Cyber security covers a wide range of threats and concerns, including the manipulation of digital information, whether en-route to the user or once in their system. The threat is real and concerns all of us, across all walks of life; maritime users are not exempt. Events such as jamming, spoofing, as well as illicit accessing of data and data corruption are all examples of cyber threats. Where data can be accessed by authorised personnel, the opportunity exists for criminals to access that data too. From a maritime perspective, such attacks can affect numerous aspects including the vessel's safe navigation, ship security and any commercial or confidential information. This paper will focus on safe navigation aspects and will consider data provided to and from a vessel. It aims to raise awareness of this growing problem, reporting on known incidents and identifying some of the new guidance which is being developed and published by authoritative bodies, including the International Maritime Organization (IMO). It will then consider some of the potential mitigation aspects which could be used in the future to prevent, as far as possible, the likelihood of cyber-attack. In general, the systems currently used by maritime voice and data communications are insecure, with most, if not all, data received through open and corruptible channels. Data is received and used at face value, which increases the risk of any corrupted data being trusted and applied. Such information could be secured using authentication techniques. This paper will introduce a number of potential improvements, including the potential of the new Maritime Cloud concept to add authentication. The Maritime Cloud is a system being developed to aid mariners in accessing and using e-Navigation services and should provide a structured and authenticated system for ship-to-ship, ship-to-shore and shore-to-ship communications. It aims to improve data organisation, data exchange and data security between various maritime stakeholders. It is being developed using open standards and open source software in a move to avoid the development of proprietary systems and facilitate the free flow of information. The Maritime Cloud can be divided into three core components, the 'Maritime Messaging Service' (MMS), the 'Maritime Service Registry' (MSR) and the 'Maritime Identity Registry' (MIR). This paper will review cyber security in the maritime sector and highlight key developments to date. It will outline how the MIR may use Public Key Cryptography (PKC) to authenticate or 'digitally sign' communications; this prevents the spoofing of maritime actors, such as vessel traffic services (VTS) and providers of position, navigation and timing (PNT) information, by guaranteeing that communications have originated from a specific Maritime Identity. This paper will outline how, by providing an authentication mechanism, the MIR is of key importance to the Maritime Cloud and the development of e-Navigation services. Data authentication is a critical consideration for any future maritime service to ensure the safe navigation of mariners.
展开▼
