The International Maritime Bureau (IMB) has highlighted the increased risk of cyber-attacks on shipping and ports – the “next playground for hackers”.
IT networks at ports and onboard ships are vulnerable to compromise via remote hacking, allowing criminals to generate release codes for specific containers, enabling people and drugs to be unwittingly transported by shipping companies, as well as high-value containers to be stolen.
IMB quoted Mike Yarwood, claims executive at insurer TT Club, who at a recent conference indicated that cyber-attacks were far from an abstract threat: “We see incidents which at first appear to be a petty break-in at office facilities. The damage appears minimal – nothing is physically removed.
“More thorough post incident investigations however reveal that the ‘thieves’ were actually installing spyware within the operator’s IT network,” said Yarwood, adding that operators’ personal devices were also targeted.
IMB also highlighted recent comments by accounting and advisory firm KPMG’s cyber security director Wil Rockall, who warned that most port control systems are manned by engineers, not information security personnel.
“Most ports and terminals are managed by industrial control systems which have, until very recently, been left out of the Chief Information Officer’s (CIO) scope. Historically, this security has not been managed by company Chief Information Security Officers (CISOs) and maritime control systems are very similar. Last year it was revealed that drug traffickers had performed a two-year long multi-layer cyber attack against the port of Antwerp,” he said.
Rockall indicated that “improvements that many companies have made to their corporate cyber security… have not been replicated in these environments. Instead engineers have often been left to implement and manage these systems – people who focus normally on optimising processes efficiency and safety, not cyber and security risks.
“We have found that one of the main blockers in improving this is a real translation problem when corporate IT security teams attempt to impose their standards on industrial control systems or maritime control systems. KPMG’s work with the operator of one of the largest fleets of crude oil and oil products tankers and liquefied natural gas carriers in the world, found that bridging that gap and coming up with pragmatic solutions to improve industrial control systems security without compromising process efficiency or safety, are vital.”
In a statement to the press, IMB stressed: “Recent events have shown that systems managing the movement of goods need to be strengthened against the threat of cyber-attacks. It is vital that lessons learnt from other industrial sectors are applied quickly to close down cyber vulnerabilities in shipping and the supply chain.”
Copyright Ships & Ports Ltd. Permission to use quotations from this article is granted subject to appropriate credit given to www.shipsandports.com.ng as the source.