attack, or you’ve fallen victim to malware or ransomware, or had your social media accounts hacked. In this hyper-connected world that we all live in, it’s all too easy for us to fall into the cyber criminals’ traps.
We, as people, are the first line of defence against any cyberattack – unfortunately, 95% of all security breaches are caused by human error, mainly by email, and primarily by phishing.
Hackers can compromise data and systems with relative ease, and on a regular basis. The main reason continues to be a lack of cyber security awareness – people utilise poor practices which expose data, leaving it unprotected and vulnerable to theft and breaches.
Being aware of this and treating emails with a little extra suspicion won’t hurt.
But that’s just the IT… what about the OT…. that’s the technology that makes things actually happen. Industrial Control Systems, for example, SCADA, etc. Chances are if you’re working on a ship, you’re especially likely to come across OT because it’s the tech that makes the ship move, navigate, and countless other things that assist humans.
Why is OT Important?
Often the OT systems and the IT systems are integrated without any thought of consequences; many devices that shouldn’t have access to the Internet or other such networks, wrongly have this access – this creates a huge problem.
Imagine a scenario where fuel and ballast systems could be hacked, tricking the vessel to thinking it was off balance – the propulsion would stop. This disruption could be used to then commit piracy or to cause environment issues that then become health and safety issues, potentially endangering lives.
Such disruption could easily target the power generators on board or other systems which are critical to life support. This disruption and danger to life can stem from a simple phishing email: if the devices receiving the phishing email are not protected and if the network said devices are linked to, isn’t configured properly to protect the systems – a process called network segmentation.
The “Insider Threat”
With the increasing connectivity and vendor requirements to connect remotely to the systems on board – an Internet connection is required to connect to systems remotely. Anything connected to the Internet, thus, presents a risk that it could be attacked. But the risk of attack also comes from within, on the local ship’s local networks.
More and more cyber-attacks and incidents come from within, either maliciously by a disgruntled crew member, for example, or by pure accident. The automation and digitisation of many of these systems create paperless bridge environments. As such, there is an increasing dependence on monitors and screens, and subsequently, an unwitting reliance that these systems are infallible to attack. Well configured systems aside, the strongest defence system against a cyberattack is quite often, the human factor. Cyber awareness is crucial, and awareness that breaching an OT system can have far more devastating effects than a breached IT system is crucial, as well.
Awareness is the Key
A high percentage of security breaches are attributed to human error, and consequentially, it’s an unfortunate truth that the crew or workforce are often the weakest link in cyber security. Bearing this in mind, developing a cyber security culture on a vessel or in the workplace is a very effective method for reducing the likelihood of a successful attack. All crew members should be aware of the dangers and know what to look out for.
When it comes to the operation of a ship or a vessel, it’s vital that all crew members understand the technology that they are working with, either directly or indirectly. Moreover, they and should be aware of the dangers and know what to look out for so that they can make informed decisions – currently, there are developing legislation and regulations which seek to mandate this, but we shouldn’t, and can’t afford to, wait.
Preventative security decisions cannot be underestimated, they are critical in ensuring safe and resilient vessels, operations, and business continuity.
Knowing the environment that you are working and living in is a must. Equally important is knowing the basics about your environment’s systems, and about how those systems can and should be secured.
There is a difference between IT and OT, but these systems might be connected, meaning that the worst can and often, inevitably, does happen. Cyber awareness and knowledge can help mitigate attacks: by separating the IT and OT functions, putting safeguards in place, and keeping systems updated and configured precisely will help.
All of this is just the basics, and the importance of thorough training in this area cannot be underestimated.
Pelion Consulting is a cyber security company that serves primarily the maritime and yachting sector. We pride ourselves on specialising in providing cyber security to superyachts and work closely with international organisations to prevent cyber-crime. By closely following the latest technological developments in the industry we ensure that our knowledge of maritime cyber security is always at the cutting edge.
Find out more at www.pelion-consulting.com
