U.S. National Cybersecurity Plan to Safeguard Maritime Sector

The U.S Government released on January 5, 2021, a cybersecurity plan to secure the nation’s maritime sector against cybersecurity threats that could endanger national security.

The Maritime Cyber Environment

With International Maritime Organization’s (IMO) mandate “to ensure that cyber risks are appropriately addressed in existing safety management systems” and the increasing number of cyber-attacks against maritime and shipping organizations, cybersecurity of maritime and shipping organizations is a top priority. In fact, cyber-attacks on the maritime industry’s operational technology (OT) systems are reported to have increased by 900% over the last three years.

The maritime and shipping sector plays a vital role in national and global economy; 90% of global trade is being carried by shipping, while in the U.S. it contributes about $5.4 trillion to the national gross domestic product. Hence, cyber-attacks against critical national infrastructure such as the maritime industry can have crippling effects on the national economy.

The maritime organizations are increasingly depending on IT and OT to maximize the reliability and efficiency of maritime commerce. These cyber-enabled systems assist vessel navigation, communications, onboard engineering management, cargo management, safety, physical security, and environmental control. However, the proliferation of internet-facing systems across the maritime sector is introducing unknown risks and expanding the threat surface. The 2017 NotPetya cyber-attack was a warning call of the disastrous effects, which crippled the global maritime industry for more than a few days.

The Plan’s Objectives

According to the statement from National Security Advisor Robert C. O’Brien “[t]he National Maritime Cybersecurity Plan unifies maritime cybersecurity resources, stakeholders, and initiatives to aggressively mitigate current and near-term maritime cyberspace threats and vulnerabilities while complementing the National Strategy for Maritime Security. The Plan identifies government priority actions to close maritime cybersecurity gaps and vulnerabilities over the next five years.”

The Maritime Cybersecurity Plan would help the federal government to “buy down the potential catastrophic risks to our national security and economic prosperity” inherited by the dependence of the maritime sector organizations on emerging technologies, said O’Brien. To achieve this goal, the Plan defines three objectives:

• Risks and Standards
• Information and Intelligence Sharing
• Create a Maritime Cybersecurity Workforce

Prioritized Action List

The Plan includes a prioritized list of actions to help government and private actors meet the above objectives. The National Security Council (NSC) will oversee the completion of these priorities and will reassess the plan at least once every five years.

Risks and Standards

The U.S. Government recognizes that although cybersecurity standards and frameworks are widely available, maritime and shipping businesses often lack the resources or expertise to implement them effectively, leaving them open to vulnerabilities which can be exploited to disrupt operations. To mitigate these risks, the following actions are foreseen:

• Identify gaps in legal authorities and de-conflict government roles and responsibilities for the implementation of maritime cybersecurity standards.
• The US Coast Guard will analyze cybersecurity reporting guidance between 2016 and 2020 to identify trends and attack vectors. The analysis will increase maritime sector situational awareness and decrease maritime cyber risk.
• Develop and implement mandatory contractual cybersecurity requirements for maritime critical infrastructure owned, leased, or regulated by the Government to decrease cybersecurity risk because of supply chain attacks.
• Develop procedures to identify, prioritize, mitigate, and investigate cybersecurity risks in critical onboard and shore-based systems.

Information and Intelligence Sharing

Information sharing across public, private, and international maritime stakeholders that relies on transparency and existing partnerships, is the key to bolster maritime cybersecurity resilience. To promote information sharing, the Plan dictates the implementation of the following actions:

• Promote domestic and international engagement to facilitate information sharing and best practices to build a coalition of maritime cybersecurity advocates.
• Share maritime cybersecurity information and intelligence with the international community.
• Develop and prioritize maritime intelligence requirements to guide risk modeling and adversary cyber risk assessments.

Create a Maritime Cybersecurity Workforce

Cybersecurity is a highly technical field requiring competent cybersecurity specialists to monitor and protect IT and OT systems and assets. However, the skills gap is a significant barrier to effective cybersecurity posture. To close this gap, the Plan proposes the following:

• Develop cybersecurity career paths, incentives, continuing education requirements, and retention incentives to build a competent maritime cyber workforce.
• Collaborate with the private sector to increase maritime cybersecurity expertise.
• Field cyber protection teams to support the strengthening of the federal maritime security resilience.

Concluding Thoughts

“The adoption of standards and best practices in the maritime industry in accordance with the IMO guidelines is only the first step” comments Notis Iliopoulos, Director GRC & Assurance at ADACOM. “The National Maritime Cybersecurity Plan takes it a step further, making a country specific mandate for the maritime sector. To my opinion, an effective implementation of the Plan demands a holistic approach for security risk management,” Iliopoulos adds.

The increased dependence of the maritime sector on cyber-enabled systems has implications on both the digital and the physical domains and demands a whole new approach to mitigate the emerging risks. “The convergence of digital and physical security and safety, in terms of processes, technology and roles, needs to become the new era in security risk management not only for the maritime sector,” notes Iliopoulos. “I’m happy to see that the Maritime sector actually demands the implementation of it. We might lack a holistic Security Risk Management framework, but the requirement for ‘information and intelligence sharing’ will make it happen,” concludes Iliopoulos.

As the US Coast Guard noted in a security warning back in 2019, “maintaining effective cybersecurity is not just an IT issue but is rather a fundamental operational imperative in the 21st century maritime environment.”

Editor’s Note: The opinions expressed in this guest author article are solely those of the contributor, and do not necessarily reflect those of Tripwire, Inc.