⊗

Maritime represents such a different environment for cyber protection that it requires a complete rethink of how best to shield ships from hackers. To this end, a group of researchers at the University of Plymouth in the UK have developed MaCRA, or the Maritime Cyber Risk Assessment framework, a unique solution to identify dynamic, vessel, cargo and route-specific cyber risks. It enables international shipping operators and insurers to rapidly assess individual ship’s or entire fleets’ unique cyber risk profiles. The new system is well timed. From January this year, the International Maritime Organization (IMO) requires ship operators systematically to address cyber security. MaCRA’s adaptive risk assessment ability is built around the insight that shipping’s myriad cyber risks are amenable to predictive modelling and mitigation through systematic analysis of vessel-type, onboard IT and operational technology (OT) systems, route and cargo variables. MaCRA dynamically correlates each voyage and fleet’s cyber risk signature with probable attacker motivations. There may be much more stealthy cyber manipulations which could stay below the radar for years Dr Kimberly Tam, a lecturer in cyber security and MaCRA project lead, explains that when her team applied standard frameworks to possible cyber attack scenarios, they didn’t fully capture the risks and dangers in the uniquely dynamic maritime context with its hugely diverse inventory of IT and OT components. And because cyber is relatively new, they could not build risk knowledge based on historical data. While some maritime operators recognised they needed better security, she says, they were not sure what that would look like. “We talked to some who believed they didn’t need much standard cyber security, but said they were being hassled to adopt solutions not appropriate to them,” Tam relates in conversation with Splash Extra. With MaCRA, the Plymouth team looked for a quantitative approach to potential vulnerabilities in order to identify and prioritise risks that many would not consider. The result, MaCRA, is an industrial-strength software as a service solution accessible via handheld and desktop applications, which is now set to be marketed globally. Soft target? Much has been written about shipping being a soft target for hackers, something Tam, whose career also includes stints with Hewlett-Packard and various US government labs, takes issue with. “Shipping has unusual qualities that may deter some attackers and interest others. But being different is thin protection. It’s better to be difficult to compromise,” she says. The worry is that many of the attacks people have heard of have been high profile but not necessarily highly sophisticated. “The real concern is we may start seeing attacks specifically designed for the maritime sector,” Tam warns. “In amongst the high profile ransomware attacks there may be much more stealthy cyber manipulations which could stay below the radar for years.” Tam and her team have detected a lot of IT attacks recently that affect the OT side. They are also beginning to see attacks demonstrating hackers’ growing understanding of maritime and its specific OT. Then there is the industry and media attention around more or less autonomous vessels that may present what she describes as “interesting, high-profile challenges” to cyber attackers. Having won various awards and notable government funding, the plan is to get the system on ships soon. Professor Kevin Jones, a man with 20 years’ Silicon Valley experience and a track record of raising more than $20m in start-up environments, is onboard to drive this next phase. “MaCRA will include tools for users across maritime, enabling individual ship and fleet operators, as well as insurers and class societies, to quantify and prioritise per vessel, fleet or operation specific risks. It will equip the sector with a cost-effective and meaningful way to address IMO cyber regulations,” says Forshaw, the university’s director of industrial and strategic partnerships.

Hacked off

A team at the University of Plymouth have developed a novel approach to maritime cyber protection

⊗

To continue reading, please login below or subscribe here.

Read Next

Costs for armed guards onboard rocket

Reining in black swans

March 2024 Review

March’s tanker rollercoaster

A sense of euphoria sweeps through dry bulk

Costs for armed guards onboard rocket

Reining in black swans

March 2024 Review

March’s tanker rollercoaster

A sense of euphoria sweeps through dry bulk

Maritime CEO Forum Singapore

Maritime CEO Forum Monaco

Advertising

Press Releases

Splash

Splash Extra

Splash Special Reports