Despite cyber security representing one of the greatest challenges faced by the industry, many shipowners and managers are still unaware of the risks of not having a solid cyber security strategy in place. This risk is only amplified by the Russia-Ukraine conflict, says law firm Ince
To put the increasing threat into perspective, a [ds_preview]recent report by Check Point Software noted a 42% global increase in cyber-attacks, with ransomware attacks most common. Globally there has been an 82% increase in data attacks since 2021.
Julian Clark, Global Senior Partner at Ince, outlines the current cyber threats faced by shipowners, and the importance of investing in cyber security for the safety of a vessel, its crew, and its owner
The Russian risk
Russia’s cyber activity has increased significantly since its invasion of Ukraine. Research by the European Parliament found there were 25 major cyber-attacks on Ukraine within the first three months of the invasion alone and governments recognise increased cyber activity will start to impact commercial shipping assets.
Many groups and authorities have blacklisted Russian vessels, creating a further risk of Russian hackers striking back with cyber-attacks. One form of retaliation includes strategically disrupting AIS tracking signals to evade sanctions and impede the trade of those who are deemed anti-Russia or allied to Ukraine. While not war in the legal sense for countries outside Russia and Ukraine, Mr Clark has described the current position as a new form of, »Global economic war«.
Cyber-attacks can significantly disrupt global trade. For example, while there is no evidence that the incident was the result of a cyber-attack, the grounding of the Ever Given in 2021 cost an estimated $10bn a week in lost trade. This demonstrates just how devastating and costly a disruption to global shipping can be.
It is also not uncommon for state-sponsored cyber-attacks to target shipping or commercial assets. The »NotPetya« ransomware attack in 2017 affected Ukraine’s financial, energy and government institutions and was found to be ‘almost certainly’ a result of Russian military activity according to The UK National Cyber Security Centre. Potentially of more concern is the growing threat of ransomware as a service (RaaS) where established hackers will sell their services to assist an attack in return for a commission taken from the ransom payment.
Lacking security
The risk of a Russian cyber-attack could be perceived as a short-term threat not warranting long-term investment in cyber security. But this is not the case. Coding software is increasingly efficient, making it far easier for individuals to develop advanced coding skills. A vessel’s OT is not only at risk from attacks by Russian military, but also from any person with the skills and motivation.
Only 42% of organisations protect their vessels from OT cyber threats. 90% of corporations are unable to defend even the most basic of attacks. This shows most shipowners are unprepared and operating with significant legal risks and are failing to properly invest to manage this growing threat. If a vessel does not have adequate cyber protection, any legal consequences from an OT attack will be directed towards the owning entity, rather than the vessel operators, potentially exposing shipowners to considerable damages claims. The failure of an owner to check and mitigate a vessel’s exposure to cyber-attacks could be deemed recklessness, ultimately resulting in a vessel being found unseaworthy. It is of major concern, says Mr Clark, that IT and in house cyber security personnel are failing in fully communicating the level of risk to C Suite.
It is also essential to highlight the significant safety risks that cyber-attacks pose to seafarers. A cyber-attack could, for example, result in a safety system showing an incorrect ballast tank fluid level, leading to dangerous instability for the crew when handling cargo.
The bottom line is, cyber security must be considered an integral part of maritime and vessel infrastructure. The legal and safety risks of a cyber-attack, from Russian military or otherwise, make investing in a sufficient cyber security solution a no-brainer. ED
