Information Security in Shipping and ISO 27001

1. InformationSecurity in
Shipping and ISO 27001
Grivas Kostas
4th ShipIT Conference, Athens, September 26, 2018

2. Information
System
Domains in a
Maritime
Organization
Shore Domain Vessel Domain

3. Shore Domain
✓ Disaster/Recover facilities
✓ Cloud Services
✓ Remote Management
✓ Mobile Access
✓ External Datacenters
✓ Suppliers’/Vendors’ Extranets
✓ Etc.

4. Vessel Domain
InformationTechnology (IT) OperationTechnology (OT)
➢ Always ON connections
➢ Performance monitoring
➢ ECDIS
➢ Advanced M/E
➢ Computer driven OT systems
➢ Crew welfare
➢ Wi-Fi
➢ Etc.

5. Information
Security
Landscape

6. Compliance
requirements
▪ TMSA 3 (Tanker Management & Self-Assessment)
▪ EU NIS DIRECTIVE (2016/1148) (Network &
Information Systems)
▪ EU GDPR
▪ SIRE VIQ ver.7 (Vessel Inspection Questionnaire)
▪ IMO MSC.1 / Circ. 1526
▪ IMO MSC 98/5/2
▪ Guidelines by BIMCO, DNV-GL, ABS, UK IET, etc.

7. TheChallenge
Organization’s
Strategy and
Security Objectives

8. TheChallenge
(cont.)
Information Security
Security
Service A
Malware
Protection
Security
Service B
Perimeter
Protection
Recomme
ndation A
Recomme
ndation B
GAP
GAP
GAP

9. The Plan
1. Context of the Organization
2. Leadership - Policy
3. Planning
4. Support
5. Operation
6. Performance evaluation
7. Improvement
ISO 27001:2013
Requirements

10. The Plan
(cont.)
KEY POINTS FOR ANALYSIS ISO 27001:2013 DOMAINS
A8
A9
A11
A13
A10
A15
A7
A12
A17
A16
A14
A18
A5
A6

11. Conclusion
The establishment, implementation and improvement of
an Information Security plan requires a solid and robust
framework.
ISO 27001:2013 contains all the necessary key points to
develop such a plan.
Even if the organization decide not to acquire the
certification, following ISO’s clauses will be beneficial.
On the other hand, the certification can:
1. Provide Competitive advantage
2. Enhance Customer’s confidence
3. Prove commitment to data and privacy protection
4. Increase legislative and regulatory compliance
5. Improve organization’s security
6. Manage Information Security Risks effectively.