A CYTUR assessment of more than a dozen marine equipment systems found that 94% were rated at a level where cyber risk treatment should be considered or required, with about 60% rated as requiring treatment. The findings suggest shipowners and managers need to look beyond CVE counts and examine how equipment is connected, what services are active and what a compromise could mean for vessel operations.
A new cybersecurity report from CYTUR is urging shipowners and ship managers to look beyond vulnerability counts when assessing the cyber risk of onboard equipment.
The CYTUR Threat Brief, published in September, examined more than a dozen recent equipment-level cyber risk assessments covering systems from more than 10 manufacturers across six categories, including propulsion control, safety systems, automation, navigation, communications and shipboard IT.
Under the IACS Recommendation 171 risk treatment criteria, 94% of the assessed systems were rated either Appropriate or Required. About 60% were rated Required, meaning treatment was mandatory under the assessment framework.
CYTUR cautions that the figure does not mean 94% of marine equipment is vulnerable. The sample consisted of systems assessed for CYTUR clients and was not designed to represent the wider equipment market.
One finding illustrates why CVE totals can give ship operators an incomplete picture. One Integrated Automation System had more than 200 identified CVEs, while another had about 20. Their respective risk levels were 20 and 16, with both rated Required.
CYTUR found that active network services also contributed to risk. One system using serial communications had eight Ethernet service ports active despite the Ethernet interface not being used for primary communication. The same pattern appeared in systems from two equipment manufacturers.
Third-party components were another source of exposure. In one assessment, the equipment manufacturer’s core controller had zero public CVEs, while an industrial network device installed alongside it had 13. Another system contained 80 CVEs across off-the-shelf PLC, HMI and I/O components.
CYTUR identifies four factors that shipowners should assess together: vulnerability, exposure, connectivity and impact.
The report also records a case where remediation reduced a system’s risk level from 20, rated Required, to 12, rated Appropriate, after software and firmware updates, removal of unnecessary services, encrypted management communication and verification of the network configuration.
As the report puts it: “What risk could this vulnerability create on the actual vessel?”
