Maritime Cyber Attacks Are A Deadly Threat

New research published by DNV reveals that less than half (40%) of maritime professionals think their organisation is investing enough in cyber security at a time when vessels and other critical infrastructure are becoming increasingly networked and connected to IT systems. 

Maritime professionals are warning of insufficient investment in cyber security as risks escalate in the era of connectivity, with three-quarters believing an incident will force the closure of a strategic waterway and according to DNV, maritime cyber security needs more investment, better regulation, and sharing of incident experiences.

This survey of 801 industry professionals by class society DNV found that more than half also expect cyber incidents to cause ship collisions, groundings, and even result in physical injury or death.

Key Findings

  • Insufficient funding is the maritime sector’s biggest barrier to greater cyber resilience in 2023, as safety-compromising threats to the industry’s operational technology gather pace.
  • Tightening regulation raises hopes for greater investment in cyber security to be unlocked, according to DNV’s survey of more than 800 industry professionals, but concerns are emerging over rulebook effectiveness and companies’ ability to comply.
  • Cyber security is a pre-requisite for progress as more than half of maritime professionals describe digital technology as a key enabler of their decarbonisation plans.  

The majority of maritime professionals expect cyber attacks to disrupt ship operations in the coming years, with more than three quarters believing an incident is likely to force the closure of a strategic waterway.

Although the maritime industry has focused on improving IT security in recent decades, DNV said the security of operational technology (OT), which manages, monitors, controls, and automates physical assets such as sensors, switches, safety and navigation systems, and vessels, is a more recent and increasingly urgent risk.

Three-quarters of those surveyed believe that OT security is a significantly higher priority for their organisation than it was just two years ago; however, just one in three in the industry are confident that their organization’s OT cyber security is as strong as its IT security. “The maritime industry is still thinking IT in an era of connected systems and assets,” said Svante Einarsson, head of maritime cyber security advisory at DNV. “With ship systems being increasingly interconnected with the outside world, cyber attacks on OT are likely to have a bigger impact in the future.”

According to DNV’s analysis, while the age of connection brings new threats, it also brings new opportunities. Almost all maritime professionals agreed the future of the industry relies on an increase in connected networks, and that connected technologies are helping the industry reduce emissions. “Cyber security is a growing safety risk, perhaps even “the risk for the coming decade,” warned Knut Ørbeck-Nilssen, CEO Maritime at DNV. 

Most maritime professionals told DNV that they believe that regulation provides the strongest motivator to unlock much-needed cyber security funding. Majority said that it will drive investment in cyber security, but only just over half are confident in the effectiveness of cyber security regulation and in their ability to meet requirements. 

DNV also found that just 36% of maritime professionals agree that complying with cyber security regulation is straightforward and almost half (44%) say that regulatory compliance requires technical knowledge that their organisation does not possess in-house. 

Seven recommendations were put forward by the report, including considering cyber security as an enabler, treating cyber issues like safety issues, sharing insights across the industry, creating a more effective training strategy, maintaining fallback options for systems, and reframing regulation as a baseline from which to build cyber security. 

The report points to pending regulations saying that tighter regulation of maritime security will provide a strong motivator to unlock funding for cyber security. 

While just over half of the survey respondents are confident in the effectiveness of cyber security regulation and their ability to meet requirements, organisations must and are preparing to comply with the new rules spurring a greater focus on the dangers.  

DNV:       Lloyds List:     Splash 247:    Seatrade-Maritime:     Maritime-Executive:    Port News:  

You Might Also Read: 

Ransomware Trends In The Aviation & Maritime Industries:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Data Sovereignty
What Is The Cybersecurity Maturity Model Certification (CMMC)? »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 8,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Codified Security

Codified Security

Codified is a testing platform for mobile application software. We make it easier than ever for companies to detect and fix security vulnerabilities and ensure their applications are compliant.

National Cyber Security Centre (NCSC) - New Zealand

National Cyber Security Centre (NCSC) - New Zealand

The role of the NCSC is to help New Zealand’s most significant public and private sector organisations to protect their information systems from advanced cyber-borne threats.

Consortium for Information & Software Quality (CISQ)

Consortium for Information & Software Quality (CISQ)

The mission of CISQ is to develop international standards for software quality and to promote the development and sustainment of secure, reliable, and trustworthy software.

Secberus

Secberus

SECBERUS creates cloud security technology to help organizations stay secure & compliant in the public cloud.

Evina

Evina

Evina offers the most advanced cybersecurity and fraud protection for mobile payment.

Safe Systems

Safe Systems

Safe Systems provide compliance centric IT services for community banks and credit unions, ensuring that they are kept up to date on current technologies, security risks, and regulatory changes.

NI Cyber Security Centre

NI Cyber Security Centre

NI Cyber Security Centre works to make Northern Ireland cyber safe, secure and resilient for its citizens and businesses.

Enzen

Enzen

Enzen is a global knowledge practice that provides consulting, technology, engineering, operating and innovation services to the energy and utility sectors.

Vali Cyber

Vali Cyber

Vali Cyber was founded in 2020 with the mission of addressing the specific cybersecurity needs of Linux.

Mobilicom

Mobilicom

Mobilicom is an end-to-end provider of cybersecurity and smart solutions for drones, robotics & autonomous platforms.

AFRY

AFRY

AFRY is a world leading engineering company, trusted as a supplier of services and solutions within the industry, energy, and infrastructure sectors as well as for authorities.

US Cyber Games

US Cyber Games

US Cyber Games is committed to inform and inspire the broader community on ways to develop tomorrow’s cybersecurity workforce.

SecureLake

SecureLake

SecureLake (formerly Managni) is one of the most trusted US-based IT security and infrastructure companies.

PureID

PureID

Protect your enterprise with PureAUTH #IAMFirewall, Resilient SSO platform, purpose built to provide Passwordless Authentication & Zero Trust Access, by default.

XY Cyber

XY Cyber

XY Cyber enable Generative AI for Cyber Operations. We simplify the complex world of cyber threats into actionable strategies, empowering your defense with AI-powered solutions.

S4E (Security for Everyone)

S4E (Security for Everyone)

At S4E.io, our mission is to democratize digital security, making it accessible, simple, and effective for individuals and businesses of all sizes.