Cybersecurity company CYTUR has published an analysis of more than a dozen recent marine equipment risk assessments, finding that 94% of the systems assessed fell into the “Appropriate” or “Required” risk treatment categories under IACS Recommendation 171.
IACS Recommendation 171 covers the incorporation of cyber risk management into safety management system (SMS) and was first published in May 2022.
The Recommendation proposes a methodology for stakeholders to manage cyber risk assessment and suggests that risk treatment measures may be called for depending on the risk level grade scored using the framework – for a Risk Level (RL) up to 4, risk treatment is considered “Optional”; for an RL from 4 to 12, risk treatment is considered “Appropriate”; for an RL greater than 12, risk treatment is “Required”.
About 60% of the systems assessed for the report were rated “Required”, where risk treatment is mandatory. CYTUR cautions that the figures are based on equipment submitted by its clients for assessment and are not representative of the wider maritime equipment market.
The assessments found that Common Vulnerabilities and Exposures (CVE) counts alone, a standardised dictionary-style catalogue of publicly disclosed cybersecurity vulnerabilities and software flaws, did not explain the resulting risk levels.
In one comparison, an integrated automation system with more than 200 identified CVEs was rated Risk Level 20, while another with about 20 CVEs was rated Risk Level 16, with both falling into the “Required” category.
CYTUR identified active ports and services, network connectivity, software and firmware status, attack surface and the potential operational impact of a compromise as factors contributing to the assessment.
In one case, equipment communicating primarily over serial links had eight active service ports on its Ethernet side, despite the Ethernet interface not being used for primary communication. Similar configurations were identified across equipment from two manufacturers.
The report also found vulnerabilities concentrated in components bundled with marine equipment. In one assessment, the manufacturer’s core controller had no identified CVEs, while an industrial network device installed alongside it had 13, with further cases involving vulnerabilities in PLCs, HMIs, I/O modules and firewall operating systems.
CYTUR also identified unsupported operating systems and vulnerabilities that had remained unaddressed despite security advisories and patches having been available for several years.
A retest conducted after remediation showed that risk could be reduced when measures were implemented and then verified. In that case, software and firmware were updated, unnecessary services were shut down and management communications were secured, with the subsequent assessment reducing the Risk Level from 20 to 12 and moving the system from “Required” to “Appropriate”.
