Maritime and port cybersecurity.

This article is also available in French.

The new generation of “superyachts” is booming (even if I do not personally own one), and unsurprisingly they are not escaping the broader digital transformation of the maritime sector. With the financial resources typical of the ultra-luxury market, there are effectively very few limits to the technologies installed on board.

High-bandwidth multi-operator satellite connections, GSM and 4G relays (and beyond), Wi-Fi networks, full-coverage onboard video surveillance, highly sophisticated entertainment systems, alarm systems, state-of-the-art bridge and engine systems, and extensive automation: these vessels are not designed solely for leisure. Many owners and charterers effectively relocate part of their business operations to the yacht. In that sense, the yacht should be viewed as an extension of the company itself - yet often a far more vulnerable one. It may lack many of the cybersecurity safeguards present in corporate environments, and the specific constraints of the maritime environment are sometimes poorly understood by corporate CISOs.

This article is also available in French.

Following several questions from readers, for those who still rely on RSS and want to stay informed about (hopefully unbiased, and vendor-neutral) maritime cybersecurity news, you can follow the site’s updates through the following RSS feed:

https://maritimeinfosec.org/index.xml

I am also present on social networks (LinkedIn, Mastodon, Bluesky).

Enjoy the reading, and thank you for your interest and continued support.

Olivier

This article is also available in French.

Update of March 19, 2018.

The BBC reports that Russia is suspected of having jammed the global GPS positioning system during a major NATO exercise called Trident Juncture. This is not particularly surprising, as it is a known Russian capability and has already been suspected of being used on several occasions. The area affected would have included Lapland and territories close to the Russian border in northern Norway.

This article is also available in French.

The South Korean manufacturer Hyundai Heavy Industries has announced that it obtained a cybersecurity certification from the American Bureau of Shipping (ABS) for a Very Large Crude Carrier (VLCC) scheduled to be delivered to a European client in November 2018 (possibly the Greek company Okeanis?).

There are few details available, but the certification reportedly reflects work carried out on the security of the vessel’s industrial control systems.

This article is also available in French.

I suggest reading this short article, which reports on a partnership between KPMG, the audit and consulting firm, and the Norwegian manufacturer Kongsberg, which designs systems for the oil and gas industries as well as the maritime sector.

There are not many details available, but it is nonetheless interesting to see manufacturers finally paying closer attention to the cybersecurity of their systems and turning to external audit and consulting firms for support. Let us hope they will find at least part of the solution there - bearing in mind that the problem, as always, is far from simple.

This article is also available in French.

I recommend reading this article from The Register about the challenges of updating systems aboard Royal Navy vessels (and the 129 comments that follow it…).

The article reveals that the Royal Navy is still using obsolete versions of Windows, namely Windows ME and Windows XP. How did they find out? Quite simply: the journalist… asked the question while embarked aboard HMS Enterprise.