ΕΛΙΣΜΕ MSAG 20181107 Φώτης Σοφρώνης ‘Cyber Security στο Θαλάσσιο Περιβάλλον’
•Download as PPTX, PDF•
1 like•117 views
Το Ελληνικό Ινστιτούτο Στρατηγικών Μελετών (ΕΛΙΣΜΕ) και η Ερευνητική Ομάδα Maritime and Seapower Analysis Group (MSAG) στην Εσπερίδα 'Νέες Τεχνολογίες και Απειλές στο Θαλάσσιο Περιβάλλον: Internet of Things & Κυβερνοπόλεμος’ την Πέμπτη 7 Νοεμβρίου 2018 στο ΕΛΙΣΜΕ. https://www.facebook.com/events/251980868801123/
Recommended
More Related Content
Similar to ΕΛΙΣΜΕ MSAG 20181107 Φώτης Σοφρώνης ‘Cyber Security στο Θαλάσσιο Περιβάλλον’
Similar to ΕΛΙΣΜΕ MSAG 20181107 Φώτης Σοφρώνης ‘Cyber Security στο Θαλάσσιο Περιβάλλον’ (20)
More from Ελληνικό Ινστιτούτο Στρατηγικών Μελετών (ΕΛΙΣΜΕ)
More from Ελληνικό Ινστιτούτο Στρατηγικών Μελετών (ΕΛΙΣΜΕ) (20)
Recently uploaded
Recently uploaded (20)
ΕΛΙΣΜΕ MSAG 20181107 Φώτης Σοφρώνης ‘Cyber Security στο Θαλάσσιο Περιβάλλον’
- 1. The better the question. The better the answer. The better the world works. Maritime Cyber Security November 2018 Fotis Sofronis Manager at EY Cybersecurity Services
- 2. Page 2 Maritime Industry History To transport the capacity of a large container ship you would need: ► 1,100 airplanes ► 35 trains ► 11,400 trucks ► Cargo ships have been used to transport commodities for over 3,000 years!!! ► 90% of world trade is carried by the maritime industry, a capacity increase of almost 20,000% in just 59 years
- 3. Page 3 “A ship in harbor is safe, but that is not what ships are built for” Grace Murray Hopper, pioneering computer scientist and U.S. Navy Rear Admiral
- 5. Page 5 Maritime systems vulnerabilities Vulnerable on-board systems include ► Propulsion and engine controls (ICS, SCADA, Remote management) ► Cargo management (RFID, Tracking systems) ► Navigation and positioning systems (AIS GPS, ECDIS) ► Communication systems (NavTex, VSAT, WII, Email, VoIP) ► Crew and passenger management and welfare systems ► Alarm and access control systems ► Cargo management systems (RFID, Tracking systems, inspection systems) ► Cargo handling systems (ICS, SCADA) ► Ground systems for vessels (Mooring, tracking, maintenance) ► Alarm and access control systems ► Passenger management systems ► Personnel and stevedore management systems ► Corporate IT systems (Email, intranet…) Vulnerable port systems include
- 6. Page 6 Maritime cyber attacks People Propulsion Cargo Systems Navigation systems On shore systems On board (ship) systems Attack Surface Maritime cyber attacks Cyber-attack on the Islamic Republic of Iran Shipping Lines – The attacks damaged all the data related to rates, loading, cargo number, date and place resulting in severe financial losses. APT attacks on Japanese and South Korean maritime and shipbuilding groups Malware was uploaded into the main computing system of the MODUFirst case of ghost shipping - Drug traffickers hacked into the computer controlling shipping containers at the port of Antwerp Multiple ransomware cases in the Greek market
- 7. Page 7 The cyber attack Maersk Imagine a company where a ship with 20,000 containers would enter a port every 15 minutes, and for ten days you have no IT MAERSK, 2017 ► Hit by the malware NotPetya ► 76 port terminals closed around the world Cost to the business USD $300m ► They went back to basics and did everything on paper
- 8. Page 8 The cyber attack Limassol - Cyprus Shipping Company - Cyprus, 2015 ► August 2015, received an email purportedly from their fuel supplier in Africa, requesting money owed be paid to a different account than usual ► Shipping company complied, paid roughly $644,000 ► Later received email from fuel company asking for payment ► Cyber crime (Interpol) has traced the money in Poland
- 9. Page 9 The cyber attack Houston – Oil rig Oil rig stability/security – Houston, 2013 ► Hackers seized command of the petrochemical plant’s computerized control-and-safety system ► Infiltrated the safety system’s firmware and inserted a ‘Remote Access Trojan’ (RAT) which allowed them to go inside the computer system and issue instructions via a hidden, electronic “back door” ► Malicious software unintentionally downloaded by offshore oil workers through laptops and USB drives, from online sources through satellite (pornography, music piracy)
