A major cyber incident has far-reaching implications. Surviving such a cyber emergency crisis requires rapid mobilisation of a number of key functions to work in alignment. Preparation through regular exercises strengthens an organisation’s ability to respond effectively during a crisis.
Blending skills across all departments, not just fleet management and IT, can provide a more effective strategy for cyber risk management. This can be done by implementing cross-functional crisis teams. This approach moves beyond basic compliance and enables cyber threats to be evaluated and mitigated against more effectively. Max Bobys, Practice Director at Hudson Cyber confirmed to Thetius that this is, “One of the most effective strategies that shipping companies of any size should consider.” A matrix maturity model approach that covers the different functional areas of the business enables each individual in that group to have an area of responsibility that they have to report on, track, and implement against, according to Mr Bobys.
Interestingly, many shipping companies already have a cross-functional crisis team process in place for physical crises. It’s a standard safety management procedure. Physical security is more intuitive and tangible physical threats can be visualised, unlike cyber threats. In the majority of cases, IT isn’t yet considered a critical part of that cross-functional team. This is largely due to the fact that the crisis team hasn’t envisaged the need to cover cyber attack scenarios, and in physical incident scenarios, IT is not necessarily critical.
Connectivity- A double-edged sword?
Changes to the Maritime Labour Convention in 2021 placed internet access higher on the list of humanitarian requirements for seafarers, but the labour force itself will to a large extent force crew connectivity to expand at sea. In 2022, Thetius gathered opinions from over 200 seafarers about digital connectivity and the future of the seafaring trade. The results showed that 88% of seafarers believe that digitalisation will result in major new ways of operating vessel fleets within five years. More surprisingly, more than 1 in 3 seafarers chose access to digital technology as the most important factor when considering working for a new employer. These respondents placed a higher priority on connectivity than they did on pay, conditions, or shore leave.
With other forms of high-performance connectivity rising rapidly, such as coastal 5G and Low Earth Orbit (LEO) satellite networks, high-capacity data exchange pathways are proliferating rapidly across the merchant sector and maritime transport. Thetius’ 2023 survey found that 43% of respondents said their company is planning to roll out LEO satellite communications within the next 12 months. This level of connectivity makes cloud services at sea a very real possibility. But LEO networks in particular hold the potential to increase the number of backdoor vulnerabilities and expand infiltration opportunities.
We must also not forget the additional training that the crew will require with increased connectivity onboard. While the potential exploitation of vulnerabilities of onboard systems is one challenge, another one is the fresh opportunity for online fraud of crew.
To explore the areas highlighted in this article, download our thought leadership report, produced in collaboration with CyberOwl and HFW, titled “Shifting Tides, Rising Ransoms and Critical Decisions”. This comprehensive report offers insights into the evolving landscape of cyber threats in the maritime industry and explains that there is a new approach towards managing cyber risk. You can download your copy of the report here.
