Cyber Security

Owners and Ship Managers had till 1 January 2021 to integrate Cyber risk into their Safety Management Systems. IMO had also affirmed the inclusion of cyber risk in the ISM Code in June 2017, sending out the strongest signal yet: inaction was not an option.

For several flag states the global regulator’s recommendation amounts to making it a mandatory requirement. Almost a year later, many yachts are still lacking an appropriate manual, an updated network design and an install base. Crew members are not trained about the danger of hacking, the different hacking methods, checks and drills, nor are they made aware of the importance of having a Cyber plan, let alone an up to date one.

Management companies, Crews and Owners rely on digital, entertainment and network-based systems in their day-to-day activities on board. Furthermore, the scope of these systems has expanded from basic information management to actually controlling machinery and other on-board equipment.

The deep integration of operational and information systems adds complexity. A loss of availability to a virtual intruder, integrity and confidentiality of business processes are at risk. Cyber Risk provides an opportunity to consider the commercial and ethical reasons for losing the control of a vessel’s Information Technology (IT) and Operational Technology (OT) infrastructure. Cyber Crime is a serious business as it is hard to detect: they generally will not trigger alarms and the immediate impact will be less obvious.

Cyber Security depends on the actions and behavior of everyone involved in vessel operation, both at sea and ashore. A vessel’s captain, second officer, chief engineer and superintendent need a robust understanding of Cyber Risk and the possible consequences on vessel safety, as do its Owners, Guests and senior managers.

Risks are a fact of life! They can never be entirely eliminated. However, by taking a methodical approach to assessing and being aware of potential scenarios that might arise, we can take steps to prevent the more obvious dangers and be ready to act.

Awareness is key!