Maritime Cybersecurity. What are we missing?

In line with the European Maritime Security Strategy and its subsequent action plans, several decisions and activities have been carried out in the European Maritime Safety Agency (EMSA) that led to improving not only the internal vision on the topic but also the recognition by other members of the maritime community. EMSA works in close cooperation with the European Cybersecurity Agency (ENISA) on topics related to maritime cybersecurity. EMSA is also part of the Transport Resilience and Security Expert Group (TRANSSEC) where viewpoints and ideas on cyber security threats, challenges and solutions are exchanged. EMSA participates and facilitates the activities of other maritime cybersecurity initiatives like for example the European Coastguard Functions Forum working group on maritime cybersecurity.

EMSA Maritime Cybersecurity Task Force has conducted an analysis of the sector.  This analysis consists of a mapping exercise considering the state of the art on maritime cybersecurity in the ecosystem of ships and port facilities. The mapping exercise considered documents including European Union and MSs legislation, policies and recommendations, papers from the International Maritime Organization, Standardization bodies, Industry, Classification Societies, Insurance companies, and Academia. The result of this work provided an overall picture of the topics addressed in the area. The subsequent gap analysis anticipates information on the more relevant topics that are not being addressed.

The results and conclusions of this work show that there is room to improve maritime cybersecurity at different levels: human element (training, procedures), policies, and technical aspects. There are also challenges for the integration of cyber-risk management within existing maritime security tools. Some examples of the topics that should be considered are: cyber-risk assessment on ships and port facilities (methodology, confidentiality, integration within Ship Security Plans and Port Facility Security Plans), cybersecurity exercises as an essential tool to create awareness and to improve preparedness, information management of maritime cybersecurity incidents (reporting of cybersecurity incidents, information sharing, dissemination of best practices), cybersecurity training at all levels (crews, shore personnel, law enforcement staff, etc), technical development and design of cybersecure ship system (networks, ECDIS, GSNS), and finally, the development of cybersecure Maritime Autonomous Surface Ships (MASS).