Cyber Management Course (Ma) – Module 10
Management could be considered Master, Owner, Operator or let’s be honest…. head of Department, or the person in charge…. which is probably you! Whatever you are called, your role is to keep the ship safe. Full stop.
This final module is designed to give you ideas for scenarios to take to your team, and talk through.
Better still, exercise, as we talked about earlier in this Management module.
Cyber Management Course (Ma) – Module 9
What procedures are followed when importing BAPLIE and similar data to the vessel?
What processes are in place to ensure that USB keys containing loading data are free from malware?
Are USB keys ever given to third parties to load data on to? Are USB keys from third parties ever inserted in to vessel systems?
If data is transferred over the internet (e.g. email) what processes are followed to ensure that the files are safe to use?
Ask how the crew would detect if loading data had been tampered with?
Do sufficient procedures exist to rapidly correct a significant out of trim or GM situation?
Cyber Management Course (Ma) – Module 9
Routing EDIFACT messages through a community message broker may reduce direct risk, though one then relies on the security of the broking service.
BAPLIE or bay plan messages are often passed to the vessel by USB or email. Follow good cyber hygiene practice with these, as discussed elsewhere in this guide.
Ensure that your message service is not available on the public internet. This can be achieved through an access control list (ACL) that only allows access from known good message sources.
Financial information can be passed in a related form of EDI message known as IFTFCC. It is important to validate any payment instruction through another method to ensure that bank account details have not been tampered with by a hacker.
Cyber Management Course (Ma) – Module 9
The verified gross mass for a container is passed in an EDIFACT message. The vessel bay plan software will use the VGM in order to determine where to place the container for optimum GM, trim and load/discharge efficiency in port.
It may be possible for a motivated hacker to tamper with message to fool the planning software in to placing containers inappropriately and changing GM or causing delays in discharging loads as containers are incorrectly buried deep in the stack.
However, of greater concern is the ability to steal containers from the port using the same messaging system. Legal documents published around a case between Glencore and MSC show that a hack of an agent resulted in container PIN release codes being compromised and two containers of metal cobalt worth >$1M being stolen from a port.
Similar techniques may be used to cause containers to be discharged at the wrong port in to the waiting hands of criminals.
Finally, targeted piracy has been reported that appears to involve knowledge of the bay plan by the perpetrators. After boarding, instead of holding the vessel ransom, a small number of containers of high value items are emptied and the pirates leave.
EDIFACT messaging includes information about the description and value of the cargo. That’s clearly of great interest to criminals.
Cyber Management Course (Ma) – Module 9
The extent of EDIFACT is so large that it cannot be discussed in sufficient detail here, however we will look at some potential attacks and mitigating strategies
A sample EDIFACT message:
Cyber Management Course (Ma) – Module 9
To quote wikipedia: “United Nations/Electronic Data Interchange for Administration, Commerce and Transport (UN/EDIFACT) is the international EDI standard developed under the United Nations.”
EDIFACT is a development of EDI, with its beginnings in the standard shipping message formats first developed and used to manage the logistics of the Berlin Airlift in 1948
Today, EDIFACT messaging is used for almost all containerised transport movements. The message format is managed and developed by SMDG.
SMDG is a non-profit Club, run by and on behalf of companies and organizations working in the maritime industry, like container terminals, ocean carriers and related companies and organizations.
SMDG develops and promotes UN/EDIFACT EDI-messages for the Maritime Industry and is an official Global User Group, recognised by the UN/EDIFACT Board.
Cyber Management Course (Ma) – Module 8
It is recommended that companies should fully understand the ship’s OT and IT systems and how these systems connect and integrate with the shore side, including public authorities, marine terminals and stevedores. This requires an understanding of all computer based onboard systems and how safety, operations, and business can be compromised by a cyber incident.
The following should be considered regarding producers and third parties including contractors and service providers:
Cyber Management Course (Ma) – Module 8
Ships are becoming more and more integrated with shoreside operations because digital communication is being used to conduct business, manage operations, and retain contact with head office. Furthermore, critical ship systems essential to the safety of navigation, power and cargo management have become increasingly digitalised and connected to the internet to perform a wide variety of legitimate functions such as:
engine performance monitoring
maintenance and spare parts management
cargo, loading and unloading, crane, pump management and stow planning
voyage performance monitoring.
The above list provides examples of this interface and is not exhaustive. The above systems provide data, which may be of interest to cyber criminals to exploit.
Modern technologies can add vulnerabilities to the ships especially if there are insecure designs of networks and uncontrolled access to the internet. Additionally, shoreside and onboard personnel may be unaware how some equipment producers maintain remote access to shipboard equipment and its network system. Unknown, and uncoordinated remote access to an operating ship should be taken into consideration as an important part of the risk assessment.
Cyber Management Course (Ma) – Module 8
Companies should evaluate and include the physical security and cyber risk management processes of service providers in supplier agreements and contracts. Processes evaluated during supplier vetting and included in contract requirements may include:
security management including management of sub-suppliers
manufacturing/operational security
software engineering and architecture
asset and cyber incident management
personnel security
data and information protection.
Evaluation of service providers beyond the first tier may be challenging especially for companies with a large number of tier one suppliers. Third party providers that are collecting and managing supplier risk management data may be an option to consider.
Lack of physical and/or cyber security at a supplier within their products or infrastructure may result in a breach of corporate IT systems or corruption of ship OT/IT systems.
Companies should evaluate the cyber risk management processes for both new and existing contracts. It is good practice for the company to define their own minimum set of requirements to manage supply chain or 3rd party risks. A set of cyber risk requirements that reflect the company’s expectations should be clear and unambiguous to vendors. This may also help procurement practices when dealing with multiple vendors.
Cyber Management Course (Ma) – Module 8
The importance of this relationship has placed the agent4 as a named stakeholder, interfacing continuously and simultaneously with shipowners, operators, terminals, port services vendors, and port state control authorities through the exchange of sensitive, financial, and port coordination information. The relationship goes beyond that of a vendor. It can take different forms and especially in the tramp trade, shipowners require a local representative (an independent ship agent) to serve as an extension of the company.
Coordination of the ship’s call of port is a highly complex task being simultaneously global and local. It covers updates from agents, coordinating information with all port vendors, port state control, handling ship and crew requirements, and electronic communication between the ship, port and authorities ashore. As one example, which touches cyber risk management: Often agents are required to build IT systems, which upload information real-time into owner’s management information system.
Quality standards for agents are important because like all other businesses, agents are also targeted by cyber criminals. Cyber-enabled crime, such as electronic wire fraud and false ship appointments, and cyber threats such as ransomware and hacking, call for mutual cyber strategies and relationships between owners and agents to mitigate such cyber risks.