Good cyber hygiene and training – AI monitoring AI for cyber

Cyber Operators Course (Op) – Module 9

Good cyber hygiene and training – AI monitoring AI for cyber

To paraphrase Arthur Schopenhauer, experts in their field will often attack those who question their expertise. One doesn’t need to be an expert navigator or ships officer in order to find issues in shipping systems.

Change has been fast on board vessels; digitalisation has come faster than many may have expected.

Talk of autonomous shipping no doubt concerns many mariners – will they be replaced by computers?  It is those experienced seafarers that have the best chance of spotting security issues when at sea.  Will the computer know the other computer has been hacked?

Can you list the IT or OT onboard that is monitored for safety by IT…?  Does that create a list for a higher risk assessment or lower?

/by

Good cyber hygiene and training – Redundancy of systems

Cyber Operators Course (Op) – Module 9

Good cyber hygiene and training – Redundancy of systems

Does a dual system create redundancy?  As an example, most vessels will have two ECDIS, or electronic chart systems, for redundancy. Few vessels now carry backup paper charts other than basic ‘get you home’ versions, as they are expensive and hard to keep updated. A colleague remembers collecting chart updates from the ships agent at each port, which he had to cut out and paste on to the chart.

Having two redundant systems sounds like a good idea. However, most of the ECDIS units we’ve tested have been running old operating systems or were missing critical patches and were trivial to compromise. Two easily hacked ECDIS units on board. Great!

Both ECDIS are often updated at the same time, removing the benefit of redundancy. This often has to be done, as otherwise there would be inconsistencies in the charts on each ECDIS.

What systems onboard are dual for redundancy, can we list them, and if they are updated at the same time?

/by

Good cyber hygiene and training – How far could a hack go? 3

Cyber Operators Course (Op) – Module 9

Good cyber hygiene and training – How far could a hack go?

Further, any number of minor incidents or technical dependencies can leave a vessel dead in the water. A colleague remembers a simple overlooked microswitch leading to start air not recharging and the vessel quickly becoming immobile.

Those serial control devices are usually connected to serial networks, hacking of which is not difficult. Similar problems have been known about for years in utilities industrial control systems (ICS). The same serial to IP converters that we’ve compromised in utilities are used on vessels. Compromise any point on the serial network and that ‘manual control’ may not work in the way intended any more

Better to ensure all crew are prepared as you see it can get much worse….You must speak up if there are crew that don’t believe the ship can be effected.

/by

Good cyber hygiene and training – How far could a hack go? 2

Cyber Operators Course (Op) – Module 9

Good cyber hygiene and training – How far could a hack go?

Manual control of a ships engine usually involves three sticks: one for the fuel pump, one for start air and one for engine direction. Fuel pump rate does not directly correlate with engine speed – there are many variables that affect this, even air humidity will change how the engine performs for a given lever setting.

Shifting the engine to stop or reverse involves using start air to restart each time. Air tanks usually contain enough air for 10 starts under automatic control, requiring 45 minutes or so to recharge. Under manual control, even a skilled operator will probably only get 5 engine starts. That’s 45 minutes and potentially 5 changes of propeller direction.

Imagine a junior officer trying to deal with failing navigation systems, all bridge sensors offline, steering gear not responding and engine levers inoperative. Manual control is an option but, as an aviation pilot, I know very well how quickly one can become overloaded with information and become incapable of dealing with a situation. Fixation on a single error quickly leads to loss of the wider picture.

/by

Good cyber hygiene and training – How far could a hack go? 1

Cyber Operators Course (Op) – Module 9

Good cyber hygiene and training – How far could a hack go?

As an example, you have lost track control so you need to revert to manual control?  Vessels are required to practice manual steering control. It’s one of the very last systems on board that has a genuine manual control, but it is still time consuming to operate manually. Steering instructions are by VHF or telephone from bridge to steering room; this all ties up busy engineering resource that is likely to be required elsewhere on the vessel whilst arriving in port. It is a pain and lends itself to incidents. We have ships engineers on our team who have been there during manual control exercises.

There is also potential to interfere prior to manual control being implemented. Steering control from the bridge can be either automatic (e.g. ECDIS in track control mode), heading – where the rudder maintains a heading, or manual bridge control. Full manual control involves disconnecting the telemotor and moving a lever in the steering room that physically moves valves to control hydraulic rams that operate the rudder. Manual engine control can be challenging, particularly when manoeuvring:

Control is usually direct from the bridge – the engine control levers directly control the engine control systems. These communicate using serial data networks that can be manipulated.