- 10. Page 10 The cyber attack Port of Antwerp - Brussels Port of Antwerp – Brussels, 2013 ► Hackers working with a drug- smuggling gang repeatedly breached digital tracking systems to locate containers holding large quantities of drugs ► Sneaked hackers into the docks' offices and fitted special key-logging devices onto computer terminals ► They then dispatched their own drivers to retrieve the containers ahead of the scheduled collection time. The scam has echoes of a plot in the hit US crime thriller, The Wire, in which a drug smuggling gang at a port in the city of Baltimore hire corrupt dockworkers to alter the computer records of containers with drugs planted in them.
- 11. Page 11 Global Information Security Survey Maritime industry ► Careless or unaware employees ► Outdated information security controls or architecture ► Unauthorized access ► Malware ► Cyber-attacks to steal financial information ► Phishing What are your prorities? 1 Cyber Resilience 2 Data leakage / data loss prevention 3Security awareness Top Threats Top Vulns Source: EY - Global Information Security Survey 2017-Transportation Sector results 44% of responders ► Do not have any type of SOC function ► Do not have a threat intelligence program ► Do not have or have an informal vulnerability management program 87% of board members and C-level executives have said they lack confidence in their organisation’s level of cybersecurity of responders say they need up to 50% more budget 86% of responders have had a recent cybersecurity incident 57%
- 12. Page 12 Global Information Security Survey Maritime industry ► Ports, vessels and infrastructure becoming increasingly connected
- 13. Page 13 Going forward Enterprise strategy Incubation and innovation Continuous Experience Implementati on Operations Grow Optimise Trust Protect In order to make this performance breakthrough, companies need to reinvent themselves in five capability areas
- 14. Page 14 Cyber defence Cyber security transformation Security architecture Change programmes Identity & access management Education & awareness Cloud / digital / mobile Cyber exercises Application security Penetration testing Technical security modules Incident response
- 15. Page 15 EU Cyber Security Strategy (COM) eIDAs Directive – article 19 EU Cloud Computing Strategy and Partnership (COM) Telecom Package – article 13 a, art. 4 ENISA II – new mandate The NIS Directive EU’s CIIP action plan General Data Protection Regulation (GDPR) Digital Single Market Strategy (DSM) cPPP
- 16. Page 16 Emerging technologies What to expect? ► IoT applications that improves the safety of ship operations and improves crew well-being - applied to smart ships by 2019 ► Block chain technology to improve operations in the global supply chain by increasing data and information sharing (e.g. smart contracts, increase security, cost saving, full transparency, etc.) - joint venture between EY and Guardtime ► Crewless ships that will be computer controlled vessels by 2020. Safer, cheaper and less polluting ► R&D projects will include a new marine fleet management center to allow remote monitoring and data analysis ► Big Data on fuel consumption, navigational information, system performance, optimization
- 17. Page 17 Thank you Q & A Fotis.Sofronis@gr.ey.com gr.linkedin.com/in/fsofronis
- 18. EY | Assurance | Tax | Transactions | Advisory About EY EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities. EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com. About EY's Advisory Services In a world of unprecedented change, EY Advisory believes a better working world means solving big, complex industry issues and capitalizing on opportunities to help deliver outcomes that grow, optimize and protect clients’ businesses. From C-suite and functional leaders of Fortune 100 multinationals to disruptive innovators and emerging market small and medium sized enterprises, EY Advisory teams with clients — from strategy through execution — to help them design better outcomes and deliver long- lasting results. A global mindset, diversity and collaborative culture inspires EY consultants to ask better questions. They work with the client, as well as an ecosystem of internal and external experts, to co-create more innovative answers. Together, EY helps clients’ businesses work better. The better the question. The better the answer. The better the world works. © 2015 EY All Rights Reserved.
