Incident, Recovery and Procedures – Action Plan steps

Cyber Management Course (Ma) – Module 4

Response to an incident, Recovery and Procedures – Action Plan steps

  1. Initial assessment. To help ensure an appropriate response, the response team should find out:
    •  how the incident occurred
    • which IT and/or OT systems were affected and how
    • the extent to which the commercial and/or operational data is affected
    • to what extent any threat to IT and OT remains.
  1. Recover systems and data. Following an initial assessment of the cyber incident, IT and OT systems and data should be cleaned, recovered and restored, so far as is possible, to an operational condition by removing threats from the system and restoring software.
  1. Investigate the incident. To understand the causes and consequences of a cyber incident, an investigation should be undertaken by the company, with support from an external expert, if appropriate. The information from an investigation will play a significant role in preventing a potential recurrence. Investigations into cyber incidents are covered in section 7.3.
  1. Prevent a re-occurrence. Considering the outcome of the investigation mentioned above, actions to address any inadequacies in technical and/or procedural protection measures should be considered, in accordance with the company procedures for implementation of corrective action.

/by

Incident, Recovery and Procedures – Effective response 2

Cyber Management Course (Ma) – Module 4

Response to an incident, Recovery and Procedures – Effective response

The Solution and Recommendation is to create an Incident Response Plan.

Borwell`s recommendation is to prepare an outline Incident Response Plan.  This should contain phone numbers of Directors, Managers, key staff, IT experts, IT suppliers, and a list of online services and where passwords are managed for these services.

/by

Incident, Recovery and Procedures – Effective response 1

Cyber Management Course (Ma) – Module 4

Response to an incident, Recovery and Procedures – Effective response

A team, which may include a combination of onboard and shore-based personnel and/or external experts, should be established to take the appropriate action to restore the IT and/or OT systems so that the ship can resume normal operations. The team should be capable of performing all aspects of the response.

Above Images and Below example from Borwell Secure Software Experts (www.borwell.com)

You or one of your colleagues notice strange emails that suggest passwords have been reset for Google, Ebay, LinkedIn and several other websites including banks too.  You then realise that these are for accounts related to your business.  Talking to colleagues, you eventually work out that these password resets are not from internal staff.  Someone has compromised an email account and has used it to force password changes to online services. Someone now has access to your business services and data.  A cyber attack is taking place.

What if this happened in your business today, or tonight?  If you had an IT security breach, how would you react?  How would you feel as the business owner?  What would you do?

When an incident has been confirmed like the scenario above, is the business able to put into effect a robust set of measures?

/by

Incident, Recovery and Procedures – Response

Cyber Management Course (Ma) – Module 4

Response to an incident, Recovery and Procedures – Response

It is important to understand that cyber incidents may not disappear by themselves. If for example, the ECDIS has been infected with malware, starting up the back-up ECDIS may cause another cyber incident. It is, therefore, recommended to plan how to carry out the cleaning and restoring of infected systems.

Knowledge about previous identified cyber incidents should be used to improve the response plans of all ships in the company’s fleet and an information strategy for such incidents may be considered.

/by

Incident, Recovery and Procedures – Introduction

Cyber Management Course (Ma) – Module 4

Response to an incident, Recovery and Procedures – Introduction

Managing an incident well can make the difference between an annoying distraction and a disaster.

Basics of Incident Response (IR):

  • isolate, don’t power off
  • Creating an IR playbook and response plan
  • Basic hack detection skills for crew

If you think you’ve been hacked or being hacked:

  • Shutdown the system
  • Or turn off the system
  • Separate the system from network
  • Restore the system with the backup
  • Or reinstall all programs
  • Connect the system to the network

It would be prudent to call the police even if you do not know who or how bad it was.  Gather evidence, and don’t assume it has gone.  Many of the case studies we look at in this book, shows hacks were left dormant for many months if not a year prior to the incident.

/by

SMS Cyber Management – Safety Management System 2

Cyber Management Course (Ma) – Module 3

SMS Cyber Management – Safety Management System

Furthermore, it is important to help ensure that a loss of equipment or reliable information due to a cyber incident does not make existing emergency plans and procedures ineffective. Contingency plans and related information should be available in a non-electronic form as some types of cyber incidents can include the deletion of data and shutdown of communication links. There may be occasions when responding to a cyber incident may be beyond the competencies on board or at head office due to the complexity or severity of such incidents. In these cases, external expert assistance may be required (for example, post event forensic analysis and clean-up).

