Monitoring Ships Data and activity – Benefits of network seg

Cyber Management Course (Ma) – Module 5

Monitoring Ships Data and activity – Benefits of network segmentation

Whilst it can be time consuming to implement, network segmentation brings many benefits.

Users access can be managed on a ‘need to know’ basis: Why would a deckhand need access to a billing system?

Layers of defence are built: an attack breaches one layer, but the remaining layers remain in place.

Incidents are easier to respond to: if someone accidentally opens an email containing malware, VLAN access can quickly be removed, isolating the incident from the rest of the network.

/by

Monitoring Ships Data and activity – Network segregation 2

Cyber Management Course (Ma) – Module 5

Monitoring Ships Data and activity – Principles of network segregation on board

Traditionally, computer networks were ‘open’ in that any one computer on the network could see any other. That made setting up access very easy, but it also meant that an incident anywhere on the network could quickly spread to all devices on it.

For example, a ransomware outbreak on one device might propagate to all devices. A hack of one system on the network might lead to data theft from all systems.

In the past, IT and OT networks were completely isolated or ‘air gapped’ meaning the only route to compromise was through physical intervention. USB, floppy disc and maintenance laptops were the most common source of infection.

More recently, OT and IT networks have been joined together to make processes more efficient and facilitate the concept of the smart ship.

Network segregation describes the process of giving devices access to only the systems they need. This makes the hackers life somewhat harder and also makes isolating compromised devices much easier.

/by

Monitoring Ships Data and activity – Network segregation 1

Cyber Management Course (Ma) – Module 5

Monitoring Ships Data and activity – Principles of network segregation on board

Segmenting your network is one of the first steps towards making it secure

Image from www.logimatic.com

It is an excellent example of how you can achieve a fully integrated vessel, but still segment compartments and look to add additional security for each section.

/by

Incident, Recovery and Procedures – Discon OT from shore network

Cyber Management Course (Ma) – Module 4

Response to an incident, Recovery and Procedures – Disconnecting OT from shore network connection

Connections between shore and OT systems can be relevant in a wide range of applications like performance monitoring, predictive maintenance, and remote support just to mention a few. Common for these systems are that they are not strictly necessary for operating the ship safely. However, they represent a potential attack vector to the systems that are needed for the ship’s safe operation. Therefore, it is relevant to assess when these connections are allowed and under what circumstances. Plans should be established specifying when such OT systems should be temporarily separated from the shore network connection to protect the ship’s safe operation. Disconnecting will help prevent the attacker from being able to manipulate safety critical systems or take direct control of the system. Disconnecting could also take place to avoid malware spreading between network segments. To effectively shut down shore connections, it is important to have the network and connectivity services designed in such a way that the networks can be physically segregated quickly by removing a single network cable (eg marked in an odd color) or powering off the firewall.

/by

Incident, Recovery and Procedures – Effective response 1

Cyber Management Course (Ma) – Module 4

Response to an incident, Recovery and Procedures – Effective response

A team, which may include a combination of onboard and shore-based personnel and/or external experts, should be established to take the appropriate action to restore the IT and/or OT systems so that the ship can resume normal operations. The team should be capable of performing all aspects of the response.

Above Images and Below example from Borwell Secure Software Experts (www.borwell.com)

You or one of your colleagues notice strange emails that suggest passwords have been reset for Google, Ebay, LinkedIn and several other websites including banks too.  You then realise that these are for accounts related to your business.  Talking to colleagues, you eventually work out that these password resets are not from internal staff.  Someone has compromised an email account and has used it to force password changes to online services. Someone now has access to your business services and data.  A cyber attack is taking place.

What if this happened in your business today, or tonight?  If you had an IT security breach, how would you react?  How would you feel as the business owner?  What would you do?

When an incident has been confirmed like the scenario above, is the business able to put into effect a robust set of measures?

/by

Incident, Recovery and Procedures – Effective response 2

Cyber Management Course (Ma) – Module 4

Response to an incident, Recovery and Procedures – Effective response

The Solution and Recommendation is to create an Incident Response Plan.

Borwell`s recommendation is to prepare an outline Incident Response Plan.  This should contain phone numbers of Directors, Managers, key staff, IT experts, IT suppliers, and a list of online services and where passwords are managed for these services.

