Cyber Operators Course (Op) – Module 1
“Firefighting on board, is it purely OT or is it connected to any external IT?”
Disruption of the operation of OT systems may impose a significant risk to the safety of on board personnel, cargo, damage to the marine environment, and impede the ship’s operation. This is why the ever advancing link between OT and IT systems creates an ever expanding risk that could be caused by Cyber Crime or other means.
Cyber Operators Course (Op) – Module 1
Vessels have always tried to stay “off-grid”. As let’s be honest, out there we are on our own anyway. As an example, we are quite rightly nervous about external people having remote control over our fire fighting or navigation equipment, as they will not be the one standing in the middle of the ocean holding the extinguisher or trying not to ground. Which is why you often hear “why are you doing that, don’t touch my equipment”
You need to list what can be “touched” externally, and what is safer?
“The problem with a Typewriter is that I can’t download the latest software patches to keep me safe from a Virus or Hacker…”
Few shipping hacks have made the public domain. However, all of the below scenarios are practical, possible and realistic where traditional OT has been integrated into IT;
Affecting stability and ballast
Modifying a GPS signal
Targeted piracy with AIS and RADAR.
Changing the current position of a ship on an ECDIS system, or modifying the digital chart to confuse and therefore cause issues for officers or crew.
Damaging ECDIS or Radar, or rendering them useless.
The most serious issues that could be caused are threats like, locking autopilot on in a vessel and steering the vessel directly towards a landmark to cause a disaster.
Or they could overload the engines either causing a complete shutdown meaning loss of power meaning unable to move OR causing a fire onboard a ship.
Cyber Operators Course (Op) – Module 1
For too many years, our perception of hacking attacks has been driven by the media and security vendors looking to make a sale, or movie makers trying to alarm us. Some independent researchers and academics make a case with a more balanced view, but we are stuck with a lack of metrics; a lack of statistical data by which to make meaningful risk decisions. This is compounded by several factors:
Cyber Operators Course (Op) – Module 1
In private, ships masters and operators will admit to plenty of hacking incidents, however, this anecdotal evidence does not help a cash-strapped operator decide where to invest limited funds.
Hence, the industry is short of actuarial data with which to make risk-based decisions on cyber matters.
Your organisation and your vessels will be hacked in some form at some point. If you are well prepared, then the damage will probably be minimal; an irritation.
If you are not well prepared, it will be an expensive exercise, possibly business-limiting
Every single organisation of the thousands the writers of this book have dealt with has had some form of a hacking incident over the years.
Some involved data loss, ransom or corruption, others involved theft of monies or technical equipment, other theft of intellectual property.
“I have seen businesses go bust as a result of a hack, I have seen others brush off incidents as they were well prepared. Those who state that they have never been hacked, in my experience, simply don’t have the expertise or systems in place to know whether or not they had been.”
Ken Munro of PenTestPartners
.
*Above: Non reported near-misses is a well-documented issue in the wider Maritime Industry. Source of above image: www.Maritime-Executive.com
Cyber Operators Course (Op) – Module 2
If you turn off your system incorrectly, any files that were being saved may be incomplete or not saved at all. This can then go ahead and create corrupt data due to the fact you didn’t allow the computer to finish writing to the disk correctly. Your Computer could now also permanently damage the hard drive due to not being turned off correctly. This is due to the actuator arm unable to park its self by the side of the disk. Instead, it may come to a slow stop and park itself upon the disk and scratch it, therefore damaging the disk and making it unusable.
The consequences of this can be that for a long time you might get lucky and the data corruption may be in an area of the disk that you don’t notice, or a file that you can do without. But after much time or even after very little time you will probably, when you need your computer most, find that one of your important programs no longer works because an important file is corrupt. Or worse, Windows will no longer boot because the registry has become corrupt.
(Have you ever seen this screen before?)
Cyber Operators Course (Op) – Module 2
Use System Restore: If your system recently started blue-screening, use System Restore to roll the software back to a previous state. If this works, you’ll know that it’s likely a software problem.
