Submitted by Cyware
As cross-border trade accelerates, the reliance on the maritime industry has increased. One could argue that it is part of the critical infrastructure as was well illustrated by the recent closing of grain exports from Ukraine that lead to shortages that impacted supplies of once common goods that were visible to consumers in grocery stores. Cyber risk, in this industry, relied upon by the global economy, would benefit from rethinking security strategies to yield a more resilient maritime industry.
Setting the context
Modern ships rely on Global Navigation Satellite System (GNSS), Radio Detection and Ranging (RADAR), Automatic Identification Systems (AISs), communications systems, cargo management systems, power management systems, and control systems that are critical for the safety of cargo and humans on board.
Similarly, the port infrastructure today consists of vast information networks, web tracking/monitoring systems, power management systems, IT systems, Operational Technology (OT) systems, Internet of Things (IoT) sensors, and communication systems that facilitate cargo movement and container processing.
Some of these systems are directly connected to the internet. Others are within reach of cyber adversaries through clever cyber-physical attacks, like phishing, that enable lateral movement and, eventually, exploit vulnerabilities.
Time to batten down the hatches
The security measures put in place to protect ships at sea and the ports should not only cover the IT systems, but also the other OT systems, IoT devices, and Industrial Control Systems (ICS) that are deployed by various entities in the maritime ecosystem.
To counter threats proactively, organizations need access to timely, relevant, and actionable intelligence on the Tactics, Techniques, and Procedures (TTPs) employed by threat actors. Traditionally, such threat information sharing is carried out through organization-specific manual processes that require significant time investment in threat investigation and analysis that may be contextualized, disseminated, and acted upon. The lack of real-time sharing leads to delays in threat containment and mitigation and reduces the overall efficacy of threat intelligence. Also, human errors and false positives frequently cloud the picture. Leveraging threat intelligence sharing and security automation can accelerate the utilization and effective deployment of threat intelligence across the entire threat hunting, detection, and mitigation lifecycle.
The benefits of a sharing ecosystem include some definition of automated response for faster approval, processing, and sharing of threat intelligence, enhanced threat contextualization, real-time visibility into maritime-specific threats through automated sharing of detection intelligence, and proactive threat mitigation through automated actioning of shared threat data.
Key takeaway
It is time for the maritime industry to prioritize cybersecurity to strengthen its security posture. Cyware can assist with unifying the collective capability of member organizations to enhance security operations through threat intelligence sharing, orchestration, and security response automation. Enabling defenders affiliated with the MTS-ISAC to collaborate in real time provides the foundation for a collective defense ecosystem that can benefit all.