THIS ARTICLE/PRESS RELEASE IS PAID FOR AND PRESENTED BY NTNU Norwegian University of Science and Technology - read more
What do you do if a hacker takes over your ship?
The risk of cyber attacks against a ship is real. The working crew on board must be allowed to practice handling these risks in a realistic way. Now they can.
You’re on the bridge, with the ship’s course shown on the digital display. But why is the ship continuing to turn west?
Everything looks normal on the computer screens in the dark wheelhouse — but outside, the land is dangerously close. What’s going on?
Down in the engine room, workers report via radio that everything is normal, but they wonder why the bridge has changed course. The engines are revving and the ship is picking up speed.
The engine room hasn’t done this. What now?
Cybersecurity is a hot topic for the entire maritime industry, as well as in academia. A joint team recently conducted a completely new cyber security course at NTNU in Ålesund, Western Norway.
Probably the first of its kind
Over two months, course participants have looked at digital threats. They have assessed the risk of existing digital threats and realistically practiced a cyber attack on a ship under way.
The key focus is on risk management of cyber attacks and building resilience.
Marie Haugli-Sandvik and Erlend Erstad explain that where information technology and people meet, there is room for digital vulnerability. Security breaches can come in through the ship’s systems, through the port system, and through the people who operate or supervise them.
Both are PhD candidates at NTNU. They are studying how the maritime industry can become better equipped to handle cyber attacks.
They have developed and now run the maritime digital security course, which appears to be the first of its kind in Norway.
Developed with the industry
“We developed this course in close collaboration with the industry,” Erstad says. “We have listened to what they want, looked objectively at their needs, and then tested the best solution we can come up with.”
“It’s always better to have a broad perspective and different approaches with new projects and methods. Established businesses can also benefit from a fresh look. NTNU is a good place to try out new ideas. As researchers, we can help meet the industry’s urgent needs while at the same time discussing solutions with them for the future,” Haugli-Sandvik says.
Not enough training in cyber security
Haugli-Sandvik conducted a survey this winter among 293 deck officers from 11 major offshore shipowners in Norway.
- 83 per cent said that they had taken part in some form of cyber security training.
- 15 per cent answered that they had never received training.
- 2 per cent didn’t know if they had had training.
“82 per cent of the deck officers said that they had received the training as e-learning and/or that they had participated in digital safety campaigns sent by their employer,” she says.
To a large extent, employers were responsible for this training, in the form of courses. This demonstrates that the industry wants to take responsibility, Haugli-Sandvik believes.
But there are many standardised and general IT security courses.
“Most of the training wasn’t directly operationally oriented and/or adapted to the maritime industry,” Haugli-Sandvik says.
This is illustrated by the fact that 66 per cent of the surveyed deck officers said that they were uncertain or disagreed that they had enough training to handle a cyber incident on board.
Major consequences
Digital IT events can have consequences for ship operations. They can affect administrative systems for ship manifests, passenger lists, digital certificates and sailing licenses and the like. This can delay or impede operations.
Companies that are exposed to these problems can experience significant financial consequences and damage to their reputation.
The Norwegian National Security Authority (NSM) points out that activity in the cyber world can be so advanced that we don’t actually notice it, and covert activity can remain hidden for a long time. How should crew on board react to discover hidden threats?
How can the crew on board make the right assessments in advance or make concrete decisions in the brief window of time a few minutes before a ship runs aground?
Knowing what to do, both to prevent this from happening, and to practice what to do if it does, is critical for the industry.
Deck officers and cyber security
Haugli-Sandvik’s research looks at how deck officers experience cyber risk at sea.
Her project is part of the work of NTNU's SFI MOVE centre (Marine Operations in Virtual Environments). They work on how future maritime operations may look. They do this through the use of digital twins, machine learning, and control centres on land.
“I’m studying how targeted guidelines, training and risk communication can be developed for maritime cyber security. I am also investigating what tools we should develop to handle new cyber risks we may experience at sea,” she says.
To be resilient
Erstad, on the other hand, is looking at cyber resilience at sea.
“I’m looking at the best way that navigators can be resistant to, prepare themselves for, and overcome, cyber attacks against the integrated navigation systems on board the ship,” he says.
Erstad says the researchers have benefitted from working with researchers at the Cyber SHIP lab at the University of Plymouth in England, which also works with maritime cyber security.
To practice realistic actions and situations in a safe environment, NTNU has opened a Cyber Range. It has been developed specifically for the maritime sector.
The Cyber Range enables practitioners and researchers to uncover vulnerabilities in maritime navigation and control systems for ships.
Simulated event
The larger course exercise relied on ship simulators at NTNU in Ålesund. These simulators are also unique in their design when it comes to realism. The participants took their seats in ship simulators, designed like a bridge on a larger ship underway in the North Sea.
“We made the simulated scenario close to what actually happens on a ship, as well as to what happens in the communication between the ship and on land. But even though the scenario uses full-scale maritime bridge simulators, the focus was mostly on getting a good discussion going,” Erstad says.
The exercise also included participants from DNV, Norwegian Hull Club, NORMA Cyber, Solstad, public institutions such as the Norwegian Coastal Administration and the Inland Norway University of Applied Science, as well as from the University of Plymouth. They were invited in as observers and as resource persons in the simulation.
“We learn the most from the dialogue between the participants in the rehearsal and in the review afterwards, not least because you can then see what was practiced and the event itself from another point of view,” Erstad says.
Strengthening the weak link
Professor Kevin Jones at the University of Plymouth points out that a cyber attack can pose huge problems for the global economy and trade.
“When the large container ship Ever Given ran aground in the Suez Canal, weather and wind were blamed as the cause. Although this was not a cyber attack, the incident illustrates the consequences that can affect a vulnerable global system,” Jones says.
90 per cent of world trade is predicted to be linked to maritime transport, through maritime supply chains. It’s entirely believable that a similar incident could occur due to digital vulnerabilities, as a result of unauthorised access to computers and control systems.
“The weak link is the human being, and we have to strengthen this link. Humans are the resource on board that can handle such a situation,” Jones says.
Adapted skills development
The exercises and the specific course with the participants, helpers and observers have strengthened the two researchers’ view that it is important to adapt skills development to the precise circumstances at hand.
The course offers a clear practical approach to risk management in a digital perspective. This is also included as part of NTNU’s master’s programme in operational maritime management.
“It is important that businesses in the maritime sector familiarise themselves with their values, the digital threats and vulnerabilities they have. Managers need to know their employees will be able to handle the digital threats, and understand the needs they have for skills in working with digital security,” Jones says.
Reference:
Erstad et al. A human-centred design approach for the development and conducting of maritime cyber resilience training, WMU Journal of Maritime Affairs, 2023. DOI: 10.1007/s13437-023-00304-7
Read more content from NTNU:
-
Artificial nose can sniff out damaged fruit and spoiled meat
-
Want to be the best? It’s all in your mindset
-
Millions of Earth's species remain unknown to us. Can we still identify them?
-
AI expert: We should not have AI that exploits people's weaknesses
-
Afghanistan veterans are more prone to anger
-
Could a digital driving instructor offer the same quality as a human, but at a lower cost?
