MASS UK Industry Conduct Principles and Code of Practice 2022 (V6)

n Negatively affect the reputation and credibility of organisations and individuals.
n Take control of a system or asset
n Access other people’s accounts
n Conduct Industrial espionage
n Initiate Government instability prior to an overthrow
5.9 CYBER SECURITY
5.9.1 Cyber security is a process used to control and protect an organisation’s computer systems, networks, and data
from, and reduce the risk of, Cyberattack.
5.7.2 A Cybercriminal could be an individual working alone or a group of people acting together such as:
n An organised crime gang
n A competitor organisation
n A foreign government (or department of)
5.7.3 The list of potential Cybercrimes is huge but commonly used methods include:
n Targeting disgruntled former employee, current employees, contractors
n Phishing emails- attempting to gain access to credentials
n Social Engineering
n Loss or theft of equipment and rogue USB Devices
n Password guessing through Brute-Force attack
n Unchanged default credentials, weak passwords on web, application or network devices (Particularly IoT devices)
n Systems and Application Vulnerabilities (updated and poorly patched software)
n SQL injection through entry field of websites/ browsers
n Cross-Site scripting (XSS)
n Passwords or data lacking strong cyphers or encryption
n Distributed denial of service (DDoS) Botnets
5.9.2 Cyber security's core function is to protect the devices we use (smartphones, laptops, tablets, computers, network
and routers), data and the services we access - both online and at work - from theft, damage or unauthorised
access.
5.9.3 The traditional approach to cyber security focuses on the protection of data and controlling access to the IT
systems components. Advanced technology such as “smart” equipment and the Internet of Things (IoT) have
changed how IT is integrated into systems and is deployed and operated. These new systems, which are
complicated, connected and can generate large amounts of data now demand a much more comprehensive
cyber security approach. It is no longer sufficient for a cyber security system to consider just the IT system; it
must also take account of the operational technology (OT) system. This is generally referred to as IT/OT
convergence.
5.10 IT/OT CONVERGENCE
5.10.1 IT/OT convergence is the integration of information technology (IT) systems with operational technology (OT)
systems. IT systems are used for data-centric computing; OT systems monitor events, processes and devices,
and make adjustments in enterprise and industrial operations.
5.8 THREAT/ATTACK VECTORS
5.8.1 Cybercriminals will investigate a target and determine which threat/attack vector to employ depending on their
findings.
Figure 5-1 Typical threat/attack vectors (Courtesy of Threat Vector Security)
5.11 THE DIFFERENCE BETWEEN IT AND OT
5.11.1 Traditional IT cyber security protects the IT system and data held in it but OT cyber security protects the complete
system (vessel, people and environment).
5.11.2 The traditional, IT based, definition of cyber security can be stated as: “Technologies, processes, and practices
designed to prevent malware from doing damage or harm to networks, computers, programs, or data.”
5.11.3 But modern, distributed, interconnected remote systems demand a more comprehensive and robust OT based
cyber security system which can be defined as:
n Technologies, processes, and practices designed to prevent the intended or unintended use of a cyber
technology system to do damage to the cyber technology (networks, computers, programs, data), and vessel
or harm to people, and environment.”
5.11.4 To achieve this level of protection we need to be able to verify the satisfactory performance of the OT cyber
security system by:
n Ensuring correct, safe, efficient and reliable operation through Software quality engineering.
n Preventing malicious and non-malicious threats through the cyber security system.
5.11.5 Functional testing will help assess a system against “known” errors or threats but makes no allowance for, as
yet, unknown events. Using a maturity model provides ongoing monitoring, assessment and improvement to a
cyber security system and will help defend against these unknown events.
40
MASS UK Industry Conduct Principles and Code of Practice Version 6
MASS UK Industry Conduct Principles and Code of Practice Version 6 41