U.S. Coast Guard Issues Alert After Ship Heading Into Port Of New York Hit By Cyberattack
https://www.ispeech.org
<div _ngcontent-c14="" innerhtml="
The U.S. Coast Guard has issued an official warning to owners of ships that cybersecurity at sea needs updating, and updating urgently. In the Marine Safety Alert published June 8, the Coast Guard "strongly encourages" that cybersecurity assessments are conducted to "better understand the extent of their cyber vulnerabilities." This follows an interagency investigation, led by the Coast Guard, into a "significant cyber incident" that had exposed critical control systems of a deep draft vessel bound for the Port of New York in February 2019 to what it called "significant vulnerabilities."
The investigation concluded that the malware attack had: "significantly degraded the functionality of the onboard computer system." This probably comes as a shock to most readers who may not consider ships and boats as targets for malware. However, it did not surprise the crew who, the Coast Guard alert insists, were well aware of "the security risk presented by the shipboard network." This network is used to update electronic charts, manage cargo data, and communicate with shore-side facilities as well as the Coast Guard. Ethical Hacker John Opdenakker says he was "amazed" to hear that the crew well knew the security risk but "this didn't result in the problems being addressed." Not that Opdenakker is victim-blaming here, but instead pointing out that there should be a formal and mandatory requirement to inform the vessel operator of the issues.
What comes as a shock to me, if I am honest, is that the measures which the Coast Guard "strongly recommends" those responsible for these vessels are hardly advanced in nature. Indeed, they are of the kind I would expect most computer users to be aware of at home, school, and work. Nor is any of this mandatory, just recommended. That the list that follows was the outcome of the investigation speaks volumes for the lack of security awareness at sea.
Here are some of the recommendations:
- Segment your networks into subnetworks to make it harder for an adversary to gain access to essential systems and equipment.
- Eliminate the use of generic log-in credentials for multiple personnel. Create network profiles for each employee. Require employees to enter a password or insert an ID card to log on to onboard equipment.
- Administrator accounts should be used sparingly and only when necessary.
- Install and routinely update basic antivirus software.
- Vulnerabilities impacting operating systems and applications are continually changing – patching is critical to effective cybersecurity.
Oh, and most telling of all, a warning to be wary of external media. The investigation revealed that it is "common practice for cargo data to be transferred at the pier, via USB drive." Drives that would be routinely plugged directly into the ship's computers without any prior scanning for malware. This isn't rocket, or torpedo for that matter, science.
The U.S Cybersecurity and Infrastructure Security Agency (CISA) has also issued a Computer Emergency Response Team (CERT) alert through the National Cyber Awareness System (NCAS) that reinforces the need for cybersecurity on commercial vessels.
Tim Mackey, the principal security strategist of the Synopsys Cybersecurity Research Center, said that "attackers define the rules of engagement in an attack, and targeting governmental and military assets will always be valuable for those seeking to disrupt our society. This incident highlights lessons for everyone to take, whether you're in government or a corporate setting: vigilance starts with preparedness."
">
The U.S. Coast Guard has issued an official warning to owners of ships that cybersecurity at sea needs updating, and updating urgently. In the Marine Safety Alert published June 8, the Coast Guard "strongly encourages" that cybersecurity assessments are conducted to "better understand the extent of their cyber vulnerabilities." This follows an interagency investigation, led by the Coast Guard, into a "significant cyber incident" that had exposed critical control systems of a deep draft vessel bound for the Port of New York in February 2019 to what it called "significant vulnerabilities."
The investigation concluded that the malware attack had: "significantly degraded the functionality of the onboard computer system." This probably comes as a shock to most readers who may not consider ships and boats as targets for malware. However, it did not surprise the crew who, the Coast Guard alert insists, were well aware of "the security risk presented by the shipboard network." This network is used to update electronic charts, manage cargo data, and communicate with shore-side facilities as well as the Coast Guard. Ethical Hacker John Opdenakker says he was "amazed" to hear that the crew well knew the security risk but "this didn't result in the problems being addressed." Not that Opdenakker is victim-blaming here, but instead pointing out that there should be a formal and mandatory requirement to inform the vessel operator of the issues.
What comes as a shock to me, if I am honest, is that the measures which the Coast Guard "strongly recommends" those responsible for these vessels are hardly advanced in nature. Indeed, they are of the kind I would expect most computer users to be aware of at home, school, and work. Nor is any of this mandatory, just recommended. That the list that follows was the outcome of the investigation speaks volumes for the lack of security awareness at sea.
Here are some of the recommendations:
- Segment your networks into subnetworks to make it harder for an adversary to gain access to essential systems and equipment.
- Eliminate the use of generic log-in credentials for multiple personnel. Create network profiles for each employee. Require employees to enter a password or insert an ID card to log on to onboard equipment.
- Administrator accounts should be used sparingly and only when necessary.
- Install and routinely update basic antivirus software.
- Vulnerabilities impacting operating systems and applications are continually changing – patching is critical to effective cybersecurity.
Oh, and most telling of all, a warning to be wary of external media. The investigation revealed that it is "common practice for cargo data to be transferred at the pier, via USB drive." Drives that would be routinely plugged directly into the ship's computers without any prior scanning for malware. This isn't rocket, or torpedo for that matter, science.
The U.S Cybersecurity and Infrastructure Security Agency (CISA) has also issued a Computer Emergency Response Team (CERT) alert through the National Cyber Awareness System (NCAS) that reinforces the need for cybersecurity on commercial vessels.
Tim Mackey, the principal security strategist of the Synopsys Cybersecurity Research Center, said that "attackers define the rules of engagement in an attack, and targeting governmental and military assets will always be valuable for those seeking to disrupt our society. This incident highlights lessons for everyone to take, whether you're in government or a corporate setting: vigilance starts with preparedness."
Gloss