GNS sets out six simple steps towards cyber security at sea
Applying the concept of a layered defence with independent but complementary measures can help to create a robust, cyber-resilient systems.
GNS has released a set of six practical steps that shipowners, managers and operators can use to build cyber resilience at sea.
Prompted by the recent widely-publicised, ransomware attack that affected over 200,000 computers in 150 countries GNS cyber security specialist Ian Millen has assembled a programme of layered defences that can be used to increase awareness and improve operational practices among crew.
“Whilst individual companies and vessels have their own policies and procedures to guard against the negative effects of cyber attacks, there are some simple measures that all can take.” said Millen. “One of the most effective approaches in risk prevention is the concept of layered defence. In other words, an approach that relies upon a number of independent but complementary measures that work together to defend against the threat.”
Each one of the layers plays its own individual part in protecting against cyber threats, but the combination of measures makes life even more difficult for those that threaten the integrity of information technology and other systems.
- Promote cyber security awareness for everyone.
Cyber security, like first aid, firefighting or watertight integrity is everyone’s responsibility – a whole ship activity. Simple measures, employed by all can go a long way to preventing costly, and sometimes dangerous, cyber security problems.
- Control access – physically and through strong passwords.
Controlled access to IT systems, supported by policies and processes, ensures that they are only used by those authorised to use them, for the purposes they are intended, in a way that they should be used.
- Back up data – in more than one place.
Backing up critical data prevents its loss and puts it beyond the reach of cyber criminal ransomware. If you have accessible copies of your data in different locations, you turn a catastrophe into an inconvenience.
- Always use a firewall as an outer layer of defence.
Firewalls can be used to decide whether to allow or block traffic and often represent the first line of technological defence, providing a hardware or software barrier between secured and controlled networks and untrusted outside networks such as the internet.
- Keep your systems and software up to date.
Modern business software and anti-virus programs feature regular updates which should always be downloaded and run – they are useless if not implemented – and can be set to ‘auto-update’ on trusted systems.
- Think before you click. Does it look right?
The ‘WannaCry’ ransomware attack demonstrates the need to think twice before clicking on anything that is not familiar. If it doesn’t look right, don’t click on it and seek advice from an IT professional or delete it.
“Some people will argue that there is no such thing as 100% cyber security, as criminals will continue to develop new threats, while others try to stay one step ahead with technology and processes to prevent and defeat their malicious activities,” added Millen. “That said, there are many simple steps that can significantly reduce the risk of suffering at the hands of a cyber attack or of recovering quickly afterwards. The ‘six simple steps’ above are not the whole story, but are a very good place to start.”