A MASTER’S GUIDE TO CYBER SECURITY First edition published 2014 ISBN: 978-1-85609-686-7 eBook ISBN: 978-1-85609-687-4 © UK Chamber of Shipping, 2014 British Library Cataloguing in Publication Data A catalogue record for this book is available from the British Library. Notice of Terms of Use All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior permission of the publishers. While the advice given in this book A Master’s Guide to Cyber Security has been developed using the best information currently available, it is intended purely as guidance to be used at the user’s own risk. Witherby Publishing Group accepts no responsibility for the accuracy of any information or advice given in the document or any omission from the document or for any consequence whatsoever resulting directly or indirectly from compliance with or adoption of guidance contained in the document even if caused by failure to exercise reasonable care. This publication has been prepared to deal with the subject of A Master’s Guide to Cyber Security. This should not, however, be taken to mean that this publication deals comprehensively with all of the issues that will need to be addressed or even, where a particular issue is addressed, that this publication sets out the only definitive view for all situations. Published by Witherby Seamanship A division of Witherby Publishing Group Ltd 4 Dunlop Square, Livingston, Edinburgh, EH54 8SB, Scotland, UK Tel No: +44(0)1506 463 227 Fax No: +44(0)1506 468 999 Email: info@emailws.com Web: www.witherbys.com Printed and bound in Great Britain by Charlesworth Press, Wakefield iii This guide takes a bottom-up approach at a non-technical level in order to raise awareness and provide basic practical advice that is suitable for implementation on ships to reduce the risks associated with a cyber attack. It does not constitute or replace the need for a comprehensive approach to cyber security. It is intended to fit within a company’s cyber security organisation. Nothing in this document removes the need for suitable corporate oversight of cyber security nor does it replace any corporate policy. For companies based in the UK, further advice is available from the Centre for the Protection of National Infrastructure at www.cpni.gov.uk or from the DfT maritime security team maritimesecurity@dft.gov.uk. v What do I need to know? 1 Is my ship a cyber target? 2 Who would attack my ship and why? 3 What can be attacked? 4 How could an attack take place? 6 How do I reduce this risk? 9 Human factors 10 Physical security 11 Computer system best practice 11 Support from ashore 13 A Master’s cyber security aide memoire 15 Human 15 Physical 15 Computer system best practice 15 Support from ashore 16 Glossary 17 Where can I get more information? 19 CONTENTS 1 WHAT DO I NEED TO KNOW? Cyber security is shrouded in technical language and seen as an area reserved for the computer specialist. It shouldn’t be. A small increase in awareness can have a big effect in preventing attacks. Effective cyber security should be considered part of everyday activity on board, and should not be a significant burden. The term Cyber means all electronic systems, including computers, networks, ECDIS, GPS, ship control systems, passenger payment systems, and the data held on them. Cyber includes how humans interact with this technology. Addressing cyber security is not confined to the very technical, and answering simple questions will make it more difficult for your ship to become the victim of a cyber attack: