CYBER SECURITY INDUSTRY GUIDELINES Aron Sorensen, Chief Marine Technical Officer, BIMCO 1
BIMCO Founded in 1905-2,300 members in around 130 countries Membership includes shipowners, operators, managers, brokers and agents Developing industry standards, and providing quality technical information, advice and education Advocating the oppinion of our members at IMO, ISO, IALA, IHO etc. 2
AGENDA Background for industry guidelines Considerations on cyber Risk based and agile approach 3
BIMCO S WORK In 2013, the BIMCO Executive Committee highlighted the importance of cyber security Ø 2013 2014 Information gathering - to deal with cyber security needs and challenges in the maritime sector In March 2014, added to the agenda of the Marine Committee and of the Security Committee Ø Decided to develop industry guidance on cyber security for ships 4
SHIPS ARE VULNERABLE TO CYBER ATTACKS Ships chartered to 3rd party operators Ø The shipowner does not have control over the IT systems required by the charterer Historically ships have been offline Ø Today cyber security cannot be controlled through avoidance of connectivity 5
SHIPS ARE VULNERABLE TO CYBER ATTACKS Critical data pertaining to cargo is passed through numerous land-side entities Ø Penetration of just one entity can result in any data element being compromised A high reliability on IT systems related to safety Ø ECDIS and satellite receivers make a ship susceptible to either penetration or jamming 6
RISKS ON BOARD SHIPS Lack of software and system monitoring Insiders introducing malware by storage devices etc. Outdated (Microsoft) software Remote attacks by criminals Unprotected or badly designed hardware and networks 7
ATTACKING A SHIP WILL NOT STOP WORD TRADE A ship is an independent unit and a cyber attack may compromise safety of that ship, the marine environment and to some extent, the business continuity of the owner To a large extent the crew will use the same contingency plans as for any other emergency if the ship is compromised 8
AGILITY NEEDED Cyber attacks develop constantly so mitigating measurers will also have to change accordingly IMO regulation would be too slow Type approval of software is not the way forward, as it is a static process We see industry best management practice as the way to cope with cyber security 9
SPECIAL ATTENTION Cyber security should be carefully considered: Ø When taking over a new building and buying used tonnage Ø In connection with on-board software maintenance Ø When dealing with an always open on-line connection 10
IT STARTS DURING CONSTRUCTION OF THE SHIP Producer should have a QA system for software lifecycle activities, which specifies cyber-security considerations Ships networks should be configured to have controlled and uncontrolled networks 11
RISK BASED APPROACH NEEDED Some organisations, ships and systems may be more at risk than others, depending on the type and value of data stored To manage risks, ships personnel and owners should understand the probability that an event will occur and the resulting impact 12
INDUSTRY GUIDELINES ON CYBER SECURITY ON BOARD SHIPS The guidance to ship owners and operators includes how to: Ø minimize the risk of a cyber-attack through user access management Ø protect on board systems Ø develop contingency plans and Ø manage incidents if they do occur 13
IMO PROCESS At MSC 94 (November 2014), proposal for guidelines for ports, ships, and other parts of maritime transportation system Ø BIMCO informed that we were working on guidance for shipowners and crew on operational aspects of cyber security on-board ships Update paper by BIMCO, ICS, INTERTANKO and INTERCARGO submitted to MSC 95 (June 2015) Ø Intention to present the finalized guidelines to MSC 96 14
RELATED WORK Working with CIRM since 2013 on a draft industry standard Maintenance and update of onboard programmable electronic systems Ø The cyber work and the CIRM work are interrelated and coordination is essential Manufacturers should develop, manage and update computerbased systems in a secure way 15
INDUSTRY SOFTWARE MAINTENANCE GUIDELINES Event initiation Preventative maintenance Corrective maintenance Planning Where and when Best service engineer for the job Onboard software log Execution Execution and control Cyber security After service Service report and onboard software log Evaluation and feedback 16
CONCLUSIONS Awareness needed in the industry Ships are exposed to a cyber-threat calling for a risk based approach Ø Industry Guidance will be submitted to MSC 96 Ø Cyber crime is developing all the time and we need to keep up Cyber security considerations should start at the software production stage and cyber robustness considerations should be made when the ship is constructed 17
Aron Frank Sørensen Chief Marine Techncal Officer BIMCO www.bimco.org afs@bimco.org Thank you for your attention Questions?