The Nature of the Shipping Industry Presents Unique Challenges for Hardening Cybersecurity.

By the end of the decade, it is expected that the world’s first autonomous container ship will have embarked on its maiden voyage, moving goods around the coastline of Norway. Together with other initiatives currently underway, such as the development of remote controlled vessels, this will mark a new era of connected shipping technology and demonstrate that the $210 billion industry is ready to embrace the future.

These advances are to be celebrated, but simultaneously they bring with them a high element of risk, as more on-board elements become exposed to the kinds of cybersecurity concerns that we’re more familiar with on land.

Much has been written about the dangers of Operational Technology (OT) in industrial environments, and we’re used to the traditional challenges of doing business at sea, from piracy to bottlenecks at container ports. What we’re not used to is recognizing that a container ship is an OT environment just like any other, and at risk of targeted and generic cyberattacks.

The threats are very real: researchers have demonstrated proof of concept attacks against many of the most common maritime systems, and there’s evidence of problems in the wild in which navigational computers were infected with malware on a USB stick being used for upgrades. Even worse, there have also been public reports that critical communications systems have been left effectively unprotected, thanks to defenceless interfaces and failures to change default credentials.

The nature of the shipping industry does present highly unique challenges for hardening cybersecurity, but they are not insurmountable. For firms that get it right, cybersecurity will be a powerful enabler in the world of more automated and unmanned shipping.

The challenges of integrating new technologies in shipping

One of the most difficult challenges with maritime cybersecurity is that every ship is different. There’s little standardisation, especially when it comes to on-board control systems, and a high mix of legacy systems – many of which were never designed with security in mind – and additional networked technologies which have been added over time.

When integrating new on-board systems, not enough attention has been paid to the principles of “secure by design”. As a result, many vessels have a ‘flat’ network structure, in which new internet connected systems for navigation and communications have been placed on the same networks as older control hardware. This introduces multiple vulnerabilities into systems which do not have adequate built-in protections.

In addition, the operating environment is also much more challenging than typical industrial setups. Most ships rely on Very Small Aperture Terminal (VSAT) satellite communications for connectivity, which is low bandwidth and high latency. It can carry some communications, such as email and navigational data, but isn’t reliable enough for the most effective security measures recommended to shore bound industries: regular patching and updates.

Manual patching can still take place, but the current nature of the industry means that ships spend as little time in port as possible. When they are docked, and bandwidth is available, security updates come a long way down the list of priorities, behind upgrades to navigational software and downloading new digital entertainment for the crew.

There is also a lack of skills among on-board crew. All too often the person responsible for IT combines the role with another position, leaving little opportunity to monitor for, and respond effectively to, a cybersecurity incident. Remote monitoring for issues that could indicate a security breach is an option, but difficult thanks to the lack of reliable bandwidth while at sea.

Propelling maritime security into the future

While a change in the approach to cybersecurity is needed, it will have to come from the maritime industry itself. Regulations and government interventions of the kind we’ve seen relating to critical infrastructure on land will be harder to enforce at sea, especially given the preference for low-regulation flags of convenience many merchant shipping lines show.

Indeed, it’s likely to be insurance companies rather than governments that provide the motivation for shipping companies to invest seriously in better protection. Specialist insurers are developing policies based on their exposure to cyberattack and are likely to act as a prime driver for better practice. There will be a tightening of due diligence before policies are issued and claims processed.

The industry does recognise the issue. Last year, the International Maritime Organization (IMO) published excellent guidelines on cybersecurity to enable safe and secure shipping. These guidelines are sound and advocate a risk management approach to cybersecurity.

A risk management approach starts with identifying which systems, data and interfaces are unprotected and pose the greatest risk if compromised, and how to protect them and mitigate the consequences of a successful attack. In a maritime context, this means securing devices and networks by closing unused data ports and ensuring full network segregation between OT and IT systems. Importantly, crew systems – such as terminals for entertainment or personal email – should be kept independent of everything else. One of the primary threats remains inadvertent infection via a flash drive or mail attachment.

To this end, better training of staff is an imperative. As the IMO guidelines state: “Senior management should embed a culture of cyber risk awareness into all levels of an organization and ensure a holistic and flexible cyber risk management regime that is in continuous operation and constantly evaluated through effective feedback mechanisms.”

There’s also a lack of basic security provision, such as the use of VPNs for communication and data transfer, and strong user authentication for on-board systems, which can be picked up in a full security audit and addressed. And that’s the important point here, these are all addressable issues.

Even so, cybersecurity costs money in an industry which typically runs on tight margins, and a lack of resources is a key factor in the challenges faced today. This is made more difficult by the fact that every ship is a unique configuration of legacy systems and incremental upgrades, making fleet-wide deployments of security solutions tough. Effective cybersecurity must also be business efficient cybersecurity.

That is why one of the best ways to improve resilience to cyberattacks and harden maritime networks is to work with partners who are developing the expertise needed through experience. Partners whose knowledge is relevant to both existing systems and the supply chain for new deployments.

The maritime industry can reap the benefits of improved automation and data services, but it can’t do it securely by itself.

(securityweek)

• Ten SA coastal councils oppose Bight oil exploration, representing nearly 500,000 people
• SA’s biggest local government, Onkaparinga Council, voted its opposition in May
• Opposition has jumped dramatically since Kangaroo Island Mayor fronted Equinor AGM

  Ten South Australian coastal local governments representing nearly half a million people are flexing their muscle to oppose oil and gas exploration in the Great Australian Bight, with Adelaide’s City of Marion becoming the tenth local government to vote its opposition last week.

