Speaking at the 6th Med Ports Conference in Livorno (Italy) last month, TT Club’s Andrew Huxley highlighted that cyber activity is a daily operational risk which needs to be addressed urgently.
London, 3rd May, 2018
According to freight transport specialist insurer TT Club, supply chain operators are vulnerable to disruptive cyber activity, from criminals or other perpetrators, impacting operations and putting commercially sensitive or confidential data at risk.
Huxley explained, “Many in the marine supply chain business have operations characterised by widespread office networks and a reliance on multiple third party suppliers. Often IT systems are of an in-house, legacy nature, which may be poorly protected by security software.” Specifically, ports and terminals are exposed to threats as they are at the confluence of physical and communications activity. The data interfaces are complex and the drive towards interconnected control systems and efficient processes, exacerbates the opportunities for outside malicious interference. Most of all, at the ship/port interface there is much opportunity to cause loss and damage, far beyond the persistent exposure to criminal activity.
The problem is intensifying. At a global level reports by AV-TEST indicate that on average 4.2 new files of malware code were generated every second last year. From a maritime supply chain perspective an example of serious IT incursion in 2017 was the spoofing attack on over twenty ships in Novorossiysk (Russia). Navigation experts claim the spoofing sent false signals and resulted in ship-board equipment providing false information as to the location of the ships. There is speculation that this incident could have been a state-sponsored attack. A second incident, the NotPetya strike, impacted many in the supply chain, including AP Moller-Maersk, resulting in large scale disruption and substantial costs for those immediately impacted and their partners.
As to the extent of attacks, research that is available reveals a worrying situation. “A BIMCO survey in 2016 suggested that more than 20% of respondents admitted to cyber attacks and last year a SeaIntel Maritime Analysis report estimated that 44% of the top 50 container carriers had weak or inadequate cyber security policies and processes,” stated TT Club’s Huxley.
The US Coast Guard issued a draft Navigation and Vessel Inspection Circular (NAVIC) titled ‘Guidelines for Addressing Cyber Risks at Maritime Transportation Security Act (MTSA) Regulated Facilities’. The circular currently under review requires incorporation of personnel training, drills and exercises to test capabilities, security measures for access control, handling cargo, delivery of stores, procedures for interfacing with ships and security systems and equipment maintenance.
Additional national and regional initiatives, exemplified in the European Union by the Directive on Security of Network and Information Systems (NIS Directive) and General Data Protection Regulation (GDPR), are indicative of the development of regulatory expectations. While the latter does not directly address it, cyber protection is intrinsically at the core of data protection. Such initiatives, together with known vulnerabilities, highlight that cyber security is ever more pertinent for ports and terminals, as well as the broader supply chain community.
TT Club, jointly with UK P&I Club (also managed by Thomas Miller) and cyber security consultants NYA, has published a paper entitled ‘Risk Focus: Cyber – Considering Threats in the Maritime Supply Chain’. This is available as a free download here
Huxley introduced the paper in his Livorno presentation, “As an insurance mutual, TT Club has always been dedicated to minimising risk through its loss prevention efforts. By publishing ‘Risk Focus: Cyber’ we hope to generate more awareness of the risks to help combat the situation. Ultimately, the main threat continues to derive from human error – downloading malicious content, opening an unsecured web browser or falling victim to social engineering attacks and phishing scams.”
Awareness of the nature of potential attacks and the need for protection is clearly a crucial initial step towards thorough risk assessment and mitigation – and this needs to become part of corporate culture.
ENDS
Notes to editors:
TT Club is the international transport and logistics industry’s leading provider of insurance and related risk management services. As a mutual insurer, TT Club exists to provide its policyholders with benefits, which include specialist underwriting expertise, a world-wide office network providing claims management services, and first class risk management and loss prevention advice.
Customers include some of the world’s largest shipping lines, busiest ports, biggest freight forwarders and cargo handling terminals, to companies operating on a smaller scale but whose operations face similar risks. TT Club specialises in the insurance of Intermodal Operators, NVOCs, Freight Forwarders, Logistics Operators, Marine Terminals, Stevedores, Port Authorities and Ship Operators. TT Club is managed by Thomas Miller.
About Thomas Miller
Thomas Miller is an independent and international provider of insurance, professional and investment services.
Founded in 1885, Thomas Miller’s origins are in the provision of management services to mutual organisations, particularly in the international transport and professional indemnity sectors; where today they manage a large percentage of the foremost insurance mutuals. Thomas Miller also manages insurance facilities for all the self-employed barristers in England & Wales, as well as trustees of pension schemes, patent agents and housing associations.
Principal activities include:
- Management services for transport and professional indemnity insurance mutuals
- Investment management for institutions and private clients
- Professional services including legal services, claims and captive management
- Managing General Agency