Cybersecurity on the High Seas

Access to or the reading of sensitive data is a comparatively less important problem when compared with the effects caused by hackers introducing malware into the control systems of ships or drilling rigs, altering coordinates, or accessing a vessel’s security-relevant subsystems. These acts don’t just endanger cybersecurity, they also impede functional safety, and ultimately the crew’s safety. This is precisely why recommendations regarding cybersecurity have increased along with the level of digitization and networking. The American Bureau of Shipping, the Baltic and International Maritime Council, Lloyd’s Register Group, the UK Chamber of Shipping, and the European Union Agency for Network and Information Society have all published guidelines regarding cybersecurity aboard ships. In general, they define processes, model approaches or technical measures for implementing cybersecurity; for the most part, these align with the guidelines for automation technology.

And finally, better networking of shipping companies and harbor unions improves the logistics at the docks and reduces fuel consumption for the ships. Simply preventing external access cannot be a solution for fixing security on ships. Defense in depth, however, which has previously been considered as state of the art, will soon become insufficient – even if it starts with access limitations, network segmentations and monitoring systems on the various levels of ship automation

Security concepts are increasingly required that always function, regardless of the time or remote access point. The new demand is for “IT Security by Design,” that is, functions of cybersecurity that are integrated from the start into the configuration of a layer-based security architecture in the controllers.