Shipping and Defence

The cybersecurity core in the naval sector

Some useful data

Maritime shipping currently accounts for 70% of global commercial traffic, generating a value stream of approximately 13 trillion dollars (sources: United Nations Development and Trade Office – International Monetary Fund). In this context, ships play a crucial role as network nodes and integrated systems, interconnected with other fleets, companies and third parties.

The complex nature of this situation highlights the challenge we face: cybersecurity in the shipping sector. All national and international regulations on maritime cybersecurity are based on Chapter IX of the International Convention for the Safety of Life at Sea (SOLAS), known as the International Management Safety Code. In this regulatory context, IT security is considered a matter of safety (protecting people and/or systems from failures) rather than security (protecting people and/or systems from external threats).

The regulatory document International Management Safety Code shares some common themes

• IT security must be addressed by applying risk management techniques in the context of information security.
  
• Cyber risks must be managed and addressed within the Security Management System.
  
• IT resilience must be developed for all naval systems that impact on security, distinguishing between IT (Information Technology) and OT (Operation Technology) systems.
  
• IT systems provide access to digital information and content, such as Internet navigation systems; while OT systems control and monitor the execution of physical processes, such as propulsion control systems. However, there are also integrated IT and OT systems, such as remote propulsion diagnostics and control systems.

The critical on-board systems:

At a secondary level of systems analysis, it is crucial to identify critical systems and safety-critical functional elements. Critical shipboard systems include navigation systems, satellite communication systems (Sat Com), machine automation systems, ship network, and ship property management system. Critical functional elements include remote maintenance, system upgrades, all internet-exposed services and human interaction.

Additional critical elements must be addressed for ships in operation that have not been designed with cyber resilience in mind. Analysis of systems at various levels is part of a broader cyber risk assessment, which includes analysis and evaluation of vulnerabilities and risks. It is important to consider that different levels of detail present different risks, and the impact of an event at one level can propagate to other levels. In addition, international standards suggest a holistic approach to cybersecurity, as outlined in the NIST Cybersecurity Framework.

The Cyber Security Contingency Plan (CSCP)

The result of this analysis is the Cyber Security Contingency Plan (CSCP), which supplements and complements the Security Management System (SMS) with regard to cyber security. This plan considers cyber danger situations and strategies for dealing with them.
In accordance with current regulations, all documentation produced regarding cybersecurity flows into a dedicated section of the SMS, structured as fractally as the system itself: from company policies, to manual, to procedures, to reports.
Special attention must be paid to new constructions, the ships of the future.
For these vessels, cyber protection measures are integrated early in the design process, following the principle of “cyber security by design,” including providing multiple layers of protection (defense in depth).

In general, the cyber resilience of a ship, whether new or otherwise, must be constantly monitored throughout its life cycle, through internal audits and analysis of reports on events that have taken place. Through these practices, each shipping company assesses the effectiveness of its IT security system and, if necessary, makes appropriate changes, following the continuous improvement approach prescribed by the regulations.

Conclusions. How can we defend shipping infrastructure?

The importance of cybersecurity in the shipping sector is clear. It is not a process to be activated only when required, but a form of protection that must be constantly renewed, accompanying the ship throughout its life cycle, from the moment of its design to its decommissioning. It is crucial to understand that cybersecurity is an indispensable element in ensuring operational security and protecting critical systems, sensitive information and human lives.

Agger was developed and tested precisely on military ships, and we had the opportunity to study the complex system of ships at length, both from the IT and OT point of view. Now Agger is also available for the Civilian Naval sector.