MASS UK Industry Conduct Principles and Code of Practice 2022 (V6)

automatically. Others are testing and verifying the security configurations of implemented systems and
investigating incidences that can compromise system or network security.
5.14 CYBER GLOSSARY
https://www.open-scap.org/features/standards/
“Access control” is selective limiting of the ability and means to communicate with or otherwise interact with a system,
to use system resources to handle information, to gain knowledge of the information the system contains or to control
system components and functions.
20. ANSI
The ANSI (American National Standards Institute) framework contains standards, information, and technical
reports which outline procedures for implementing and maintaining Industrial Automation and Control Systems
(IACS). The framework applies to all organisations that implement or manage IACS systems. The framework
consists of four categories as defined by ANSI. The first category contains foundational information like security
models, terminologies, and concepts. The second category addresses the aspects involved in creating and
maintaining IACS cyber security programs. The third and fourth categories outline requirements for secure system
integration and security requirements for product development, respectively.
“Back door” is a secret method of bypassing normal authentication and verification when accessing a system. A back
door is sometimes created in hidden parts of the system itself or established by separate software.
“Bring your own device (BYOD)” allows employees to bring personally owned devices (laptops, tablets, and smart
phones) to the ship and to use those devices to access privileged information and applications for business use.
“Cyberattack” is any type of offensive manoeuvre that targets IT and OT systems, computer networks, and/or
personal computer devices and attempts to compromise, destroy or access company and ship systems and data.
https://www.ansi.org/
21. NIST SP 800-12
“Cyber incident” is an occurrence, which actually or potentially results in adverse consequences to an onboard system,
network and computer or to the information that they process, store or transmit, and which may require a response action
to mitigate the consequences.
This framework provides an overview of control and computer security within an organisation. Also, NIST SP 800-12
focuses on the different security controls an organisation can implement to achieve a strengthened cyber security
defence. Although most of the control and security requirements were designed for federal and governmental
agencies, they are highly applicable to private organisations seeking to enhance their cyber security programs. NIST
SP 800-12 enables companies to maintain policies and programs for securing sensitive IT infrastructure and data.
“Cyber risk management” means the process of identifying, analysing, assessing, and communicating a cyber-related
risk and accepting, avoiding, transferring, or mitigating it to an acceptable level by taking into consideration the costs
and benefits of actions taken by stakeholders.
“Cyber system” is any combination of facilities, equipment, personnel, procedures and communications integrated to
https://csrc.nist.gov/CSRC/media/Publications/sp/800-12/rev-1/draft/documents/sp800_12_r1_draft.pdf
provide cyber services; examples include business systems, control systems and access control systems.
22. NIST SP 800-14
“Defence in breadth” is a planned, systematic set of activities that seek to identify, manage, and reduce exploitable
vulnerabilities in IT and OT systems, networks and equipment at every stage of the system, network, or sub-component life
cycle. Onboard ships, this approach will generally focus on network design, system integration, operations and maintenance.
NIST SP 800-14 is a unique publication that provides detailed descriptions of commonly used security principles.
The publication enables organisations to understand all that needs to be included in cyber security policies. As a
result, businesses ensure to develop holistic cyber security programs and policies covering essential data and
systems. Besides, the publications outline specific measures which companies should use to strengthen already
implemented security policies. In total, the NIST SP 800-14 framework describes eight security principles with a
total of 14 cyber security practices.
“Defence in depth” is an approach which uses layers of independent technical and procedural measures to protect IT
and OT on board.
“Executable software” includes instructions for a computer to perform specified tasks according to encoded instructions.
https://ws680.nist.gov/publication/get_pdf.cfm?pub_id=890092
“Firewall” is a logical or physical break designed to prevent unauthorised access to IT infrastructure and information.
23. NIST SP 800-26
“Firmware” is software imbedded in electronic devices that provides control, monitoring and data manipulation of
engineered products and systems. These are normally self-contained and not accessible to user manipulation.
Whereas the NIST SP 800-14 framework discusses the various security principles used to secure information
and IT assets, NIST SP 800-26 provides guidelines for managing IT security. Implementing security policies alone
cannot enable a company to realise optimum cyber security since they require frequent assessments and
evaluations. For example, the publication contains descriptions for conducting risk assessments and practices
for managing identified risks. It is a highly useful framework that ensures organisations maintain effective cyber
security policies. A combination of different NIST publications can ensure businesses maintain adequate cyber
security programs.
“Flaw” is unintended functionality in software.
“Intrusion Detection System (IDS)” is a device or software application that monitors network or system activities for
malicious activities or policy violations and produces reports to a management station.
“Intrusion Prevention System (IPS”, also known as Intrusion Detection and Prevention Systems (IDPSs), are network
security appliances that monitor network and/or system activities for malicious activity.
https://csrc.nist.gov/publications/detail/sp/800-26/archive/2001-11-01
“Local Area Network (LAN)” is a computer network that interconnects computers within a limited area such as a home,
ship or office building, using network media.
52
MASS UK Industry Conduct Principles and Code of Practice Version 6
MASS UK Industry Conduct Principles and Code of Practice Version 6
53