Cybersecurity management for marine and offshore


Implementing Cyber Security in Offshore Oil and Gas Platforms Due to very large production volumes and government regulation, this project placed a high emphasis on security. Cyber security for the operational systems was achieved using the Tofino Industrial Security Solution.

Across the global maritime community, ports, vessels and facilities are increasingly connected to and dependent on cyber systems. Failure to anticipate and prepare for a cyber incident may have significant consequences. Maritime industry operations and management rely on cyber systems. Global Positioning Systems (GPS), automated equipment, physical security sensors, electronic certificates, cargo tracking, electronic navigation, Automatic Identification Systems (AIS), record-keeping and pre-arrival processing are just some of the equipment and activities that depend on reliable and secure cyber systems.

This reliance on computers and computer networks, particularly those connected to the internet, creates a potential vulnerability to cyber attacks as a result of poor cyber security practices. There are many examples of cyber security incidents related to the maritime industry: • Researchers from the University of Texas in the US demonstrated in July 2013 that it is possible to change a vessel’s direction by interfering with its GPS signal to cause the onboard navigation systems to falsely interpret a vessel’s position and heading. • A hacker caused a floating oil-platform located off the coast of Africa to tilt to one side, thus forcing it to temporarily shut down. •

Hackers accessed cyber systems in a port to locate specific containers loaded with illegal drugs and remove them from the port undetected. • Somali pirates employed hackers to access a shipping company’s cyber systems to identify vessels passing through the Gulf of Aden loaded with valuable cargoes and minimal on-board security, which led to the hijacking of at least one vessel. • In the Norwegian energy and oil and gas sector, more than 50 cyber security incidents were detected in 2015. •

Ten years ago, the antivirus company McAfee registered 25 new threats a day - now they register half a million threats daily.

• An increasing number of objects are connected to the Internet and may be hacked. The consequences of a cyber attack could be wide-ranging. For example, ship collisions could result from hacking of e-navigation and other systems which could lead to: • physical loss of or damage to ships, • physical injury to crew, • loss of cargo, • pollution, and • business interruption – including disruption to the port’s activities which could lead to considerable business interruption losses.

Provide Standards and Governance

a) Cyber issues are covered by the governing body (Board of Directors, Executive Board, etc.) to focus on risks to the organization, investments required to address those risks, and personnel and staffing needed for solid programs.

b) Cybersecurity information provided to the Board is of sufficient quantity and frequency to enable solid Board understanding of cybersecurity risks in the enterprise, necessary mitigation efforts, and tradeoff decisions about those risks.

c) The organization has an appointed and empowered Chief Information Security Officer (CISO) (or equivalent) whose responsibilities unify all information technology, information systems and data systems security in a single point of accountability.

d) The CISO’s reporting structure is short and direct, giving priority to enterprise risk management and risk mitigation efforts.

e) The organization has a governance structure that makes timely decisions about cybersecurity, systems and risk, balancing investments, business rules, and operations in order to minimize possible risks and maximize benefits from expenditures.

AP Class Cybersecurity Brochure