Cookies help us deliver the best experience on our website. By using our website, you agree to our use of cookies Dismiss

BV sees rapid growth in ships applying for Cyber Managed notation

Paillette Palaiologou, vice president for the Hellenic Black Sea & Adriatic Zone, Bureau Veritas Paillette Palaiologou, vice president for the Hellenic Black Sea & Adriatic Zone, Bureau Veritas

Bureau Veritas Marine & Offshore (BV) has announced an increase in the number of ships applying for its ‘Cyber Managed’ notation.

{mprestriction ids="1,2"} The notation was co-developed by BV and external marine security experts as part of joint technical working groups organised by BV. It ensures compliance with the main existing cybersecurity standards (IMO MSC-Fal 1-Circ3, NIST, BIMCO etc.) and will enable shipowners to meet the requirements of IMO’s guidance to administrations that maritime cybersecurity risk should be reflected in ship security practice under the ISM Code by January 1, 2021.

BV expects that more than 100 ships will be operating under the ‘Cyber Managed’ notation by the end of January 2020.

Cyber Managed is based on a security risk assessment developed from an initial mapping of onboard systems that result in a practical set of requirements. Cyber Managed focuses on ensuring that cybersecurity is managed onboard as per industry best practice for change management and traceability of IS/IT systems onboard, emergency procedures and basic security protection measures.

The initial risk analysis and mapping exercise can be performed either during the newbuilding phase or at any time during the lifecycle of the vessel. The notation is applicable to both new and existing ships.

This initial risk analysis results in the definition of mitigation actions that can be achieved through the development of ad-hoc procedures. These procedures are then incorporated into the ship management system (as per IMO MSC-Fal1-Circ3 requirements). The risks may also be mitigated through security protection of remote access and network connections that can usually be performed through software updates. Cyber Managed does not require new equipment to be fitted onboard.

Completion of an initial survey onboard vessels allows the award of the ‘Cyber Managed’ notation. Annual surveys of similar scope combined with other class surveys ensure regular update of the documentation and crew training, and thus the maintenance of the notation.

“Cyber Managed provides a holistic yet pragmatic response to cyber threats to keep owners continually protected. BV’s network of surveyors are confirming compliance with the notation requirements on ships world-wide for Greek owners. We are stressing the practical – the pragmatic – approach that we have enabled. This solution was developed specifically for the marine industry,” said Paillette Palaiologou, vice president for the Hellenic Black Sea & Adriatic Zone, Bureau Veritas.

“We see that shipowners are willing to invest in ensuring they are addressing cyber risks and their charterers are increasingly interested as well. We are seeing interest from insurers as well – and that this notation can be expected to be a factor in the response of underwriters’ assessment of risk.”

BV’s work is best built on an internal risk assessment conducted by a shipowners or manager. This assessment forms the foundation for applying Cyber Managed across an entire fleet. The assessment provides detailed mapping (a ‘repository’) of both the hardware and software installed onboard and assessment of operational criticality.

BV cyber and marine experts support owners during the whole process, providing practical standard template and methodologies for the security risk analysis and technical assistance to develop procedures. This allows in-house teams to significantly increase their awareness of cybersecurity best practices while preparing for the certification.

BV reviews all documentation (onboard handbook, onshore security policies) prepared by the client against the requirements of NR659. Then vessels are surveyed to ensure that the documentation reflects the actual condition of hardware installed. Finally, a ‘Cyber Handbook’ is placed on board - and management practice should be that the crew are made aware of its contents and requirements. These requirements are, typically, to recognize emergency situations, to handle cyber lifesaving technique and, when possible, ensure restoration of systems.

BV has also developed a ‘Cyber Secure’ notation specifically for new buildings to help ensure the ‘security by design’ of ships where cyber security is most critical: remotely-operated vessels, autonomous vessels, military vessels as well as other sophisticated vessel types. This Cyber Secure notation will notably require the hardening of the most critical IS/IT equipment onboard.  {/mprestriction}

Related items

  • Neptune Cyber launches virtual ship safety tool

    Neptune Cyber has launched an innovative new online tool to ensure marine operators stay ahead of new cyber risk regulations that take force in January 2021.

  • Gaining visibility of your onboard systems: you can’t secure something you can’t see

    By Ken Woghiren, Chief Technology Officer, CyberOwl

    Monitoring is the backbone of good cyber risk management. If you don’t know what assets you have and can’t see what is happening to those assets, then you can’t respond properly if they are under attack. But some fleet operators struggle to justify the budget until they better understand the volume and severity of cyber risks they’re exposed to - a vicious cycle, where lack of visibility leads to lack of action. Shipping IT managers can break out of this vicious cycle and implement some basic cybersecurity monitoring. This article sets out some practical guidance to get started. The rationale is clear: even some basic monitoring and a response plan makes your vessel significantly harder to attack than the next one. 

  • BV conducts remote survey for PSA Marine harbour tug

    Bureau Veritas Marine Singapore (BV) in collaboration with PSA has successfully completed a remote marine survey for ‘PSA Aspen’, an LNG dual fuel PSA Marine harbour tug.

  • Global pandemic sees 400 per cent rise in cyber-attacks

    The Coronavirus pandemic is leaving the maritime and offshore energy sectors vulnerable to cyber-attack, with Naval Dome citing a massive 400 per cent increase in attempted hacks since February 2020.

  • We hacked a ship. The owner is liable.

    Author: Ewan Robinson, director of maritime communications and solutions provider Yangosat. 

