Maritime and port cybersecurity.

This article is also available in French.

According to The Maritime Executive, the Port of Kennewick, in Washington State, was hit by a ransomware cyberattack on November 17. A ransom of $200,000 was demanded in exchange for restoring access to the port’s data [ 1].

Although smaller than the major ports on the U.S. West and East Coasts, this inland port on the Columbia River now joins the list of many ports already affected by this type of attack. If further evidence were needed, the incident once again highlights that cybersecurity risks must also be taken seriously in the inland waterways sector.

This article is also available in French.

Carnival, the world’s largest cruise operator (102 vessels and roughly 50% of the global cruise market, representing around 225,000 passengers on board every day), announced that it had been the victim of a ransomware cyberattack on August 15, 2020 (1 2). Two ships belonging to the group had already been affected by a cyberattack in May 2019.

The attack, detected by the company, resulted in unauthorized access to part of the group’s information systems, with some systems subsequently encrypted. The intrusion also led to the download of certain data files, although the company did not specify the type of information involved.

This article is also available in French.

According to the English-language website Vanguard, operational technology (OT) systems in the maritime sector have experienced an increase in cyberattacks of around 900% over the past three years. As a reminder, “OT” refers to Operational Technology, meaning, according to the NIST definition, the set of constrained information systems used in industrial and operational environments (industrial control systems, operational applications), as opposed to IT, which refers to more traditional information systems such as corporate networks or intranet services.

This article is also available in French.

We have already discussed autonomous maritime vehicles in several previous articles, notably in the context of the first trials of autonomous ferries in Finland, in an article about the future of maritime information systems, and when reviewing some of the emerging regulatory references on the subject.

In the maritime domain, different categories of autonomous systems exist or are expected to emerge, including UAVs (Unmanned Aerial Vehicles), USVs (Unmanned Surface Vehicles), and UUVs (Unmanned Underwater Vehicles).

This article is also available in French.

In February 2020, the United States created the Maritime Transportation System Information Sharing and Analysis Center (MTS-ISAC), whose website has since been launched. The MTS-ISAC was established by a group of U.S. maritime stakeholders as a non-profit association (501(c)(6), broadly comparable to a French non-profit association) with the goal of promoting cybersecurity information sharing across the maritime community.

A growing awareness within the maritime sector

This article is also available in French.

By now, after reading the various articles on this site, you have probably understood that maritime information systems contain vulnerabilities. The real challenge is that the future of maritime information systems is being built while many of these vulnerabilities remain unresolved. It is a bit like adding extra floors to a house while the concrete of the ground floor has not yet fully set. In short, it is risky. Ships being built today are still insufficiently secured, yet they are designed to remain in service until around 2060.