Shipowners’ Club published guidance on crewmembers’ responsibilities for maintaining security of IT systems on board, safeguarding personal devices and identifying which equipment is most vulnerable on board.
How can the crew protect themselves and the vessel from a cyber-attack?
Crew members can take various measures actions to avoid their vessel becoming compromised:
- Do not Jailbreak a device: Make sure that the mobile device is updated regularly, and the device is not subject to ‘rooting’ or ‘jailbreaking’. Rooting is a process that enables access to an Android device with ‘root’ or ‘system’ privilege, which then allows the user to install or make any modifications. Jailbreaking regards Apple products in the same way. The aim of these actions is to remove restrictions imposed by the manufacturer or operator. When a device is rooted or jailbroken, there is a high chance that the device can have spyware, trojans, rootkits, or other forms of malware installed easily without the owner’s knowledge;
- Do not plug personal items into the ship’s critical network: Crew that has access to or manage important ship systems must not plug personal devices into any of the ports on these management systems or Human-Machine Interfaces (HMIs). As the Shipowners’ Club says, it is imperative that devices used for accessing and/or managing ship systems are not used for web-browsing, social media, internet surfing or personal emails;
- Avoid clicking on phishing emails: Phishing emails are sent by hackers to get unknowing users to click on malicious links or files. They are usually well built to look like a legitimate sender to confuse the recipient. Phishing attacks are one of the most successful and common attack methods for hackers, due to the fact that it saves them the effort of having to find another way through a firewall.
Most vulnerable equipment
The most vulnerable systems on board are usually the oldest and least updated systems. These systems often operate in a plaintext format or are using old protocols for management or operation. What is more, they tend to be linked to managing process control, safety and support functions such as Distributed Control Systems (DCS). DCS is a term for systems that collect, process and forward data on board ships such as alarms, video, private telephone systems, engine controls and dynamic positioning among others.
[smlsubform prepend=”GET THE SAFETY4SEA IN YOUR INBOX!” showname=false emailtxt=”” emailholder=”Enter your email address” showsubmit=true submittxt=”Submit” jsthanks=false thankyou=”Thank you for subscribing to our mailing list”]
The problem is getting worse when the most vulnerable systems are also the most significant. A defence-in-depth strategy is necessary when securing these vulnerable and critical systems. Defence-in-depth is the layering of protections to access critical systems, making it more difficult to bypass security to access the system. The most crucial systems and those programs that have access to or control these systems, are the most important and will require the highest level of redundancy and security measures.
How can the crew ensure that equipment is safe to plug into the ship’s systems?
To reduce the danger of plugging equipment into lower security and higher security systems, crewmembers are encouraged to:
- Prohibit any uncontrolled devices from accessing the most critical systems: Any equipment or systems allowed to access these or the networks that include these important systems, should be fully controlled and established policies and controls should be in place that identify everything that is allowed, and more specifically what is not allowed;
- Ensure devices have a current and updated antivirus software installed: Before equipment is plugged into the systems to patch an air gapped system or to transfer a file, file integrity checks and antivirus scans should be automatically performed;
- Ensure that the ability to install third party software or applications is completely controlled and restricted only to system administrators.
However, the crew must give special consideration to the ‘Bring Your Own Device (BYOD)’ policy. If such policy is allowed, the Club says that operators must implement a comprehensive asset loss aversion solution and policy. Devices that are allowed into the network should be controlled by an appropriate measure. If a BYOD device is lost or stolen, the IT team must be able to remotely wipe the device. The IT team also has to capable of preventing unauthorised installs and downloads to these devices.
Special precautions for isolating networks on which the ship’s communication equipment functions?
The crew must segment and separate networks into different areas of trust depending on the importance of the systems that operate on those networks.
The key word here is network, any system that is communicating with a critical system is also deemed to be critical, and hence part of the network
Shipoweners’ Club stated.
Nevertheless, it must be noted that a network must not be over-secured to the point of damaging availability of critical systems. The target of security is to limit the risk of possible asset loss, and not reduce the availability of necessary services to authorised personnel.
