Paperless ship navigation: cyber security weaknesses

Sviličić, Boris; Kristić, Miho; Žuškin, Srđan; Brčić, David

doi:10.1007/s12198-020-00222-2

Cited by 14 publications

(5 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, in this study, the tasks related with ECDIS are determined by referencing the guide of operational handbook for ECDIS (Weintrit, 2009), and OCIMF's guide related to the recommendations on usage of ECDIS and preventing incidents (OCIMF, 2020). Then, these determined ECDIS tasks are integrated with the cybersecurity by referencing ECDIS cyber incidents (Svilicic et al, 2019a(Svilicic et al, , 2019d(Svilicic et al, , 2020Karahalios, 2020;Kristic et al, 2021;Tam et al, 2022), various recommended international IT and OT cybersecurity standards for maritime such as International Organization for Standardization (ISO), IEC standards and NIST framework (ISO/IEC, 2010; BSI, 2011BSI, , 2017BSI, , 2018BSI, , 2021Cichonski et al, 2012), and other codes of cybersecurity for ships (ICS and other organizations, 2016;Boyes and Isbell, 2017;IACS, 2020). Moreover, the developed final ECDIS tasks integrated with cybersecurity are checked by referencing a safety management manual of a shipping company, which is required by the IMO Maritime Safety Committee (MSC) according to the Resolution MSC.428(98) 'Maritime Cyber Risk Management in Safety Management Systems' (IMO, 2017a).…”

Section: Tasks Identificationmentioning

confidence: 99%

“…Although there are apparent benefits, as mentioned, with the integration of several operational navigation equipment with ECDIS, the risk of cyber-attacks on the ECDIS system or its integrated items emerges. Because ECDIS and its typical back arrangement have high-level connectivity and digitalisation, they are an excellent environment for cyber-security threats associated with the distribution of malicious code (Svilicic et al, 2020). For this reason, cyber-attacks aimed directly at ECDIS or its integrated items should be considered as a critical issue to ensure safety of life, property and environment (Kristic et al, 2021).…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Evaluating SLIM-based human error probability for ECDIS cybersecurity in maritime

Kayisoglu

Bolat²,

Tam³

2022

J. Navigation

View full text Add to dashboard Cite

There is an undeniable recognition that maritime cybersecurity risk management should involve process, technology, and people. However, thus far, most studies have focused on the technical and process aspects of maritime cybersecurity, more than on the human element. On a vessel, the Electronic Chart Display and Information System (ECDIS) is, amongst all the electronic devices on the bridge, a complex and indispensable maritime sociotechnical system that must consider both technical and human aspects. In the context of maritime cyber resilience, it is important to note that when developing strategies for maritime cybersecurity, one cannot only consider technical security measures and ignore human error, as this does not adhere to good cybersecurity practice. To address this, this study aims to identify the navigating officers’ responsibilities for ECDIS cybersecurity and find the human error probabilities during these tasks via the SLIM-based human reliability analysis method. The outputs of this study provide an insight for industrial policies and best practices, in ECDIS cybersecurity risk management in terms of the behavioural and cultural aspects of shipping.

show abstract

Section: Tasks Identificationmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Evaluating SLIM-based human error probability for ECDIS cybersecurity in maritime

Kayisoglu

Bolat²,

Tam³

2022

J. Navigation

View full text Add to dashboard Cite

show abstract

“…It did so through different means than Denmark. The legal implementation is done through the Network and Information Systems Regulations 2018 43 which designates competent authorities as those that can enforce the rules, and defines which types of penalties that are supposed to encourage compliance. Furthermore, the UK implemented a series of thorough guidance and systems, such as the Cyber Assessment Framework.…”

Section: United Kingdommentioning

confidence: 99%

“…As of the time of writing, there are measures in place to mitigate current attacks, ships can be sailed without any of these systems. But in the future, this may not be the case, and the entire infrastructure of the whole world may be at risk from Supply Chain Attacks [43], and past incidents further support this [30].…”

Section: Regulating Adversarial Supply Chain Attacks In the Futurementioning

confidence: 99%

Preventing or Mitigating Adversarial Supply Chain Attacks; a legal analysis

Ludvigsen¹,

Nagaraja²,

Daly³

2022

Preprint

View full text Add to dashboard Cite

The world is currently strongly connected through both the internet at large, but also the very supply chains which provide everything from food to infrastructure and technology. The supply chains are themselves vulnerable to adversarial attacks, both in a digital and physical sense, which can disrupt or at worst destroy them. In this paper, we take a look at two examples of such successful attacks and consider what their consequences may be going forward, and analyse how EU and national law can prevent these attacks or otherwise punish companies which do not try to mitigate them at all possible costs. We find that the current types of national regulation are not technology specific enough, and cannot force or otherwise mandate the correct parties who could play the biggest role in preventing supply chain attacks to do everything in their power to mitigate them. But, current EU law is on the right path, and further vigilance may be what is necessary to consider these large threats, as national law tends to fail at properly regulating companies when it comes to cybersecurity.

show abstract

“…In [ 23 ], the authors examine cybersecurity weaknesses in paperless ships that depend on two internetworked ECDIS workstations operated in a backup arrangement. As in [ 13 , 21 , 22 ] their method employs cyber security tests using a vulnerability scanning tool.…”

Section: Related Workmentioning

confidence: 99%

A Triggering Mechanism for Cyber-Attacks in Naval Sensors and Systems

Leite

Moraes

Albuquerque

et al. 2021

Sensors

View full text Add to dashboard Cite

In the maritime sector, the integration of radar systems, Automatic Identification System (AIS) and Electronic Chart Display and Information System (ECDIS) through digital technologies enables several benefits to maritime operations, but also make ships prone to cyberattacks. In this context, this work investigates the feasibility of an attacker using a radar system or AIS as open door to remotely send commands to a cyber threat hosted on a ship, even if the ship’s systems are air gapped—i.e., are not connected to other networks. The received commands are intended to trigger a cyber threat located in the ship. Although the literature covers several analyzes on cyber risks and vulnerabilities in naval systems, it lacks exploiting mechanisms capable of acknowledging attack commands received through radar and AIS. To this end, this work proposes a triggering mechanism that uses a template matching technique to detect specific patterns transmitted by the attacker to the ship’s radar or AIS. The results show the effectiveness of the proposed technique as a tool to acknowledge the received attack commands and activate a malicious code previously installed on the ship. In the case of attacks on a radar system, the accuracy achieved by the proposed method is 0.90. In the case of attacks on an AIS/ECDIS setup it presents an accuracy of 0.93. In both cases the proposed mechanism maintains the due safety against accidental attack activations.

show abstract

Paperless ship navigation: cyber security weaknesses

Cited by 14 publications

References 15 publications

Evaluating SLIM-based human error probability for ECDIS cybersecurity in maritime

Evaluating SLIM-based human error probability for ECDIS cybersecurity in maritime

Preventing or Mitigating Adversarial Supply Chain Attacks; a legal analysis

A Triggering Mechanism for Cyber-Attacks in Naval Sensors and Systems

Contact Info

Product

Resources

About