Maritime UK MASS CoP v2

10.6.5 Security measures include:
n Security by design, using best practice principles;
n Use of safe operating system (or no operating system at all), as many cyber-attacks exploit the operating
system itself;
n Air-gapping (denial of communications so that the firmware, once programmed, is safe). This eliminates
backdoor attacks and is effectively applied to many sensors such as GPS, heading and depth sensors;
n Command link encryption;
n Use of multiple command links, effectively providing command link backup.
n BIT testing to verify the integrity of firmware and mission and configuration data at run time.
10.6.6 A Cyber Security Analysis shall be conducted to identify possible security vulnerabilities and their effects on the
vital systems and the performance of the craft or vessel, including but not limited to the command link, the
generation and dissemination of waypoints, steering, and the ability to initiate Emergency Stop.
10.6.7 The Cyber Security Analysis shall be interpreted and acted upon in a manner similar to the Risk Assessment,
in terms of identifying the need to apply corrective measures to reduce risk to an acceptably low level.
54
MASS UK Code of Practice Version 2