Cyber Security Management Report: Shipping Industry Challenges

This report delves into the critical aspects of cyber security management within the shipping industry, addressing the growing threats and challenges posed by digitalization and interconnected systems. It begins with an overview of the IT environment in modern shipping, highlighting the integration of technology and the resulting vulnerabilities. The report then explores the NIST framework for cyber security, emphasizing its role in managing and expressing cyber security risks. A significant portion is dedicated to cyber security management, including planning, risk assessment, and mitigation strategies. Key network security issues, such as cyber-attacks, DoS attacks, phishing, and cloud attacks, are examined in detail. The report proposes a seven-layer network security model to address these issues. Finally, the report concludes with recommendations for enhancing cyber security in the shipping industry, ensuring the protection of data, systems, and operations. The report also highlights the significance of proactive measures and continuous monitoring to safeguard against evolving threats.

Running head: CYBER SECURITY MANAGEMENT
Cyber Security management
Name of the Student
Name of the University
Author’s Note

2
CYBER SECURITY MANAGEMENT
Table of Contents
Introduction......................................................................................................................................3
Description of IT environment........................................................................................................3
NIST framework..........................................................................................................................4
Cyber Security Management...........................................................................................................4
Network Security issues..................................................................................................................7
Network Security Model................................................................................................................10
Conclusion.....................................................................................................................................14
Recommendations..........................................................................................................................14
References......................................................................................................................................16

3
CYBER SECURITY MANAGEMENT
Introduction
Cyber security has been an important for the application of information technology in
various fields. Different cyber rusks and threats are prevailing in the marmite with the
implementation of information technology. In the shipping industry, information technology has
played an important role in providing a quality transportation services. Modern technology have
helped in creating digitalized ships and increase in the exchange of data and information.
However, this have increased in cyber-attacks and variety of threats in the internet. The Cyprus
Shipping Chamber has been facing various IT security risks and threats due to the
implementation of the digitalization and information technology. This report has focused on the
cyber security issues in the shipping industry. This report outlines about the different strategy
for mitigating these issues related to the cyber issues in the shipping industry.
Description of IT environment
In the modern world, ships have been integrated with information technology and relying
in integration, digitalization and automation. These advancement in the shipping industry have
been helping in providing a keen approach towards the benefits and quality transportation
through water. However, this integration system has been increasing the accessibility of the ships
for transportation (Bonaci et al. 2015). The safety, environmental and commercial consequences
of the cyber security issues have been significantly affecting the shipping industry. The response
to increasing cyber threat have been supported with various group of stakeholders in the
companies. The stakeholders are responsible for maintaining the cyber threats included in
shipping industry. The use of various information technology at different parts of the ship have
been helping in different ways for providing a better (Bush et al. 2015). This case study has been

4
CYBER SECURITY MANAGEMENT
showing a real scenario of the implementation of information technology at various parts of the
shipping industry. With the implementation of the I technology in the shipping industry. The
cyber threats have been creating several issues in the shipping industry. Risks involved in the
shipping us dustsr have been identified in order to mitigate issues in the shipping industry.
The International Maritime Organization (IMO) has able to develop some policies in
order to provide strategies for the development of recommendation to mitigate maritime cyber
risks. The risks management to procedure in the maritime industry have been initiated by this
organization that have helped a lot to reduce cyber threats in the industry (Thakur et Al. 2015).
Cyber security has been a major threat to the shipping industry. The information technology
have helped in storing data and information of the persons on the shop and others staffs.
Therefore, this data an information is important for the shipping company as the ship will be in
the middle of the sea. The security of the ship and staffs on the ship have been dependent of the
data and information. The use of the information technology have helped in storing data and
information over the cloud and online database. Therefore, it creates a huge risks for the cyber
threats and risks in shipping industry.
NIST framework
The National Institute of Standards and Technology framework has been helping in
developing guidelines for providing security to data and information. The NIST focuses in the
understanding, managing and expressing cyber security of data and information both externally
and internally (Glantz et al. 2014). The stakeholders of the organization have been responsible
for the security of the data and information in the market. The use of the NIST help in providing
actions in reducing cyber security risks. Therefore, it helps in aligning policy and technological
approaches.

