Page 42: of Marine News Magazine (October 2019)

41 43

COLUMN AUTONOMOUS CYBER RISK “In 2013, a team of researchers from the University of Texas demonstrated that by using a $3,000 GPS spoofer, a small antenna and a laptop, an $80 million private yacht could be steered off course. The ship turned, but the chart display and the crew saw only a straight line. Other systems are at risk as well.”

There are speci? c cybersecurity guidelines dealing with already in the Cloud, but a word of caution: the migration

OT systems such as NIST 800-82, a security framework of applications to the Cloud adds new layers of complexity for industrial control systems. Unfortunately, maritime and threat surfaces.

companies have a legacy of low cyber awareness and cy- An insecurely con? gured AWS Web Application Firewall bersecurity capability. But, even being ‘average’ in terms of (WAF) permitted an insider to steal 106 million personal cyber security is not good enough. The danger is too great. records from a large bank. The devil is truly in the details.

Cybersecurity experts all agree that layered defenses and In cybersecurity, getting the details right is an absolute. multiple security defenses within the layers are best prac- Cybersecurity is more than just a means for defense. It tices against intrusions and breaches. While nothing guar- is a business enabler and reputation booster, enhancing antees immunity, signi? cantly lower risk is achievable with the loyalty and trust of security-minded customers and

Zero Trust, which relies on the concept of ‘never trust and partners. It can drive new business and be a competitive always verify a connection.’ Zero Trust employs micro-seg- differentiator if cybersecurity is baked-in, part of the de- mentation and granular perimeter enforcement based on sign. Forbes contributor William Saito said it well when users, their locations and other data to determine whether he compared cybersecurity to the brakes of the very swift to trust a user, machine or application seeking access. Zero Japanese bullet train, that the brakes permit speed. “The

Trust might have minimized, perhaps prevented the well- brakes aren’t there to act as a drag on the bullet train’s per- publicized Maersk event. formance – they allow it to travel faster than conventional trains because they put the train drivers in control of its

The Regulator’s Role speed. To go really fast, you need really good brakes.”

Regulators are taking an activist role in cybersecurity.

The EU’s General Data Protection Regulation (GDPR) gives regulators extra-territorial reach and the ability to

Mr. Jeffery Mayger provides cyber security advisory services at levy ? nes up to 4% of annual global turnover or Euro 20

Concord, a consultancy for information technology integration and security services. His cybersecurity background includes million – whichever is greater – for any company infring-

Chief Information Security Of? cer (CISO) for global mining ing on the data privacy of EU citizens. The International company Sibelco and information security services to upstream

Maritime Organization, the United Nations agency with oil/gas customers. In addition to his B.S in Mechanical Engi- responsibility for the safety and security of shipping, is ex- neering, Mr. Mayger also holds a Master of Business Adminis- amining how to address autonomous shipping in its regu- tration (MBA) from the University of Texas. His Information

Security background includes designations as Certi? ed Infor- latory framework. A cyberattack against marine shipping mation Security Professional (CISSP) and Certi? ed SCADA could face the wrath of multiple regulators.

Security Architect (CSSA). Mr. Mayger can be contacted at

Some marine stakeholders are building cloud-based au- [email protected].

tonomous shipping platform. Many onshore industries are

October 2019 MN 42