Remember Module 9 of your Operator course (Op), where AI monitors AI….

/by

SMS Cyber Management – Safety Management System 1

Cyber Management Course (Ma) – Module 3

SMS Cyber Management – Safety Management System

The safety management system will already include procedures for reporting accidents or hazardous situations and define levels of communication and authority for decision making. Where appropriate, such procedures should be amended to reflect communication and authority in the event of a cyber incident.

The following is a non-exhaustive list of cyber incidents, which should be addressed in contingency plans on board:

  • loss of availability of electronic navigational equipment or loss of integrity of navigation related data
  • loss of availability or integrity of external data sources, including but not limited to GNSS
  • loss of essential connectivity with the shore, including but not limited to the availability of Global Maritime Distress and Safety System (GMDSS) communications
  • loss of availability of industrial control systems, including propulsion, auxiliary systems and other critical systems, as well as loss of integrity of data management and control

/by

Clause 380 Maritime Cyber Insurance – P&I Cyber UK Club 3

Cyber Management Course (Ma) – Module 2

Clause 380 Maritime Cyber Insurance – P&I Cyber Insurance example UK P&I

The Notice goes onto state:

“P&I War Risks (including terrorist risks)

 

P&I cover is subject to an exclusion in respect of P&I liabilities, costs or expenses arising from war risks as defined in UK Club’s Rule 5E, including acts of terrorism.  The exclusion applies irrespective of any contributory negligence on the part of the Owner or his servants or agents.  A key part of the definition refers to P&I losses caused, or contributed to, by “War, civil war, revolution, rebellion, insurrection or civil strife arising therefrom, or any hostile act by or against a belligerent power, or any act of terrorism”

 

Depending on motive, a cyber-attack could constitute an “act of terrorism” or even in warlike circumstances a “hostile act by a belligerent power”

 

Terrorist acts are generally regarded as those aiming to kill, maim or destroy indiscriminately for a political, religious or ideological cause.  The Club’s Directors have power under the Rules to determine whether a particular event constitutes an act of terrorism for the purpose of applying the exclusion

A cyber-attack on an individual ship is, however, likely to be regarded as a hostile act of a belligerent power only in the context of civil war or where a rebellion extends to the occupation of territory and organised political authority over military forces

A cyber-attack on an individual ship could arise for a variety of reasons that do not engage the war exclusion – including, for example, commercial sabotage, or the malicious act of an individual with a grudge against the owning company – and in any such cases a Member’s normal P&I cover will respond (subject to the remainder of the Rules)”

When we reflect back on `Water holing` from the Operators course (Op), we must consider the motive and effort placed in modern cyber crime.  Does this level of motivation or motive constitute at an act of terrorism.

It is vital that Owners and Operators and content with their level of cover, and more importantly, now understand the education level required for their Operators to try and stop an attack in the first place.

/by

Clause 380 Maritime Cyber Insurance – P&I Cyber UK Club 2

Cyber Management Course (Ma) – Module 2

Clause 380 Maritime Cyber Insurance – P&I Cyber Insurance example UK P&I

It is important for Management to understand if they are covered for Operation loss and/or loss through the many opportunities covered in the Op course in depth, namely:

  • Micro-sandboxing
  • Microsoft Office macros
  • Spyware
  • Spoofing
    Phishing
  • Spear Phishing
  • Phishing scams
  • Example of a Scam
  • CEO fraud (Captain/Master/Operator or Owner)
  • Email attachments
  • Pop Up Ads
  • Water holing
  • Harmful Software
  • Malware
  • Trojan
  • Worms
  • Crimeware
  • Adware
  • Bots
  • DDOS

/by

Clause 380 Maritime Cyber Insurance – P&I Cyber UK Club 1

Cyber Management Course (Ma) – Module 2

Clause 380 Maritime Cyber Insurance – P&I Cyber Insurance example UK P&I

In March 2018 the UK P&I Club released a Q&A bulletin called “Cyber risks and P&I insurance”

“Are cyber risks excluded from P&I cover?

No.  As a general rule, P&I liabilities which are set out in Rule 2 of the UK Club Rules are not subject to any exclusion of cyber risks.  Nor is the International Group Pooling Agreement subject to a cyber risk exclusion.  Some maritime cyber risks, however, don’t come within the scope of P&I because they don’t arise from the operation of a ship.  An example is the risk of monetary loss where a shipping company is blackmailed to pay a ransom for the restoration of IT data or restoration of IT systems that have been compromised by cyber-attack.”

/by