MaCRA: a model-based framework for maritime cyber-risk assessment

Abstract

In the current economy roughly 90% of all world trade is transported by the shipping industry, which is now accelerating its technological growth. While the demand on mariners, ship owners, and the encompassing maritime community for digital advances (particularly towards digitization and automation) has led to efficient shipping operations, maritime cybersecurity is a pertinent issue of equal importance. As hackers are becoming increasingly aware of cyber-vulnerabilities within the maritime sector, and as existing risk assessment tools do not adequately represent the unique nature of maritime cyber-threats, this article introduces a model-based risk assessment framework which considers a combination of cyber and maritime factors. Confronted with a range of ship functionalities, configurations, users, and environmental factors, this framework aims to comprehensively present maritime cyber-risks and better inform those in the maritime community when making cyber-security decisions. By providing the needed maritime-cyber risk profiles, it becomes possible to support a range of parties, such as operators, regulators, insurers, and mariners, in increasing overall global maritime cyber-security.

Cyber-Risk Assessment for Autonomous Ships

“…This data on near-future autonomous ships, modelled by axis s of the MaCRA framework, differs from the previous study based on existing manned maritime vessels. For example, autonomy reduces the number of onboard navigation systems, traditionally used for human-based operations [10]. However, while reducing the number of systems decreases the attack-surface area, the addition of remote controlled operations in futuristic autonomous ships increase the severity and likelihood of successful exploits.…”

“…In order to assess cyber-risks specific to autonomous ships, this article uses a novel application of the MaCRA model, a maritime-specific framework that assess cyber-risks [10]. This model was based on established patterns within threat assessment models [13], [14], [15] but until this point has not been applied to futuristic ships, only present day systems.…”

“…• axis s : Technological systems and their impacts • axis e : Attacker ease-of-exploit required for attack • axis r : Attacker reward for attacking autonomous ships While the model is often represented visually as 3D or 2D, the model dimension is actually much higher as all three axes are functions of following attacker and target attributes [10].…”

“…Although increased interconnectivity between ships and on-shore infrastructure have improved efficiency, and more is necessary to support autonomous ships, this trend also increases potential cyberattacks on maritime vessels [6], [7], [8], [9]. To better assess cyber-threats, specifically for autonomous ships, this article extends a novel modelling framework named MaCRA (Maritime Cyber-Risk Assessment) [10], which is currently being propagated with today's shipping data, to perform a parallel exploration of the potential cyber-vulnerabilities and associated risks of autonomous ships. Specifically, this article examines three examples of near-future ships, at various stages of autonomy and designed for different purposes, already being prototyped with their first voyage planned for 2020.…”

Raising Awareness on Cyber Security of ECDIS

“…Ship operational technology systems for a last two decades have been intensively developed by means of digitalization, integration and networking. The development resulted in complex and computerbased technology systems, and therefore there is urgent need for safeguarding shipping from cyber threats and vulnerabilities (Svilicic et al 2019, Tam et al 2019, Filic 2018, Kessler et al 2018, Polatid et al 2018, Hareide et al 2018, Shapiro et al, 2018, Svilicic et al 2018, Lee et al 2017, Hassani et al 2017, Burton 2016, Balduzzi et al 2014, Svilicic et al 2005. The International Maritime Organization (IMO) has recently published the Guidelines on high-level recommendations for maritime cyber risk management (IMO MSC-FAL.1/Circ.3 2017), and imposed to include cyber risk assessment in the implementation of the International Safety Management (ISM) Code safety management system on ships by 1st of January 2021 (IMO MSC.428(98) 2017).…”