Scan for Malware: Malware that digs deep into Windows and gets its hooks into the Windows kernel at a low level can cause system instability. Scan your computer for malware to ensure buggy malicious software isn’t causing it to crash.
Install Updated Drivers: An incorrectly installed or buggy driver can lead to crashes. Download the latest drivers for your computer’s hardware from your computer manufacturer’s website and install them — this may fix BSODs caused by driver problems.
Boot into Safe Mode: If your computer is blue-screening every time you turn it on, try booting into safe mode. In safe mode, Windows loads only the essential drivers. If a driver you’ve installed is causing Windows to blue screen, it shouldn’t do so in safe mode. You can work on fixing the problem from safe mode.
Check for Hardware Problems: Blue screens can be caused by faulty hardware in your computer. Try testing your computer’s memory for errors and checking its temperature to ensure that it isn’t overheating.
Reinstall Windows: Reinstalling Windows is the nuclear option. It will blow away your existing system software, replacing it with a fresh Windows system. If your computer continues to blue screen after this, you likely have a hardware problem.
Cyber Operators Course (Op) – Module 1
GDP (Gross domestic product) is one of the primary indicators used to gauge the health of a country’s economy. The GDP of Russia is $1.5 Trillion USD. That means if Cyber Crime was a country, it would have the 13th highest GDP in the World.
This $1.5 trillion figure includes:
$860 billion – Illicit/illegal online markets.
$500 billion – Theft of trade secrets/IP.
$160 billion – Data trading.
$1.6 billion – Crimeware-as-a-Service.
$1 billion – Ransomware.
.
Nowadays, where everything on our vessels is controlled with technology and computers, we have to be very careful of incoming threats created to cause damage or safety concerns.
At the end of this course, we will be reviewing 10 high profile shipping incidents that added to the above figures. They are only 10 of the many incidents that are reported and does NOT include the high profile Maersk incident that has been well documented already.
Learn from this course and add to your “common sense” so you are not responsible for the next major incident!
Cyber Operators Course (Op) – Module 2
If you ask “do you ensure that all passwords are complex and changed regularly” then you’ll get a “yes”.
The IT guy is thinking “our user passwords for business computers are good” but they’re not thinking about other areas. It may be true that certain areas of the vessel are secure, however instead ask:
“which of your passwords on your systems are blank, default, simple or re-used?”
Then you might find out that the key component of their vessel network is on the public internet and has a default password!
Ask the OT teams how they deal with device passwords. You might be surprised how weak the passwords are, or if they’ve been changed from the vendor’s default password!
“When conducting deep Navigation Audits, I often need to access the CCRP page on ECDIS (which is locked out by the manufacturer requirement password) or see how the DGPS unit is configured. Most of the time the passwords I need to either configure a unit or to access the LAN are dyno-taped on the unit itself.”
Neil, On-board Auditor for ECDIS Ltd.
Cyber Operators Course (Op) – Module 3
Thieves are often excellent social engineers. Watch the movie ‘Catch me if you Can’ for some great examples of how ‘talking the talk and walking the walk’ can gain access to sensitive areas.
A vessel often has many different personnel aboard, particularly when in port. It could be very easy for a motivated individual to board the ship and place a ‘back door’ device on the ships network.
Once placed, the hacker would have continuous remote access to the network on the ship. A back door can bypass the security all of the network perimeter defences such as firewalls.
Defending against the social engineer is clearly important.
Cyber Operators Course (Op) – Module 1
Cyber Security affects all industries. The fact that ships are being controlled more and more by computer systems means that attackers have a more valuable target. With this in mind, we need to know what we can do to help mitigate or prevent computer-based Cyber Attacks
(Now take a few minutes to review this image and start making a list in your mind of all the different computer-based systems on board YOUR vessel)
*Image from www.PenTestPartners.com who Consult in Maritime Cyber and conduct vessel penetration testing.