Control can also be managed from the engine control room, through programmable logic controllers (PLCs) and human-machine interfaces (HMIs). Again, these contain serial data communications that can be tampered with.

/by

Good cyber hygiene and training – Knowing you’ve been hacked

Cyber Operators Course (Op) – Module 9

Good cyber hygiene and training – Knowing you’ve been hacked

A Ponemon data breach report in 2017 showed that it took US organisations an average of 206 days to detect a data breach. That’s a statistic from shore-based organisations, where IT and IT security personnel and expertise are usually available.

So how does a ships crew, where perhaps one person on the crew has a small amount of basic IT skill, detect a breach of a vessel?

If you don’t know, you can’t take action. At what point do you decide that the navigation systems are no longer trustworthy? Who makes that decision? The inexperienced third officer? Do they wake the captain?

Who decides to take the vessel out of track control mode? Remember, security isn’t binary – something is a bit odd, but all the digital systems seem to agree with each other. A security incident doesn’t have to involve alarming ransomware taking control of cargo manangment, it can be much more subtle than that.

Even with years of forensics experience, sometimes investigators struggle to determine the cause of an incident. I remember one case where a human hair in a switch port was causing public IP addresses to be spoofed on the internal network. We didn’t believe it either, until we removed the hair and replaced it several times, at which point the spoofing stopped and started consistently!

So you take action, you assess the incident and decide you need help. You pick up the satphone to HQ. The satphone isn’t working as it uses the same, vulnerable satellite terminal that the hacker exploited. What next?

/by

Good cyber hygiene and training – Attitude towards Cyber 2

Cyber Operators Course (Op) – Module 9

Good cyber hygiene and training – Attitude towards Cyber

So why don’t some ships Officers believe that hacking is possible?

They’ve spent years training and working up the ships hierarchy, gaining significant expertise. They are experts in their field and have doubtless dealt with some very difficult situations at sea. They have precise navigation skills, yet only in the last few years have digital controls and navigation systems entered shipping.

It’s not unreasonable for a Captain to assume that, if digital systems started failing, they could fall back to paper charts on the bridge, or manual use of Fixed Firefighting equipment, or `hand pump` on the steering motors.  The problem is hacking doesn’t work like that.

It may not simply `fail` it may be manipulated or give no indication of failure.

Do all your fellow crew understand the reality of this, do you need to report higher if not?

/by

Good cyber hygiene and training – Attitude towards Cyber 1

Cyber Operators Course (Op) – Module 9

Good cyber hygiene and training – Attitude towards Cyber

The usual response is ‘ships can’t be hacked.’ When I dig further, what they usually seem to mean is that ‘processes aboard the bridge mean that the captain or officers will spot the issue and take manual control’

We see the same pattern when security flaws are discovered in an industry for the first time. Back the early 2000’s, few industries outside financial services and government took security seriously. ‘Why would hackers be interested in us’ was the usual objection.

Over time, as financial services and governments improved their security, other industries became easier targets for hackers looking to monetise their gains. I remember charities objecting ‘We’re a charity working for good causes, why would hackers attack us’ – yet soon they were being used for validating stolen credit card data through small test charges.

Hackers will come to every industry, starting with those with the weakest security. Why develop hugely costly nation-state grade malware to hack a bank when you can exploit Windows XP systems in shipping and generate similar returns?

/by

Good cyber hygiene and training – Detecting a hacking incident

Cyber Operators Course (Op) – Module 9

Good cyber hygiene and training – Detecting a hacking incident

Interview the officers and the engineer. Ask them how they would detect a hack. A lack of understanding of what a hack actually is will make it very difficult for crew to detect a real incident.

Owing to Hollywood glamorisation of hacking attacks, there is a perception by many that a hack will be a visual incident. Movie directors need to have something for the audience to ‘see’ on screen. If you ask an experienced captain what a hack ‘looks like’ they will probably talk about systems going offline or alarming ‘ransom’ images popping up on digital systems.

This could not be farther from the truth.

/by

Secure USB ports on all ships systems – Malware on phones

Cyber Operators Course (Op) – Module 8

Secure USB ports on all ships systems – Malware on phones being passed to ship’s systems

It’s very easy to accidentally get malware on USB keys. We’ve already seen cases of both Deck and Engineering systems compromised by ransomware. How often do you see a phone charging from a USB port on a bridge console? Phones can be full of malware too.

To prevent accidental introduction of malware to vessel systems, lock down USB access. If critical systems can only be updated by USB, keep dedicated USB keys in a secure location that are used for nothing other this purpose. This isn’t ideal, but is better than open USB access!

/by