Local government opposition has stepped up dramatically since Kangaroo Island Mayor Peter Clements fronted the Statoil-Equinor annual general meeting in Norway in May to ask the oil giant to drop its Bight plans. Shortly after, South Australia’s biggest local government, Onkaparinga City, voted its opposition followed by the state’s third biggest council, City of Port Adelaide Enfield, last month.

The Marion Council motion states: “The City of Marion writes a letter to the National Offshore Petroleum Safety and Environmental Management Authority (NOPSEMA) requesting a moratorium on oil and gas exploration in the Great Australian Bight because of the minimal benefits to the City and its residents compared with the potential devastating impacts of an oil spill.”

Wilderness Society South Australia campaigner Cristel Chambers said: “The opposition to oil and gas exploration in the Great Australian Bight is growing dramatically, with 10 local governments representing nearly half a million South Australians now opposed to risky ultra-deepwater oil exploration in Australia’s southern seas.

“Four South Australian councils ‑ Port Adelaide, Marion, Onkaparinga and Alexandrina – have passed resolutions opposing oil and gas in the Bight since May when Kangaroo Island Mayor Peter Clements travelled to Statoil-Equinor’s AGM in Norway to ask the oil giant to drop its plans to drill in the Bight.

“In May more than a thousand people lined the shores across Australia to oppose offshore oil and gas exploration and calling Statoil-Equinor to drop its Bight plans at Hands Across the Sands events from New South Wales right across to Western Australia. About 500 people attended the Adelaide event at Semaphore Beach alone.

“Statoil-Equinor, however, has thumbed its nose at the growing community opposition and extraordinarily reasserted its intention to attempt risky ultra-deepwater drilling in the Great Australian Bight Marine Park next year while pushing for an extension to its drilling timeline. Statoil-Equinor’s continued dismissal of the community’s concerns brings the reputation of the entire offshore oil and gas industry into disrepute.

“Statoil-Equnior should start listening to the people and quit its plans to drill in the deep, rough and remote waters of the Great Australian Bight, just as BP and Chevron have already done.

“South Australian coastal councils have good reason to voice their opposition as under the Australian National Plan for Maritime Environmental Emergencies it’s local councils that will have to clear up the devastating effect of an oil spill, and will have to support their fishing, aquaculture, tourism and other existing industries from collapsing. And neither the local councils ‑nor indeed the state government – have the resources, the skills, the expertise or the money to do so.

“Furthermore, under Australia’s regulations the petroleum operator obligations do not cover compensation for loss and ongoing damage to parties such as the fishing or tourism industry; which fall under the category of third party liabilities and would be forced to follow alternate legal options and the inevitable time delays and costs should a spill occur.

“The international Hands Across the Sand movement grew from the Deepwater Horizon disaster in 2010 when 800 million litres of oil spewed into the Gulf of Mexico.

“The Great Australian Bight waters are deeper, more treacherous and more remote than the Gulf of Mexico. BP’s own oil spill modelling showed a spill from an ultra-deepwater well blowout in the Great Australian Bight could impact anywhere along all of southern Australia’s coast, from Western Australia right across to Victoria through Bass Strait to NSW and around Tasmania. A spill could hit Adelaide in 20 days and could hit Port Lincoln and Kangaroo Island in 15 days.

“A spill would be devastating for South Australia’s $442 million fishing industry and its tourism industries in coastal regions, worth more than $1 billion. The two industries employ more than 10,000 full-time positions.

“There is no established offshore oil and gas industry in South Australia to deal with a disaster. More than 6800 boats were involved in the Gulf cleanup but the South Australian Oyster Growers Association says that SA and neighbouring states probably have only 20 vessels that could operate safely in the waters where BP-Statoil planned to drill.

“The Great Australian Bight is a unique, pristine marine environment, with 85 per cent of its marine species found only in these waters. The Bight is a haven for 36 species of whales and dolphins, including the world’s most important nursery for the endangered southern right whale. The Bight is Australia’s most important sea lion nursery and supports seals, orcas, giant cuttlefish, great white sharks and some of Australia’s most important fisheries.”

It’s been common to lump WestJet in with the likes of Norwegian as a carrier trying to make long-haul, low-cost service work. With Boeing 787s starting to join the Calgary-based airline’s fleet next year, it has seemed intuitive that WestJet—traditionally an LCC and about to launch a ULCC subsidiary—would be entering the growing long-haul, low-cost sector.

But that is not actually the case. New CEO Ed Sims, whose background includes running Air New Zealand’s long-haul operations, views WestJet’s coming long-haul offering as more akin to Air New Zealand’s—and Air Canada’s—long-haul offering than Norwegian’s.

WestJet’s 787 service “certainly won’t be ULCC long-haul,” Sims told me in a recent conversation. “This is not Norwegian. I want every inch of real estate on the aircraft to work as hard as possible from a yield perspective … Those 24 seats in [WestJet’s 787] premium economy will be the hardest working yield on the aircraft.”

On its 787s, WestJet plans a traditional business-class cabin with lie-flat seats, an international premium economy offering and, more broadly, a long-haul product with a “mainline” feel.

Increasingly, it looks like Sims replacing Gregg Saretsky as WestJet’s CEO in March marked a fairly clean break from WestJet’s past and the beginning of its future. At the time, Sims spoke of the “next chapter” for WestJet and credited Saretsky with setting “the foundation for WestJet’s global evolution.” Sims will pilot WestJet through that evolutionary step.

In our conversation, Sims noted WestJet is becoming more of a hub-and-spoke carrier (“We’re building hubs to feed the Dreamliner,” he explained), is preparing to open airport lounges, and is making other changes—such as equipping onboard kitchens to cook hot food—that position it to compete as an elite global airline. “A lot of the changes are subtle but very significant,” he said.

(Aaron Karp/Aviation Daily)