5
CYBER SECURITY MANAGEMENT
Cyber Security Management
Cyber security is concerned with availability and integrity of the safety of data and
information in the shipping industry. The use of the cyber security management in the
maintaining and monitoring the security risks sin the shipping industry. The use of the cyber
security management include various steps and stages that have been discussed below:
Plans and procedure
Planning helps in creating and maintaining a different approach to the security
assessment of the company. The company operates 100 ships including that include tankers,
bulkers and container ships. The company directly employ over 3000 employees in seven offices
worldwide. Therefore, it becomes difficult for the company a huge amount of data and
information. The use of the online database helps in maintaining a proper record of information
of employees (Borders, Syrowik David 2015). The cyber security has been creating threat for the
owners, stakeholders and other board of directors of the company. Therefore, cyber security has
been an important topic for the company to secure their data and information from the hackers.
Company employees, port agents, service vendors, equipment manufacturers, and
crewing services do introduce a significant cyber security risk for a ship’s commercial operations
due to the large number of persons routinely visiting the ship or joining as crew (Amini et al.
2015). These ship visitors are often routine in nature and are left minimally monitored while they
complete their tasks onboard. There is no company cybersecurity policy in place for ship related
services that use the ships network. Therefore, there is a requirement to identify major risks
involved in the shipping industry related to the cyber security.

6
CYBER SECURITY MANAGEMENT
The company is currently undergoing to through a transition from the current fleet broadband
communication systems to a higher broadband capable VSAT system. This change in the system
might help in maintaining and monitoring cyber security of the ship (Malhotra 2015). The rapid
development in the maritime industry have been depending in the satellite communication
coverage. Therefore, this might help in connecting directly to the receiver section of the ships.
Ships are no longer protected by an air-gap from external systems. Today, an estimated 30,000
vessels globally have equipment providing them with constant internet access, which is an
increase from only 6,000 in 2008. However, cyber security focuses on the security of the
networks and information stired in the ship database (Hong et al. 2015). The communication
process in the ship depends on the satellite communication. Therefore, there is a chanced of
tracking and intercepting the data and information during communication.
This might create an issue and loss to the company. The security of the ships in mid ocean
becomes difficult (Carr 2016). The VSAT broadband ability of different ships have been
maintaining internet connection in the ships. The use of internet connection in the shop might
help in providing a various tendency to improve communication in the ship. Various malwares
attacks are the main threat to the ship. The communication in the ship might get hampered by
the malware attack in the network (Conti, M., Dargahi and Dehghantanha 2018). However, the
Board of Directors has helped in maintaining the cyber security of the network. Therefore, cyber
risk management include following data and information:
 It helps in identifying the roles and responsibilities of users, key personnel and managing
bith on shore and abroad.
 It helps in identifying assets and systems with proper assets and capabilities that might
create risks for the operations of ships and safety.

7
CYBER SECURITY MANAGEMENT
 It helps in implementing technical measures for protecting against a cyber-incident for
ensuring continuity of operations. This may include training and awareness, software
maintenance, remote and local access, access privileges, use of removable media and
equipment disposal.
 It helps in implementing activities for preparing and responding to the cyber problems.
Network Security issues
There are various network issues can be identified in the organization:
Cyber-attacks
Cyber attacks have been the most widely recognized dangers in the system of the
organization. There are different instances of Cyber attacks in the association. Different
destructive infections and malwares can attack the system server of the organization and cause
Cyber attacks (Perlman, Kaufman and Speciner, 2016).
Figure 1: Attack techniques

