Incident, Recovery and Procedures – Response

Cyber Management Course (Ma) – Module 4

Response to an incident, Recovery and Procedures – Response

It is important to understand that cyber incidents may not disappear by themselves. If for example, the ECDIS has been infected with malware, starting up the back-up ECDIS may cause another cyber incident. It is, therefore, recommended to plan how to carry out the cleaning and restoring of infected systems.

Knowledge about previous identified cyber incidents should be used to improve the response plans of all ships in the company’s fleet and an information strategy for such incidents may be considered.

/by

Incident, Recovery and Procedures – Introduction

Cyber Management Course (Ma) – Module 4

Response to an incident, Recovery and Procedures – Introduction

Managing an incident well can make the difference between an annoying distraction and a disaster.

Basics of Incident Response (IR):

isolate, don’t power off

Creating an IR playbook and response plan

Basic hack detection skills for crew

If you think you’ve been hacked or being hacked:

Shutdown the system

Or turn off the system

Separate the system from network

Restore the system with the backup

Or reinstall all programs

Connect the system to the network

It would be prudent to call the police even if you do not know who or how bad it was.  Gather evidence, and don’t assume it has gone.  Many of the case studies we look at in this book, shows hacks were left dormant for many months if not a year prior to the incident.

/by

SMS Cyber Management – Safety Management System 2

Cyber Management Course (Ma) – Module 3

SMS Cyber Management – Safety Management System

Furthermore, it is important to help ensure that a loss of equipment or reliable information due to a cyber incident does not make existing emergency plans and procedures ineffective. Contingency plans and related information should be available in a non-electronic form as some types of cyber incidents can include the deletion of data and shutdown of communication links. There may be occasions when responding to a cyber incident may be beyond the competencies on board or at head office due to the complexity or severity of such incidents. In these cases, external expert assistance may be required (for example, post event forensic analysis and clean-up).

Remember Module 9 of your Operator course (Op), where AI monitors AI….

/by

SMS Cyber Management – Safety Management System 1

Cyber Management Course (Ma) – Module 3

SMS Cyber Management – Safety Management System

The safety management system will already include procedures for reporting accidents or hazardous situations and define levels of communication and authority for decision making. Where appropriate, such procedures should be amended to reflect communication and authority in the event of a cyber incident.

The following is a non-exhaustive list of cyber incidents, which should be addressed in contingency plans on board:

loss of availability of electronic navigational equipment or loss of integrity of navigation related data.

loss of availability or integrity of external data sources, including but not limited to GNSS.

loss of essential connectivity with the shore, including but not limited to the availability of Global Maritime Distress and Safety System (GMDSS) communications.

loss of availability of industrial control systems, including propulsion, auxiliary systems and other critical systems, as well as loss of integrity of data management and control.

/by

Clause 380 Maritime Cyber Insurance – Liability Cover

Cyber Management Course (Ma) – Module 2

Clause 380 Maritime Cyber Insurance – Liability Cover

Contact your P&I Club for detailed information about cover provided to shipowners and charterers in respect of liability to third parties (and related expenses) arising from the operation of ships.

An incident caused, for example by malfunction of a ship’s navigation or mechanical systems because of a criminal act or accidental cyber attack, does not in itself give rise to any exclusion of normal P&I cover. In the event of a claim involving a cyber incident, claimants may well seek to argue that the claim arose as a result of an inadequate level of cyber preparedness. This, therefore, further stresses the importance of companies being able to demonstrate that they are acting with reasonable care in their approach to managing cyber risk and to protecting the ship. It should be noted that many losses, which could arise from a cyber incident, are not in the nature of third-party liabilities arising from the operation of the ship and are therefore not covered by P&I insurance. For example, financial loss caused by ransomware, or costs of rebuilding scrambled data would not be identified in the coverage.

/by

Clause 380 Maritime Cyber Insurance – P&I Cyber S Club 1

Cyber Management Course (Ma) – Module 2

Clause 380 Maritime Cyber Insurance – P&I Cyber Insurance example Standard Club

The Standard Bulletin in March 2017 looked to provide information on liability and cover.

“How would standard P&I cover operate in such a scenario?

 

Poolable P&I cover Other than the exclusion relating to paperless trading, there is no express cyber exclusion in the club’s rules. As such, a member’s normal P&I cover will continue to respond to P&I liabilities arising out of a cyber attack so long as the attack in question does not constitute ‘terrorism’, ‘a hostile act by or against a belligerent power’ or another war risk excluded under rule 4.3 of the club’s rules. Whether or not a cyber attack constitutes an act of terrorism for the purposes of the rules will generally depend upon the motivation behind it. In the context of war risks, terrorism is broadly understood to denote acts aimed to kill, maim or destroy indiscriminately for a public cause. Accordingly, if, for example, a cyber attack were to be perpetrated by an individual or group for the purposes of causing general disruption and for no public cause, then this would be very unlikely (without more) to constitute terrorism for the purposes of the rules and a member’s cover will respond in the normal manner. However, in the event of any dispute as to whether or not an act constitutes terrorism, the club’s board is given the power under rule 4.3 to decide and such decision shall be final.”

