DCN AUGUST Edition 2019

MARITIME CYBERSECURITY
Published data over recent years suggests that these direct and
indirect costs of a significant hacking event can be in the millions
of dollars.
Organisations also need to appreciate that where there has been,
or there is suspected to have been, unauthorised access to their
system, then the NDB scheme and foreign equivalents may apply
even where personal information does not appear to be the primary
target of the event.
NDB SCHEME
In May this year, the Office of the Australian Information
Commissioner released a report reviewing the first 12 months
in the life of the NDB scheme which provided some compelling
insights into the rising risk of cyber security threats, and some
important lessons for organisations.
The OAIC has reported there were 964 eligible data breaches in
that period, the vast majority of which were relatively small events,
where affected individuals numbered less than 1000 (83%). Of the
eligible data breaches, 60% were of a malicious nature and 35%
were attributed to human error (the remaining 5% being attributed
to system faults). The vast majority of the malicious events involved
compromised or stolen credentials, enabling third parties to access
email accounts or systems.
VALUABLE LESSONS
There are some valuable lessons that can be drawn from those
statistics. Firstly, over a third of all incidents are the result of
human error, and human error can be reduced by appropriate
training and employee guidelines. Ensuring employees follow IT
security procedures, and providing comprehensive training will go
a long way to reducing that risk.
Similarly, the prevalence of incidents arising from stolen
credentials is a lesson in the importance of adopting simple but
effective IT security procedures for staff – regularly changing
passwords and dual-factor authentication would have prevented
many of the reported incidents, we suspect.
More targeted and sophisticated attacks will remain a risk, and
appropriate level of cyber resilience (including a properly prepared
data breach response plan and cyber insurance should be in place
to manage and respond to such risks), but the starting point should
be employee engagement and training.
The best cyber resilience practices start with all employees
understanding that their inadvertent actions, like clicking on a
bogus link or responding to a fake email, are the greatest risk to
your business.
Matt Ellis, insurance partner and
co-head of Norton Rose Fulbright’s
cyber insurance and incident
response practice in Australia
Global shipping makes
the connection on
cybersecurity
Whether in pursuit of personal data or money,
cybercrime is now a big and highly automated
business, ready to strike at the most vulnerable
part of an organisation’s defences 24/7, writes
Inmarsat’s Peter Broadhurst
Speaking on a panel at the World Economic Forum earlier
this year, A.P. Møller-Maersk chairman Jim Hagemann Snabe
revealed that responding to the NotPetya ransomware attack of
June 2017 had required the reinstallation of 4000 new servers,
45,000 new PCs, and 2500 applications, all within ten days.
During this period, the company reverted to manual systems.
In hitting a company equipped with experienced cybersecurity
specialists, NotPetya showed the cyber threat is as real for
shipping as it is for any other connected business, especially
where legacy systems proliferate.
THE STATE OF IOT-BASED SOLUTIONS
If the warning should be sinking in, an Inmarsat research
program report, The Industrial IoT on land and at sea suggests
maritime minds are slow to change. The unique study drew
on testimony from 750 survey respondents across a range of
industries to establish preparedness and perceptions regarding
the adoption of IoT-based solutions.
The survey found 87% of maritime respondents saying they
believed their cybersecurity arrangements could be improved. It
also saw more of them identifying data storage methods (55%),
poor network security (50%) and potential mishandling/misuse
of data (44%) as likely to lead to breaches in cybersecurity than
outright cyberattack (39%).
Given the self-diagnosis, it is perhaps surprising to find just
25% of maritime respondents said they were working on new IoTbased
security policies.
In fact, Inmarsat’s research exposed ambivalence as one of
shipping’s leading feelings towards IoT-based solutions. With
some owners engaging at the level of blockchain, others take
their lead from their need to comply with regulation: this is
an industry which simultaneously sustains just over 30% of
shipping respondents as ‘IoT leaders’ and just under 30% as ‘IoT
laggards’, the report says.
For every owner signed up to the benefits of condition-based
monitoring and predictive maintenance based on real-time
connectivity, there appears to be another for whom maintenance
is something that takes place at regular and predictable intervals,
or whenever is most convenient.
Inconsistent views on cybersecurity also appear free to coexist
with immature ones. Around 70% of respondents identify
reducing marine insurance premiums as a main driver for
Norton Rose Fulbright
48 August 2019
thedcn.com.au