/by

Incident, Recovery and Procedures – Action Plan steps

Cyber Management Course (Ma) – Module 4

Response to an incident, Recovery and Procedures – Action Plan steps

  1. Initial assessment. To help ensure an appropriate response, the response team should find out:

 how the incident occurred

which IT and/or OT systems were affected and how

the extent to which the commercial and/or operational data is affected

to what extent any threat to IT and OT remains.

  1. Recover systems and data. Following an initial assessment of the cyber incident, IT and OT systems and data should be cleaned, recovered and restored, so far as is possible, to an operational condition by removing threats from the system and restoring software.
  1. Investigate the incident. To understand the causes and consequences of a cyber incident, an investigation should be undertaken by the company, with support from an external expert, if appropriate. The information from an investigation will play a significant role in preventing a potential recurrence. Investigations into cyber incidents are covered in section 7.3.
  1. Prevent a re-occurrence. Considering the outcome of the investigation mentioned above, actions to address any inadequacies in technical and/or procedural protection measures should be considered, in accordance with the company procedures for implementation of corrective action.

/by

Incident, Recovery and Procedures – Invest cyber incidents

Cyber Management Course (Ma) – Module 4

Response to an incident, Recovery and Procedures – Investigating cyber incidents

Investigating a cyber incident can provide valuable information about the way in which a vulnerability was exploited. Companies should, wherever possible, investigate cyber incidents affecting IT and OT on board in accordance with company procedures. A detailed investigation may require external expert support.

The information from an investigation can be used to improve the technical and procedural

protection measures on board and ashore. It may also help the wider maritime industry with a better understanding of maritime cyber risks. Any investigation should result in:

a better understanding of the potential cyber risks facing the maritime industry both on board and ashore

identification of lessons learned, including improvements in training to increase awareness

updates to technical and procedural protection measures to prevent a recurrence.

/by

Incident, Recovery and Procedures – Recovery

Cyber Management Course (Ma) – Module 4

Response to an incident, Recovery and Procedures – Recovery

When a cyber incident is complex, for example if IT and/or OT systems cannot be returned to normal operation, it may be necessary to initiate the recovery plan alongside onboard contingency plans.

When this is the case, the response team should be able to provide advice to the ship on:

whether IT or OT systems should be shut down or kept running to protect data

whether certain ship communication links with the shore should be shut down

the appropriate use of any advanced tools provided in pre-installed security software

the extent to which the incident has compromised IT or OT systems beyond the capabilities of existing recovery plans.

It is important for relevant personnel to execute regular cyber security exercises in order to help keep the response capability effective. Cyber security exercises could, where appropriate, be inspired by real-life events and can be simulations of large-scale incidents that escalate to become cyber crises. This offers an opportunity to analyse advanced technical cyber security incidents, but also to help address business continuity and crisis management.

/by

Incident, Recovery and Procedures – Contingency plans

Cyber Management Course (Ma) – Module 4

Response to an incident, Recovery and Procedures – Contingency plans

When developing contingency plans for implementation onboard ships, it is important to understand the significance of any cyber incident and prioritise response actions accordingly.  Any cyber incident should be assessed in accordance with chapter 4 to estimate the impact on operations, assets etc. In most cases, and with the exception of load planning and management systems, a loss of IT systems on board, including a data breach of confidential information, will be a business continuity issue and should not have any impact on the safe operation of the ship. In the event of a cyber incident affecting IT systems only, the priority may be the immediate implementation of an investigation and recovery plan.

The loss of OT systems may have a significant and immediate impact on the safe operation of the ship. Should a cyber incident result in the loss or malfunctioning of OT systems, it will be essential that effective actions are taken to help ensure the immediate safety of the crew, ship, cargo and protection of the marine environment. In general, appropriate contingency plans for cyber incidents, including the loss of critical systems and the need to use alternative modes of operation, should be addressed by the relevant operational and emergency procedures included in the safety management system.

Some of the existing procedures in the ship’s safety management system will already cover such cyber incidents. However, cyber incidents may result in multiple failures causing more systems to shut down at the same time. The contingency planning should take such incidents into consideration.

/by