/by

Clause 380 Maritime Cyber Insurance – P&I Cyber S Club 2

Cyber Management Course (Ma) – Module 2

Clause 380 Maritime Cyber Insurance – P&I Cyber Insurance example Standard Club

The Bulletin goes onto the matter of a Cyber-attack during war

“If a cyber attack were to be executed against a ship by a government or organised rebels in a period of war or civil war, the war risks exclusion in the rules would be engaged.”

It is with particular attention that the Shipping company or Vessel should consider the word `war` and `terrorism` and their definitions.  We are about to look at another P&I policy on Cyber Insurance and understanding these definitions will have a key role when development your procedures and considering your liability.

Note:  I hope you were paying attention when you conducted the Cyber Operators course (Op) which discussed these terms in more detail!

/by

Clause 380 Maritime Cyber Insurance – P&I Cyber UK Club 1

Cyber Management Course (Ma) – Module 2

Clause 380 Maritime Cyber Insurance – P&I Cyber Insurance example UK P&I

In March 2018 the UK P&I Club released a Q&A bulletin called “Cyber risks and P&I insurance”

“Are cyber risks excluded from P&I cover?

No.  As a general rule, P&I liabilities which are set out in Rule 2 of the UK Club Rules are not subject to any exclusion of cyber risks.  Nor is the International Group Pooling Agreement subject to a cyber risk exclusion.  Some maritime cyber risks, however, don’t come within the scope of P&I because they don’t arise from the operation of a ship.  An example is the risk of monetary loss where a shipping company is blackmailed to pay a ransom for the restoration of IT data or restoration of IT systems that have been compromised by cyber-attack.”

/by

Clause 380 Maritime Cyber Insurance – P&I Cyber UK Club 2

Cyber Management Course (Ma) – Module 2

Clause 380 Maritime Cyber Insurance – P&I Cyber Insurance example UK P&I

It is important for Management to understand if they are covered for Operation loss and/or loss through the many opportunities covered in the Op course in depth, namely:

Micro-sandboxing

Microsoft Office macros

Spyware

Spoofing

Phishing

Spear Phishing

Phishing scams

Example of a Scam

CEO fraud (Captain/Master/Operator or Owner)

Email attachments

Pop Up Ads

Water holing

Harmful Software

Malware

Trojan

Worms

Crimeware

Adware

Bots

DDOS

/by

Clause 380 Maritime Cyber Insurance – P&I Cyber UK Club 3

Cyber Management Course (Ma) – Module 2

Clause 380 Maritime Cyber Insurance – P&I Cyber Insurance example UK P&I

The Notice goes onto state:

“P&I War Risks (including terrorist risks)

 

P&I cover is subject to an exclusion in respect of P&I liabilities, costs or expenses arising from war risks as defined in UK Club’s Rule 5E, including acts of terrorism.  The exclusion applies irrespective of any contributory negligence on the part of the Owner or his servants or agents.  A key part of the definition refers to P&I losses caused, or contributed to, by “War, civil war, revolution, rebellion, insurrection or civil strife arising therefrom, or any hostile act by or against a belligerent power, or any act of terrorism”

 

Depending on motive, a cyber-attack could constitute an “act of terrorism” or even in warlike circumstances a “hostile act by a belligerent power”

 

Terrorist acts are generally regarded as those aiming to kill, maim or destroy indiscriminately for a political, religious or ideological cause.  The Club’s Directors have power under the Rules to determine whether a particular event constitutes an act of terrorism for the purpose of applying the exclusion

A cyber-attack on an individual ship is, however, likely to be regarded as a hostile act of a belligerent power only in the context of civil war or where a rebellion extends to the occupation of territory and organised political authority over military forces

A cyber-attack on an individual ship could arise for a variety of reasons that do not engage the war exclusion – including, for example, commercial sabotage, or the malicious act of an individual with a grudge against the owning company – and in any such cases a Member’s normal P&I cover will respond (subject to the remainder of the Rules)”

When we reflect back on `Water holing` from the Operators course (Op), we must consider the motive and effort placed in modern cyber crime.  Does this level of motivation or motive constitute at an act of terrorism.

It is vital that Owners and Operators and content with their level of cover, and more importantly, now understand the education level required for their Operators to try and stop an attack in the first place.

/by