code_of_practice_V3_2019

11.6.5 Security measures include:
n Security by design, using best practice principles;
n Use of safe operating system (or no operating system at all), as many cyber-attacks exploit the operating system
itself;
n Air-gapping (denial of communications so that the firmware, once programmed, is safe). This eliminates backdoor
attacks and is effectively applied to many sensors such as GPS, heading and depth sensors;
n Command link encryption;
n Use of multiple command links, effectively providing command link backup.
n BIT testing to verify the integrity of firmware and mission and configuration data at run time.
11.6.6 A Cyber Security Analysis should be conducted to identify possible security vulnerabilities and their effects on
the vital systems and the performance of the craft or vessel, including but not limited to the command link, the
generation and dissemination of waypoints, steering, and the ability to initiate Emergency Stop.
11.6.7 The Cyber Security Analysis should be interpreted and acted upon in a manner similar to the Risk Assessment,
in terms of identifying the need to apply corrective measures to reduce risk to an acceptably low level.
Fugro FAS900
70
MASS UK Industry Conduct Principles and Code of Practice Version 3