An In-Depth Security Assessment of Maritime Container Terminal Software Systems

Abstract

Attacks on software systems occur worldwide on a daily basis targeting individuals, corporations, and governments alike. The systems that facilitate maritime shipping are at risk of serious disruptions, and these disruptions can stem from vulnerabilities in the software and processes used in these systems. These vulnerabilities leave such systems open to cyber-attack. Assessments of the security of maritime shipping systems have focused on identifying risks but have not taken the critical (and expensive) next step of actually identifying vulnerabilities present in these systems. While such risk assessments are important, they have not provided the detailed identification of security issues in the systems that control these ports and their terminals. In response, we formed a key collaboration between an experienced academic cybersecurity team and a well-known commercial software provider that manages maritime shipping. We performed an analysis of the information flow involved in the maritime shipping process, and then executed an in-depth vulnerability assessment of the software that manages freight systems. In this paper, we show the flow of information involved in the freight shipping process and explain how we performed the in-depth assessment, summarizing our findings. Like every large software system, maritime shipping systems have vulnerabilities. INDEX TERMS ICT (Information and Communications Technologies), maritime container terminals, software assurance, software security, software systems, vulnerability assessment VOLUME thevolume, theyear

The Relevance of Classic Fuzz Testing: Have We Solved This One?

“…We still too frequently find such things as not checking for return values (Section 4.2.2) and careless error handling (Section 4.2.3). These are exactly the kinds of errors that we have found in our in-depth software assessment activities [5] and that we teach about in our Introduction to Software Security course [7]. Computer science curriculums need to emphasize these practices at every level and in every area, not just in security or software engineering classes.…”

Comprehensive Analysis of Maritime Cybersecurity Landscape Based on the NIST CSF v2.0

“…With technology becoming increasingly intertwined with these operations, the associated risks are rising, necessitating a comprehensive risk assessment. Eichenhofer et al's [49] study delved deep into the importance of ICT security in the maritime industry by evaluating software vulnerabilities in commodity systems and providing detailed insights using the First Principles Vulnerability Assessment methodology. Their analysis brings out numerous significant vulnerabilities in the code, underscoring the absolute necessity for risk assessment.…”

Maritime Autonomous Surface Ships: A Review of Cybersecurity Challenges, Countermeasures, and Future Perspectives

“…This encompasses diverse cyber threats faced by MASS during open-sea navigation. Lastly, "Space Systems Cybersecurity Guidelines" [37] provide guidelines, but adapting these to MASS specifics, including its independence, communication challenges, and integration of space and sea technologies, is crucial. Existing studies contribute valuable insights into cybersecurity, autonomous systems, and maritime operations.…”