8
CYBER SECURITY MANAGEMENT
(Source: Perlman, Kaufman and Speciner, 2016)
DoS attack
A denial of service attack is an attack that arrangements with closing down of system
server o the organization. This attack may shut down a machine or a server for all time by
harming the web design. It centers in the private information and data of the association in the
market. This may diminish mark estimation of the organization in the market (Kizza, 2017).
Figure 2: DoS attack
(Source: Kizza, 2017)
Phishing
This attack focuses on the individual data of the clients including the username,
passwords, managing an account data and other individual data. This attack is basically finished
with the assistance of spam messages that are sent to the clients. At the point when the clients
open that spam mail. All the login qualifications are sent to the programmers (Acemoglu,

9
CYBER SECURITY MANAGEMENT
Malekian and Ozdaglar, 2016). This can be a hazardous or the organization, as there are various
sends are gotten on their mail id.
Figure 3: Phishing attack
(Source: Acemoglu, Malekian and Ozdaglar, 2016)
Cloud attacks
Cloud computing have been a developing innovation everywhere throughout the world.
By and large, the greater part of the organization are keeping up and putting away their
information over the cloud. In this way, different programmers that have focusing on cloud for
breaking out information and data (Beberlein et al., 2017). The attacks in the cloud have been an
incredible effect in the advancement of the organization. Cloud attacks have been regular over
the web as the vast majority of the organizations are accessible in the cloud.

10
CYBER SECURITY MANAGEMENT
Figure 4: Cloud attacks
(Source: Beberlein et al., 2017)
Network Security Model
The proposed arrange security show is of seven layers that aides in partitioning the
assignment in the system framework. This model has been a nonspecific model and can be
pertinent to various security gadgets. The seven layers of the system security show incorporate
Physical, VLAN, ACL, Software, client, Administrative and IT Department.
Physical layer
The physical layer centers in the security of the system at physical level. It can be
actualized to the physical security for keeping them from getting to an office to pick up put away
on PCs and servers. Clients get associated with the frameworks through physical layer. Be that as
it may, physical layer has been the most effortless layer in the model (Frigault et al., 2017).
VLAN
The VLAN layer alludes to the support and making of the virtual neighborhood. The
VLAN help in keeping up the security of different frameworks associated together. These

11
CYBER SECURITY MANAGEMENT
associated PCs and different gadgets get attacked by various infections and interlopers for
rupturing out information and data from the system. The VLAN deals with general society and
private system (Knapp and Langill, 2014). VLAN helps in making an ensuring over the systems
that aides in shielding them from outer interlopers in the system.
ACL Layer
The Access Control Lists or ACL is security convention introduced in switches and
firewalls. This aides in permitting and denying a specific demand on various servers and hosts.
Client can put a solid access control records to confines a portion of the sites and servers to be
gotten to from the gadget. This aides in limiting the passage of hurtful components in the
systems (Larson et al., 2016). This layer helps in giving security of the product utilized as a part
of the framework. It ensures the area controller that aides in keeping up the security of the space
names of different server over the system.
Programming layer
The product layer has been concentrating on the refreshing programming introduced in
the gadget. Redesigned patches encourages in giving security to the new dangers over the web.
The utilization of the product layer helps in keeping up the propelled rendition of different
programming that expands productivity of the gadget utilized as a part of the system (Kizza,
2017). In the event that a host is legitimately refreshed and fixed accurately, a client layer attack
can be confined in the system.
Client Layer
The client layer have concentrated on the preparation and information of the client over
the security in the system. The client needs to comprehend the back idea of the system security

