USCG issues cyber alert after incident investigation

The United States Coast Guard (USCG) has issued an alert to warn of potential cyber vulnerabilities onboard commercial vessels, following its investigation of a malware incident reported by a vessel bound for the Port of New York and New Jersey.

According to the Alert, in February 2019 the unnamed vessel experienced a “significant cyber incident” impacting its shipboard network, following which an interagency team of cyber experts, led by the Coast Guard, conducted an analysis of the network and essential control systems.

The team concluded that, although the malware significantly degraded the functionality of the onboard computer system, essential vessel control systems had not been impacted. Nevertheless, the team found that the vessel was operating without effective cybersecurity measures in place, exposing critical vessel control systems to significant vulnerabilities.

According to USCG, the security risk presented by the shipboard network was well known among the crew prior to the incident, and that the same shipboard network was employed by the crew for personal use and for official business – such as to update electronic charts, manage cargo data and communicate with shore-side facilities, pilots, agents, and the Coast Guard.

“It is unknown whether this vessel is representative of the current state of cybersecurity aboard deep draft vessels,” USCG said.

“However, with engines that are controlled by mouse clicks, and growing reliance on electronic charting and navigation systems, protecting these systems with proper cybersecurity measures is as essential as controlling physical access to the ship or performing routine maintenance on traditional machinery.”

“It is imperative that the maritime community adapt to changing technologies and the changing threat landscape by recognising the need for, and implementing, basic cyber hygiene measures.”

Cyber advice

As a result of this investigation, USCG “strongly recommends” that vessel operators take the following basic measures to improve their cybersecurity:

  • Segment Networks – ‘Flat’ networks allow an adversary to easily manoeuvre to any system connected to that network. Segment your networks into ‘subnetworks’ to make it harder for an adversary to gain access to essential systems and equipment.
  • Per-user Profiles & Passwords – Eliminate the use of generic log-in credentials for multiple personnel. Create network profiles for each employee. Require employees to enter a password and/or insert an ID card to log on to onboard equipment. Limit access/privileges to only those levels necessary to allow each user to do his or her job. Administrator accounts should be used sparingly and only when necessary.
  • Be Wary of External Media – This incident revealed that it is common practice for cargo data to be transferred at the pier, via USB drive. Those USB drives were routinely plugged directly into the ship’s computers without prior scanning for malware. It is critical that any external media is scanned for malware on a standalone system before being plugged into any shipboard network. Never run executable media from an untrusted source.
  • Install Basic Antivirus Software – Basic cyber hygiene can stop incidents before they impact operations. Install and routinely update basic antivirus software.
  • Don’t Forget to Patch – Patching is no small task, but it is the core of cyber hygiene. Vulnerabilities impacting operating systems and applications are constantly changing – patching is critical to effective cybersecurity.