Cybersecurity risk assessment of VDR

Abstract

The voyage data recorder (VDR) is a data recording system that aims to provide all navigational, positional, communicational, sensor, control and command information for data-driven investigation of accidents onboard ships. Due to the increasing dependence on interconnected networks, cybersecurity threats are one of the most severe issues and critical problems when it comes to safeguarding sensitive information and assets. Cybersecurity issues are extremely important for the VDR, considering that modern VDRs may have internet connections for data transfer, network links to the ship's critical systems and the capacity to record potentially sensitive data. Thus, this research adopted failure modes and effects analysis (FMEA) to perform a cybersecurity risk assessment of a VDR in order to identify cyber vulnerabilities and specific cyberattacks that might be launched against the VDR. The findings of the study indicate certain cyberattacks (false information, command injection, viruses) as well as specific VDR components (data acquisition unit (DAU), remote access, playback software) that required special attention. Accordingly, preventative and control measures to improve VDR cybersecurity have been discussed in detail. This research makes a contribution significantly to the improvement of ship safety management systems, particularly in terms of cybersecurity.

Comprehensive Analysis of Maritime Cybersecurity Landscape Based on the NIST CSF v2.0

“…Yoo et al [81] focused on AI technology's cybersecurity implications in the context of autonomous ships, applying the SQUARE methodology to identify vulnerabilities and envisage cyberattack scenarios. In a similar vein, Söner et al [82] delved into the variety of challenges that come with securing the maritime environment. Söner et al identified cybersecurity concerns for voyage data recorders (VDRs) on ships, which are crucial for accident investigation.…”

“…There is a consensus on the need for comprehensive education and training programs to build sufficient cybersecurity knowledge across all levels of the industry. • Data Security: Data security has been identified as a critical area of advancement, with the research proposing various strategies to protect data within the maritime sector[60,[81][82][83][84][85][86][87][88][89][90][91][92][93][94][95]. This includes the development of technologies and processes to ensure the integrity and confidentiality of maritime data.…”

Literature review on maritime cybersecurity: state-of-the-art

“…Ships and ports are the central roles of maritime transportation with several shipboard navigation systems, such as ECDIS and AIS, as well as Voyage Data Recorder (VDR), providing real-time sailing information to ensure safety and efficiency (Söner et al, 2023). Meanwhile, the number of ship-and portinvolved cyber-attacks (Silverajan et al, 2018) has increased, using such instruments as code injection, tampering and modification, GPS and AIS spoofing, signal jamming and information eavesdropping, as well as link disruption, which can utilise one or several vectors, such as a positioning system, firmware, sensors, VDRs, intra-vessel networks, vessel-to-shore communications, remote operation systems and so on.…”

Risk Assessment for Autonomous Ships Using an Integrated Machine Learning Approach

“…Breaches in system security can compromise the control, navigation, or communication of autonomous ships, leading to accidents or malicious activities [14,15]. Autonomous systems involve the integration of multiple components, including software, hardware, sensors, and communication systems [16].…”