Historically, ship owners protected themselves from pirates with weapons.
Today, criminals also use an arsenal of digital weapons to attack.
And globally, the maritime industry is struggling to keep up as cybercriminals get faster and smarter.
A key example is La Marina de Valencia,home of TNWs first conference in Spain in March 2023.
It operates as a Port 4.0 testbed and the worlds first cybersecurity Living Lab for the maritime industry.
It’s free, every week, in your inbox.
The Port 4.0 project is the brainchild of the Valencia 2007 Consortium and Telefonica Tech.
Now theres an app that allows boat owners to manage their vessels and bookings remotely and in real-time.
The owners of the moored boats now also enjoy digitised electricity and water supply services.
This tests 5G communications, signature and certification platforms, proprietary identity systems, blockchain, and cloud repositories.
And its a powerful way of testing the level of security of new tech in the wild.
This threat poses a real and costly risk to the industry.
Maritime organisations distributed and global nature makes them an appealing target for cybercriminals.
Vessel downtime is expensive.
This increases the likelihood of a ransomware payout to avoid disruption.
And the problem is only getting bigger.
A modern maritime vessel involves a complex plethora of digital and hardware devices.
This opensthe potential for cyber attacksboth onshore and offshore.
The opportunities are huge.
And there are a variety of different methods.
The maritime industry has been no stranger to ransomware attacks.
The worlds largest shipping and logistics companies have suffered ransomware attacks, includingCOSCOfrom China andCMA CGMfrom France.
Even passenger vessels arent immune.
There is no formal legal requirement toreport ransomware attacksincreasing the challenge of preventing further attacks by monitoring cybergangs.
It provides a means to detect and prevent illicit activities at sea.
AIS hacking also can misrepresent a ships location.
Naval vesselsare extremely attractive to cybercriminals.
In June 2021, the AIS tracking of two UK and Netherlands Navy ships washacked.
But in reality, live camera feeds show that the vessels had never left port.
This could affect crude oil prices.
For example, in May 2020, Irans busy Shahid Rajaee port terminal washacked.
Computers regulating vessels, trucks, and goods flow crashed simultaneously.
It resulted in a massive blockage of waterways and roads near the facility.
It was allegedly by Israeli operatives in response to Irans cyberattack against Israeli water supplies.
And it hit Copenhagen-based shipping giant A.P.
They also made it look like theyachtcrashed into Snake Island, Ukraine, with the destination of hell.
Now Putins yacht is on the right track!
Theres the combinatorial complexity of legacy and modern equipment unable to guarantee security.
This is because legacy equipment is out of warranty and cannot be patched.
The challenge of securing the seas is exacerbated by a lack of reliable end-to-end digitization.
Ng explains, Often the ship managers will decide, theyre just not even going to fix it.
Or theres just not enough time to do it.
This is due to waiting queues at docks.
Thats a long time between in-depth security updates.
Insider jobs are also part of the mix
Insiders can also aid cybercriminals.
One shipping company employee recalled:
Ive seen Captains and others stealing, photographing documents, and selling them.
Then, theres plain old reluctance.
The audience extends from students and government to manufacturers and companies who have experienced or are anticipating an attack.
She explained, We look at systems currently deployed, but also next-generation technology that hasnt hit shelves yet.
Earlier this year, the research department worked with the Bank of England.
They wanted to test how some of the worlds leading insurance firms would respond to a maritime cyber attack.
They used a scenario where an individual or organisation gains access to the bridge system of commercial seagoing vessels.
This caused physical damage to ships and ports.
The maritime supply chain, accounting for 90% of world trade in goods, was heavily disrupted.
This can massively drive up the cost of insurance policies and leave the shipping industry significantly out of pocket.
Is there hope for the ships of the future?
In the short term, no.
He laughed, not even close.
But fortunately, the tides are turning.
The International Association of Classification Societies has developed two Unified Requirements (URs) on cyber resilience.
Vessels regulations cover equipment identification, protection, attack detection, response, and recovery.
UR E27aims to ensure system integrity is secured and hardened by third-party equipment suppliers.
However, as Ng notes, this excludes the 70,000-odd vessels currently operating.
Kimberley Lam is hopeful that we can meet all the threats in the upcoming years head-on and be prepared.
However, she remains concerned about the influx of nation-state threats.
And in case of the next attack, its a matter of when not if.
Story byCate Lawrence
Cate Lawrence is an Australian tech journo living in Berlin.
