[MARITIMES INDUSTRY] Cybersecurity and maritime sector

The digitization of the maritime sector has been accelerating for several years. New information and communication technologies are being used to automate processes, improve port efficiency and profitability, monitor ship movements and meet growing maritime security challenges. Thus, in parallel with ship automation, ports have also entered the digital age, particularly in container management. The port of Rotterdam is a perfect example. Thanks to innovative tools, the first European port has succeeded in making its traffic more fluid and thus gaining in competitiveness. Given the increasing importance of cyberspace in maritime operations and activities, enhanced information security systems have now become a necessity for the entire maritime sector. This integration of computer systems  in  managing  and empowering   operations   related   to   maritime   activities   is called   “marétique”   in   French.  Digital technology is thus infiltrating from all sides into the seafaring professions, both in the leisure, commercial and military navies.

However, unfortunately,  smart maritime equipments are vulnerable and   seduce hackers imagination. For example, in 2011, a drug cartel had ordered the attack on the port of Antwerp. Through a phishing campaign targeting port agents, attackers were able to recover passwords controlling access to the container management system.  In 2014, Trend Micro teams demonstrated that malicious AIS messages could attack VTS (Vessel Traffic Services) servers used in maritime traffic control by exploiting common security vulnerabilities such as SQL injection. This year, the US Coast Guard warned against the proliferation of malware disrupting ships’ computer systems. Several aggravating factors are taken into account in assessing the new risks associated with the hyper-connection of the maritime sector: technological factors (vulnerable equipment easy to compromise), operational factors (lack of awareness among personnel, lack of systems able to detect cyberattacks) and finally human factors (lack of expertise and specialists in cyber security).

The threats associated with the digitization of the maritime sector must make naval system designers and integrators think about redefining the cyber defense capabilities of the ships they design. However, the implementation of real cybersecurity policies is still in its beginning stages. However, good cybersecurity practices can be implemented to improve the security of computer networks on board a ship, such as network segmentation, implementation of default security, installation of effective antivirus software, implementation of SIEM and SOC, or specific maritime security watch. Designers and integrators have to think about redefining the cyber defense capabilities of the ships they design.