12
CYBER SECURITY MANAGEMENT
over the web. The learning and preparing over the system security helps in limiting the dangers
and dangers over the system. The client has to think about the vulnerabilities that can be
executed on the system (Acemoglu, Malekian and Ozdaglar, 2016). A system security expert
may help in giving preparing and information about system security issues.
Managerial Layer
The managerial layer centers around the preparation and inspiration of the regulatory clients.
This layer incorporate every one of the individuals from administration. In this way, the
managerial clients should be taught with the learning of system security and attempt to
distinguish issue in the system of the association.
IT Department layer
The IT division layer contains all system security experts including professionals,
modelers and bolster authorities. The IT division layer have the entrance to peruse and compose
any information and data from organize (Knapp and Langill, 2014). This aides in getting to the
security conventions of the system. Its nonappearance office layer stick make chances in the
system identified with the money related loss of the organization in the market. These headway
in the delivery business have been helping in giving a sharp approach towards the advantages
and quality transportation through water. Nonetheless, this mix framework has been expanding
the openness of the boats for transportation. The wellbeing, ecological and business outcomes of
the digital security issues have been fundamentally influencing the delivery business. The
reaction to expanding digital danger have been upheld with different gathering of partners in the
organizations. The partners are in charge of keeping up the digital dangers incorporated into
transportation industry. The utilization of different data innovation at various parts of the ship

13
CYBER SECURITY MANAGEMENT
have been helping in various routes for giving a superior. This contextual analysis has been
demonstrating a genuine situation of the execution of data innovation at different parts of the
transportation business. With the usage of the I innovation in the transportation business. The
digital dangers have been making a few issues in the delivery business. Dangers engaged with
the shipping have been distinguished so as to relieve issues in the delivery business. The
International Maritime Organization (IMO) has ready to build up a few approaches with a
specific end goal to give techniques to the improvement of proposal to alleviate oceanic digital
dangers. The dangers administration to strategy in the sea business have been started by this
association that have helped a considerable measure to diminish digital dangers in the business.
Digital security has been a noteworthy danger to the delivery business. The data innovation have
helped in putting away information and data of the people on the shop and others staffs.
Subsequently, this information a data is critical for the transportation organization as the ship
will be amidst the ocean. The security of the ship and staffs on the ship have been reliant of the
information and data. The utilization of the data innovation have helped in putting away
information and data over the cloud and online database. Subsequently, it makes a tremendous
dangers for the digital dangers and dangers in transportation industry.

14
CYBER SECURITY MANAGEMENT
Conclusion
It can be concluded that cyber security has been an important part for shipping industry.
The use of cyber security in the shipping industry has been creating problems for maintaining
network system in the ship. Various cyber threats have been discussed in the report that might
help in identifying the rims and cyber threats in the shipping industry. The use of various cases in
the shipping industry have been discussed in the report. The support of stakeholders in
maintaining cyber security in the shipping industry have been discussed in the report. The use of
various strategies for mitigating these issues have been explained in the report. Different cyber
security to threats and risks are discussed properly. These threats have been helping in creating
strategies for mitigating them. A network security model have been proposed for mitigating the
network issues and communications. There are few recommendations provided in the end of the
report for mitigating the cyber threats and risks involved in the shipping industry.
Recommendations
There are some recommendations for maintaining and mitigating the cyber issues in the
shipping industry. Some of them are as follows:
Firewalls: Firewalls are the tools that help in restricting harmful viruses and malwares
form entering into the network of the system. Firewall creates virtual wall around the system
that restricts harmful viruses and allows only limited important information that stored in the
system. The use if the updated firewall helps in detecting the viruses in the network system. The
use of updated firewalls helps in maintaining the security of the systems and networks. The use
of firewall help in maintaining the security of the system.

15
CYBER SECURITY MANAGEMENT
Antivirus: Antivirus helps in detecting viruses and malwares in the networks. The use of
various antiviruses in the networks helps in detecting and removing harmful viruses and
malwares in the networks.