Editor's Notes
- Ports increasingly rely on communications systems to keep operations running smoothly, and any IT glitches can create major disruptions for complex logistic supply chains. Ships do not usually have the luxury of 50+Mb broadband: many share a single 64Kb Inmarsat connection between a number of onboard systems. This means that in the event of attack or infection, any files required to rebuild or repair an onboard PC-based system must be on the ship already, rather than having to be downloaded (something that could take a day using Inmarsat). Most vessels currently do not have operating system disks on board, let alone proprietary software, drivers or patches. This connectivity constraint also provides a single point of failure and vulnerability. Maritime Industry is based on IT solutions with global interfaces to improve efficiency and international networking. Technical dimensions of shipping and of ships themselves are not depending on technology only for communication purposes. The progress of information technologies will definitely proceed and as a logical consequence, turn into complex risk scenarios which current Ports increasingly rely on communications systems to keep operations running smoothly, and any IT glitches can create major disruptions for complex logistic supply chains. Ships do not usually have the luxury of 50+Mb broadband: many share a single 64Kb Inmarsat connection between a number of onboard systems. This means that in the event of attack or infection, any files required to rebuild or repair an onboard PC-based system must be on the ship already, rather than having to be downloaded (something that could take a day using Inmarsat). Most vessels currently do not have operating system disks on board, let alone proprietary software, drivers or patches. This connectivity constraint also provides a single point of failure and vulnerability.
- Cyber threat actors Hactivism: promote a political agenda or a social change Cyber terrorism: the politically motivated use of computers and information technology to cause severe disruption or widespread fear
- Much of that is due to laxity in security practices. Ninety-nine percent of successful attacks on maritime system are through known but unpatched system vulnerabilities. Security is often limited to protecting system perimeters, with thought rarely given to detecting intruders who have penetrated the perimeter or stopping them from penetrating further. Σύστημα πρόωσης
- Much of that is due to laxity in security practices. Ninety-nine percent of successful attacks on maritime system are through known but unpatched system vulnerabilities. Security is often limited to protecting system perimeters, with thought rarely given to detecting intruders who have penetrated the perimeter or stopping them from penetrating further. There were no indications that GPS and other electronic navigation aids were affected by this week’s attack, but security specialists say such systems are vulnerable to signal loss from deliberate jamming by hackers. Last year, South Korea said hundreds of fishing vessels had returned early to port after its GPS signals were jammed by North Korea, which denied responsibility. Icefog: Kaspersky revealed virus from 2001 to 2013 on Japanese and Korean Assets. Targets of the phishing included “governmental institutions, military contractors, maritime and shipbuilding groups, telecom operators, industrial and high-tech companies and mass media Ghost Shipping: Between 2011 and 2013, Dutch drug traffickers employed computer savvy counterparts to hide cocaine inside containers enroute to the Port of Antwerp by infiltrating networks responsible for managing what was inside each TEU.47 According to CyberKeel, the hackers were able “to have remote access to the terminal systems, and thereby they [drug traffickers] were able to release containers to their own truckers without knowledge of the port or the shipping line.” Mobile offshore drilling units: In 2013, while drilling in the Gulf of Mexico, workers from a U.S.-based oil company accidently uploaded malware onto the main computing system of the MODU. The effects of this attack paralyzed the rig, particularly from communicating with the rig’s navigation system
- The cyber attack was among the biggest-ever disruptions to hit global shipping. Several port terminals run by a Maersk division, including in the United States, India, Spain, the Netherlands, were still struggling to revert to normal operations on Thursday after experiencing massive disruptions. In an example of the turmoil that ensued, the unloading of vessels at the group’s Tacoma terminal was severely slowed on Tuesday and Wednesday, said Dean McGrath, president of the International Longshore and Warehouse Union Local 23 there. The terminal is a key supply line for the delivery of domestic goods such as milk and groceries and construction materials to Anchorage, Alaska. “They went back to basics and did everything on paper,” McGrath said.
