Maritime Cyber Security Testing
Maritime cyber security
As ships get bigger, with more automation, fewer crew members, and more connectivity, the attack surface of a modern commercial vessel is becoming as complex and diverse as that of a connected car or commercial aeroplane.
We have ex-ships officers and engineering staff on the team here, so we have first-hand experience of the unusual networks and communications found on board.
Don’t risk your ships security to a penetration tester that doesn’t understand shipping; we’ve come across other consultancies that have broken critical systems on board whilst trying to test their security, as they simply didn’t understand what they were testing.
What does a ship look like to an attacker?
The complex systems involved in shipping offer rich pickings to the hacker, pirate and thief. Load theft, smuggling stowaways, narcotics, arms, even crippling or sinking a vessel are very real threats.
Maritime insurance often specifically excludes losses as a result of ‘cyber’ incidents, so it’s very important to check your cover.
From satcoms, mobile data and Wi-Fi through to propulsion and loading systems, this is what a hacker sees when they look at a ship. Many of these systems can be comprised, causing financial loss and safety issues.
Tactical Advice
Tens of vendors are involved in connected systems on ships, from Dell providing desktop PCs, to satcoms gear for Internet, chart systems, MMI, control systems, radar systems etc. This is a recipe for security disasters.
Here are a few basic issues you could check for yourself:
Check your satcom terminals for default, weak or blank admin passwords. Make sure the latest software is running on ALL of your terminals.
Check the network isolation and segregation between bridge, engine room, crew, Wi-Fi and business networks.
Check Wi-Fi networks for strong encryption and strong passwords. Make sure that business systems are particularly well protected.
Demand evidence from your technology suppliers that the systems they provide to you are secure. Remember, if you don’t ask for security, you probably won’t get it!
Sit down and think about how you might attack your ships network, given your knowledge of your systems. That’s what the hacker does, so pre-empt them and defend better.
Don’t forget your people. Officers can become fixated on digital navigation systems on the bridge. These can be hacked and manipulated, so don’t forget to look outside.
How we can help you
Creating a security strategy in line with IMO guidance and ISO/NIST frameworks will help assure your security. We have ex-ships officers and engineers on the team here, so understand ship security intimately.
We can help you create a strategy.
However, frameworks and policies take time to implement, often requiring process and cultural change. In the meantime, ships and terminals are still being hacked.
A tactical security audit of your vessel and shore systems is a great way to find the ‘easy wins’ for security in the short term.
We often find trivial changes can make a huge difference to the exposure of your operations to hackers. Talk to us about how this can be done.
Further reading
Our blog is full of advice for securing your vessel:
Top 10 tactical tips for maritime security
Plus many other areas of ship system security you may not have considered:
