Monitoring Ships Data and activity – Testing network seg 2

Cyber Management Course (Ma) – Module 5

Monitoring Ships Data and activity – Testing network segregation

Some questions may help provide a picture of vessel network segregation

“When was the last time a third party verified the segregation of the various networks on board”

“Which systems on the bridge have access to the OT network?”

“Does an OOW have access to bridge systems from anywhere other than the bridge?”

“Do any computers on the vessel business network have access to OT systems, e.g bay planning, ballast/trim, propulsion etc?”

“What steps have been put in place to ensure that the crew Wi-Fi network can only access the internet or other crew leisure systems?”

/by

Monitoring Ships Data and activity – Network seg on board

Cyber Management Course (Ma) – Module 5

Monitoring Ships Data and activity – Network segregation on board vessels

There are multiple networks on board any large vessel:

  • Business network
  • Crew network and WiFi
  • Bridge systems
  • OT networks, including engine management and propulsion
  • Satellite communications and the internet
  • …among many

/by

Monitoring Ships Data and activity – Benefits of network seg

Cyber Management Course (Ma) – Module 5

Monitoring Ships Data and activity – Benefits of network segmentation

Whilst it can be time consuming to implement, network segmentation brings many benefits.

Users access can be managed on a ‘need to know’ basis: Why would a deckhand need access to a billing system?

Layers of defence are built: an attack breaches one layer, but the remaining layers remain in place.

Incidents are easier to respond to: if someone accidentally opens an email containing malware, VLAN access can quickly be removed, isolating the incident from the rest of the network.

/by

Monitoring Ships Data and activity – Basic steps to create

Cyber Management Course (Ma) – Module 5

Monitoring Ships Data and activity – Basic steps to create

First, one might build a series of Virtual LANS (‘VLANs’), often grouping devices by system function. For example, a VLAN of the workstations and laptops in the finance department, or the business computers on board a vessel.

Then one should consider what systems the computers on that VLAN need to access over the network.

For example, finance workstations would need network access to the servers that run the finance applications. On board a vessel, business computers may need access to an on board email server.

The second step is to work out which network services are needed to support the business function. For example, finance workstations might need to connect to a network port on a finance database server. The key is to use the VLAN to lock down the access between the two sets of devices (workstations and servers) to only allow access. In the case of a Microsoft SQL server database, that network port might be TCP port 1433.

By restricting access to only port 1433, it is much harder for malware and other attacks to spread around the network.

Of course, if the installer of the IT system forgot to change the default database password (as is surprisingly common!) the attacker would have little trouble hacking it.

/by

Monitoring Ships Data and activity – Network segregation 2

Cyber Management Course (Ma) – Module 5

Monitoring Ships Data and activity – Principles of network segregation on board

Traditionally, computer networks were ‘open’ in that any one computer on the network could see any other. That made setting up access very easy, but it also meant that an incident anywhere on the network could quickly spread to all devices on it.

For example, a ransomware outbreak on one device might propagate to all devices. A hack of one system on the network might lead to data theft from all systems.

In the past, IT and OT networks were completely isolated or ‘air gapped’ meaning the only route to compromise was through physical intervention. USB, floppy disc and maintenance laptops were the most common source of infection.

More recently, OT and IT networks have been joined together to make processes more efficient and facilitate the concept of the smart ship.

Network segregation describes the process of giving devices access to only the systems they need. This makes the hackers life somewhat harder and also makes isolating compromised devices much easier.

/by

Monitoring Ships Data and activity – Network segregation 1

Cyber Management Course (Ma) – Module 5

Monitoring Ships Data and activity – Principles of network segregation on board

Segmenting your network is one of the first steps towards making it secure

Image from www.logimatic.com

It is an excellent example of how you can achieve a fully integrated vessel, but still segment compartments and look to add additional security for each section.