- Impersonate seller, send emails requesting payment be made to a different account = funds sent into scammer’s account
- However, whilst the maritime industry might not seem a likely target, reports of successful cyber-attacks are not unknown. Take, for example, the Port of Antwerp, where hackers working with a drug-smuggling gang repeatedly breached digital tracking systems to locate containers holding large quantities of drugs. They then dispatched their own drivers to retrieve the containers ahead of the scheduled collection time.
- Cyber Resilience (ελαστικότητα) Cybersecurity refers to your methods and processes of protecting electronic data, including identifying it and where it resides, and implementing technology and business practices that will protect it. Cyber Resilience you can think of it as your organization’s ability to withstand or quickly recover from cyber events that disrupt usual business operations
- Security Architecture: Implement robust security frameworks Build and manage secure systems. Develop a security architecture framework for current, intermediate and target architectures. Security solutions, that meet business needs. Assess your security architecture against good practice, internal policies and industry peers. Change Programs: Improved processes, measures, indicators and controls that will protect people, property, technology, data and supply chains. Tailored around requirements, combining technical and industry experience. Focussed on most critical improvement areas and to identify where to invest. Deliver and implementing the organisational and operational change required. IAM: IAM maturity, and provide analysis on your process documentation. Latest trends and technologies, regulations, and best practice. Technical planning of an IAM program Education services allow clients to become more proficient in the use of IAM toolsets. Define and review IAM strategies and roadmaps. Education and Awareness: Awareness and technical training Build a capability framework to identify skills landscape and potential gaps. Establish a staff training program and develop a method for testing employees knowledge. Produce security policies Run external courses for your company. Cloud and Digital Mobile Manage use of the cloud, whether that be handling privacy risks or transforming your records management processes. Secure and transition to a cloud based solution. Compliance with multiple jurisdictions and data protection laws for global organisations. Manage digital risk and get the most out of transferring to the cloud. Achieve security from new technologies such as mobile banking and social media. Cyber Exercises: Cyber attacks based on a range of scenarios. Security policies, staffs security skills, your managements response, and help you deal with media interest and enquiries. Red-teaming activities can be performed to measure response to a real-life attack systems. Establish areas for improvement that have been confirmed through simulated real-life situations. Application Security Test and assess the security of an organisations web applications, mobile applications, cloud based applications, and bespoke client-server applications. Define an application assurance policy, and establish an application inventory. Identify mitigating controls, plan a remediation policy, implement the mitigating controls, and re-scan applications. Penetration Testing Provide independent and objective assessment of an organisations technology systems and infrastructure. Identify security risks associated with an organisations infrastructure in order to prioritise mitigation steps. Test an organisations authentication, configuration, web based services, firewalls and session management. Asset discovery, penetration testing, configuration reviews, and code reviews. Skilled testers enable to perform 24/7, follow-the-sun, off and on-site penetration testing. Incident Response Define, design and implement security architecture strategies, frameworks and processes, and end-to-end security solutions. Develop current, intermediate and target reference security architectures. Measure the maturity of your security architecture. Perform Incident Response activities in the event that your organisation suffers a breach or a security incident.