Cyber ​​attacks at sea: how to protect maritime systems

*By Luiz Soria, CEO of Skymarine
The digitalization of the maritime industry has brought significant advances in efficiency and operations, but it has also opened new doors to cyber threats. Connected maritime systems, ranging from navigation to cargo management and communications, are increasingly vulnerable to attacks. This scenario raises the question: how can we protect these systems against growing threats?

The challenges are many. The first major concern is the vast attack surface. Modern ships, ports and related infrastructure are all interconnected through complex networks. Each connected device represents a potential point of vulnerability that cybercriminals can exploit.

Navigation systems, cargo control, communications and even onboard entertainment are all potential targets. The complexity and interdependence of these systems make protecting each point mission critical.

Additionally, the maritime industry often operates with legacy technologies that are often not designed with cybersecurity in mind. Upgrading or replacing these systems can be expensive and logistically challenging, especially when it involves globally dispersed fleets. This leaves many systems vulnerable to attacks that exploit known weaknesses.

Another significant challenge is the lack of cybersecurity awareness and training among maritime industry professionals. Crews and shore personnel may not be familiar with cybersecurity best practices, making them easy targets for social engineering attacks such as phishing.

Examples around the world

One of the most notorious cyberattacks against the shipping industry was the NotPetya ransomware attack, which affected container shipping giant Maersk in 2017. This attack crippled the company’s IT systems across the globe, resulting in a massive disruption to operations.

NotPetya spread rapidly across Maersk’s networks, infecting around 4,000 servers, 45,000 PCs and 2,500 applications. The company estimated the financial impact of the attack to be around $300 million. The incident highlighted the vulnerability of global supply chains and the urgent need to improve cyber defenses in the maritime industry.

Another case was in 2018. Cosco Shipping, one of the world’s largest container shipping operators, suffered a ransomware attack that affected its operations in the United States. The attack resulted in the disruption of several operational activities, including email and communication systems. The company was forced to disconnect its regional networks to contain the spread of the ransomware.

Although Cosco was able to restore its operations after a few days, the attack highlighted the vulnerability of IT networks in the maritime industry and the need for robust incident response protocols.

So what are the solutions to these challenges?

The first line of defense is to implement a layered approach to cybersecurity. This includes using robust firewalls, intrusion detection systems, and advanced encryption to protect sensitive data. Network segmentation can help limit the spread of an attack by isolating critical systems from less important ones.

Ongoing system maintenance and updates are equally important. While replacing legacy technologies can be challenging, regular application of security patches and software updates are essential to protect against known vulnerabilities. Investing in modern, more secure technologies is a crucial step toward mitigating long-term risks.

Read more:

Cybersecurity awareness and training should also not be overlooked. Regular training programs for crews and ground personnel should be implemented to ensure everyone is aware of cyber risks and knows how to respond to incidents. Simulated attacks and response exercises can help prepare personnel to deal with real-world situations.

Furthermore, collaboration is key. The maritime industry must work together with governments, cybersecurity organizations and other stakeholders to share threat intelligence and develop effective defense strategies.

The creation of specific international standards and regulations for maritime cybersecurity can help unify efforts and ensure a basic level of protection across the industry. Only through these combined efforts can we ensure the security and resilience of the maritime industry in an increasingly digitalized world.