/by

Incident, Recovery and Procedures – Discon OT from shore network

Cyber Management Course (Ma) – Module 4

Response to an incident, Recovery and Procedures – Disconnecting OT from shore network connection

Connections between shore and OT systems can be relevant in a wide range of applications like performance monitoring, predictive maintenance, and remote support just to mention a few. Common for these systems are that they are not strictly necessary for operating the ship safely. However, they represent a potential attack vector to the systems that are needed for the ship’s safe operation. Therefore, it is relevant to assess when these connections are allowed and under what circumstances. Plans should be established specifying when such OT systems should be temporarily separated from the shore network connection to protect the ship’s safe operation. Disconnecting will help prevent the attacker from being able to manipulate safety critical systems or take direct control of the system. Disconnecting could also take place to avoid malware spreading between network segments. To effectively shut down shore connections, it is important to have the network and connectivity services designed in such a way that the networks can be physically segregated quickly by removing a single network cable (eg marked in an odd color) or powering off the firewall.

/by

Incident, Recovery and Procedures – Contingency plans

Cyber Management Course (Ma) – Module 4

Response to an incident, Recovery and Procedures – Contingency plans

When developing contingency plans for implementation onboard ships, it is important to understand the significance of any cyber incident and prioritise response actions accordingly.  Any cyber incident should be assessed in accordance with chapter 4 to estimate the impact on operations, assets etc. In most cases, and with the exception of load planning and management systems, a loss of IT systems on board, including a data breach of confidential information, will be a business continuity issue and should not have any impact on the safe operation of the ship. In the event of a cyber incident affecting IT systems only, the priority may be the immediate implementation of an investigation and recovery plan.

The loss of OT systems may have a significant and immediate impact on the safe operation of the ship. Should a cyber incident result in the loss or malfunctioning of OT systems, it will be essential that effective actions are taken to help ensure the immediate safety of the crew, ship, cargo and protection of the marine environment. In general, appropriate contingency plans for cyber incidents, including the loss of critical systems and the need to use alternative modes of operation, should be addressed by the relevant operational and emergency procedures included in the safety management system.

Some of the existing procedures in the ship’s safety management system will already cover such cyber incidents. However, cyber incidents may result in multiple failures causing more systems to shut down at the same time. The contingency planning should take such incidents into consideration.

/by

Incident, Recovery and Procedures – Invest cyber incidents

Cyber Management Course (Ma) – Module 4

Response to an incident, Recovery and Procedures – Investigating cyber incidents

Investigating a cyber incident can provide valuable information about the way in which a vulnerability was exploited. Companies should, wherever possible, investigate cyber incidents affecting IT and OT on board in accordance with company procedures. A detailed investigation may require external expert support.

The information from an investigation can be used to improve the technical and procedural

protection measures on board and ashore. It may also help the wider maritime industry with a better understanding of maritime cyber risks. Any investigation should result in:

  • a better understanding of the potential cyber risks facing the maritime industry both on board and ashore
  • identification of lessons learned, including improvements in training to increase awareness
  • updates to technical and procedural protection measures to prevent a recurrence.

/by

Incident, Recovery and Procedures – Recovery

Cyber Management Course (Ma) – Module 4

Response to an incident, Recovery and Procedures – Recovery

When a cyber incident is complex, for example if IT and/or OT systems cannot be returned to normal operation, it may be necessary to initiate the recovery plan alongside onboard contingency plans.

When this is the case, the response team should be able to provide advice to the ship on:

  • whether IT or OT systems should be shut down or kept running to protect data
  • whether certain ship communication links with the shore should be shut down
  • the appropriate use of any advanced tools provided in pre-installed security software
  • the extent to which the incident has compromised IT or OT systems beyond the capabilities of existing recovery plans.

It is important for relevant personnel to execute regular cyber security exercises in order to help keep the response capability effective. Cyber security exercises could, where appropriate, be inspired by real-life events and can be simulations of large-scale incidents that escalate to become cyber crises. This offers an opportunity to analyse advanced technical cyber security incidents, but also to help address business continuity and crisis management.

/by