    We hacked a ship. The Owner is Liable.

    Well, we hacked the communications system of the ship. Technically we have been doing this for a few years.

    This time we did it like a “bad guy” would.

    We got into the vessel, belonging to a multinational company, and found out everything possible about the system, the setup, the manufacturers information.

    This is a very specialised vessel that was alongside in the capitol city of a major European country, carrying out cargo discharge.

    We could have broken the system so badly, the vessel would have been back to Sat-C and flag signals.

    Any information going through that satcomm would have been able to be collected, checked and used.

    As we are Ethical Hackers, we are obliged to act in certain ways. One of them is that we have to tell everyone involved if we did something during testing.

    We did. Well, we tried to.

    The Owners operators, when we finally managed to get someone in the overworked operations department to listen, didn’t care and ignored us.

    The manufacturers didn’t even bother to respond.

    All of the test was documented, peer reviewed and otherwise substantiated by trusted persons.

    The lawyers are going to have a field day and be very happy.

    Ship owners are not.

    Owners and operators are being badly supported and advised by these super providers, who use third party engineers, or poorly trained engineers, and leave systems in an exposed state. Equipment manufacturers and developers are so guilty of poor techniques and security that using “industry best practice” is a total contradiction.

    Lawyers, P&I and Class are going to be so busy refusing claims in the event of a cyber incident, that the poor owners are not going to know where to turn.

    Owners are forced into accepting sub-standard equipment. This equipment cannot be made secure in its current format, and yet the manufacturers and developers, fail to update and secure them.

    The providers supply this equipment, along with the bandwidth and engineers who install them, and then incorrectly configure and allow public access to them. The Owner is still liable.

    So how were they failed?

    We have been presenting at various conferences over the last few years, highlighting how exposed we are as an industry to ‘hackers’ and bad actors.

    It normally consisted of a prepared victim vessel, using a system that had been poorly configured by the provider, or the providers appointed/trained engineer, and accessing the equipment onboard, normally the antenna or satcomm system. It’s a quick way to display to an audience just how much we are ‘displaying publicly’.

    recently someone asked “what could someone actually do?”

    A relevant question we thought, so we tested to see what we could actually do.

    As a basic attack, an intruder could lock out all the users from accessing the equipment. They could turn off the satcom, or prevent systems and users onboard gaining access to the internet or to systems onshore or stop onshore reaching the vessel.

    OK, so this is annoying and disruptive, costing from a few hundreds to several tens or hundreds  of thousands if the charterer deems “off hire” status due to lack of communications.

    Well, that’s quite expensive, potentially.

    But what can we learn from the systems we can get at?

    A lot.

    Given the amount of systems that are exposed to the internet, with poor configuration, it is relatively easy to find a ‘victim’, and to maximise the information gained by using the tools available and exposed by the simplest of mistakes.

    Default admin passwords.

    There is a need for it, but no excuse for it.

     Service Providers, who manage several thousands of vessels, still use engineers who leave default admin usernames and passwords.

     So, it’s a fault on one vessel, but it cant really hurt can it?

    It can. And it does.

     Our target vessel was found.

    That took 7 minutes to locate.

    It belonged to a very large multinational corporation. The default username and password was still in effect on the VSAT system.

    Access was made to the administration area, so all usernames and passwords could be changed. Also available was access to the system by FTP. Even if this had not already been enabled, as we were in the Admin area, we could have enabled it.

     This is where major security flaw #1 was found. The FTP access gave access to the entire operating system of the device, not just the FTP area.

    Major security flaw #2 was putting a text file in every folder with a map of the entire structure of the operating system.

    This allowed for finding and copying the ‘hidden’ password file to our local machine. It was actually encrypted.

     2 hours later, it wasn’t.

    So now we had all the manufacturers usernames and passwords.

     Now we can access the publicly available machines where they have changed the default admin username and password, by using the manufacturers. They have these so the engineers can always get in. Great for business and support, not so for security.

     The network connections listed in the antenna setup were then investigated.

     The VSAT Modem was accessed, again using default connections on SSH, with publicly available usernames and passwords.

    Command line access to the modem was achieved, allowing us to take control and alter the configuration. In effect we could now control the communications in 2 different places.

     Such systemic failures, at the developmental and operational level, are going to have huge issues when Cyber 2021 comes into force next year.

    Class and P&I will be left wondering who to refuse claims and who to sue for negligence when there are events, while the operators are trusting the providers to implement correctly, and the manufacturers and developers are failing at such basic levels, they will likely be left with the legal responsibility in the first instance.

    The lesson of life in todays marine communications environment?

    Don’t trust what’s being given to you.

    Unless you have had your own trusted IT check what’s gone before, why would you blindly trust a stranger with your vessels now?

    The Owner is Liable.

    Yangosat is a maritime communications and solutions provider, helping shipowners and providers realise new systems and invigorate existing ones. This article has been reproduced with the author's permission. 

     

Joomla SEF URLs by Artio

Login/Register

Register or Login to view even more of our content. Basic registration is free.

Register now

Digital Ship magazine provides the latest information about maritime satellite communications technology, software systems, navigation technology, computer networks, data management and TMSA. It is published ten times a year.

 

Address:
Digital Ship Ltd
Digital Ship - Digital Energy Journal
39-41 North Road
London
N7 9DP
United Kingdom

Copyright © 2019 Digital Ship Ltd. All rights reserved           Cookie Policy         Privacy Policy

x