16
CYBER SECURITY MANAGEMENT
References
Amini, L., Christodorescu, M., Cohen, M.A., Parthasarathy, S., Rao, J., Sailer, R., Schales, D.L.,
Venema, W.Z. and Verscheure, O., International Business Machines Corp, 2015. Adaptive
cyber-security analytics. U.S. Patent 9,032,521.
Bonaci, T., Herron, J., Yusuf, T., Yan, J., Kohno, T. and Chizeck, H.J., 2015. To make a robot
secure: An experimental analysis of cyber security threats against teleoperated surgical
robots. arXiv preprint arXiv:1504.04339.
Borders, K.R., Syrowik David R, 2015. Method, system and computer program product for
detecting at least one of security threats and undesirable computer files. U.S. Patent 9,055,093.
Bush, J.E., Ayyagari, A., Li, W., Lorimer, S.W., Benson, M.L., Bates, S.J. and Craig, J.A.,
Boeing Co, 2015. Methods and systems for use in identifying cyber-security threats in an
aviation platform. U.S. Patent 9,178,897.
Carr, M., 2016. Public–private partnerships in national cyber‐security strategies. International
Affairs, 92(1), pp.43-62.
Conti, M., Dargahi, T. and Dehghantanha, A., 2018. Cyber Threat Intelligence: Challenges and
Opportunities. Cyber Threat Intelligence, 70, p.1.
Glantz, C.S., Landine, G.P., Craig Jr, P.A. and Bass, R.B., 2014. Lessons Learned in Over a
Decade of Technical Support for US Nuclear Cyber Security Programmes. In International
Conference on Nuclear Security: Enhancing Global Efforts. Proceedings of the Interational
Conference.

17
CYBER SECURITY MANAGEMENT
Hong, J., Nuqui, R., Ishchenko, D., Wang, Z., Cui, T., Kondabathini, A., Coats, D. and
Kunsman, S.A., 2015. Cyber-physical security test bed: A platform for enabling collaborative
cyber defense methods. In PACWorld Americas Conference.
Malhotra, Y., 2015. Cybersecurity and Cyber-Finance Risk Management: Strategies, Tactics,
Operations, and, Intelligence: Enterprise Risk Management to Model Risk Management:
Understanding Vulnerabilities, Threats, and Risk Mitigation (Presentation Slides).
Nourian, A. and Madnick, S., 2015. A systems theoretic approach to the security threats in cyber
physical systems applied to stuxnet. IEEE Transactions on Dependable and Secure Computing.
Thakur, K., Qiu, M., Gai, K. and Ali, M.L., 2015, November. An investigation on cyber security
threats and security models. In Cyber Security and Cloud Computing (CSCloud), 2015 IEEE 2nd
International Conference on (pp. 307-311). IEEE.
Acemoglu, D., Malekian, A., and Ozdaglar, A. (2016). Network security and contagion. Journal
of Economic Theory, 166, 536-585.
Beberlein, L. T., Dias, G., Levitt, K. N., Mukherjee, B., and Wood, J. (2017). Network attacks
and an Ethernet-based network security monitor.
Chen, G., Gong, Y., Xiao, P., and Chambers, J. A. (2015). Physical layer network security in the
full-duplex relay system. IEEE transactions on information forensics and security, 10(3), 574-
583.
Frigault, M., Wang, L., Jajodia, S., and Singhal, A. (2017). Measuring the Overall Network
Security by Combining CVSS Scores Based on Attack Graphs and Bayesian Networks.
In Network Security Metrics (pp. 1-23). Springer, Cham.

18
CYBER SECURITY MANAGEMENT
Kizza, J. M. (2017). Guide to computer network security. Springer.
Knapp, E. D., and Langill, J. T. (2014). Industrial Network Security: Securing critical
infrastructure networks for smart grid, SCADA, and other Industrial Control Systems. Syngress.
Larson, V., Short III, R. D., Munger, E. C., and Williamson, M. (2016). U.S. Patent No.
9,374,346. Washington, DC: U.S. Patent and Trademark Office.
Perlman, R., Kaufman, C., and Speciner, M. (2016). Network security: private communication in
a public world. Pearson Education India.