A recent Wall Street Journal article highlighted the importance of defending against port cyber attacks. The article outlines upcoming regulations which will encourage more action to prevent attacks. Ports are a significant point within the maritime supply chain, as this is where goods are processed, stored and transferred onto vessels. Due to the vast number of goods which pass through ports every day, they are an attractive target for actors looking to collect information about containers and then attack vessels. Some organized crime groups even want to infiltrate and control ports.
Cyber attacks against ports threaten the integrity of data which passes through them and in come cases control of the port. Any disruption could have implications for global trade. In December 2022 the Port of Lisbon was attacked with ransomware, which took down the port’s website and internal computer systems. Lots of confidential information was stolen, including budgets, contracts, cargo information, ship logs and port documentation. Some of the information was published. Luckily, the port’s operations were not compromised.
Three main ports in Canada were similarly targeted. A DDoS attack took down the ports’ websites, but port operations were not disrupted.
Cyber attacks have doubled since the pandemic against the Port of Los Angeles, which is the busiest in the western hemisphere. The port encounters many attack types, including ransomware, malware and credential harvesting, and attackers intend on causing significant disruption and impact on the economy.
Finally, a suspected cyber attack took down the Tokyo MOU’s inspection database in July 2022. The Tokyo MOU coordinates port state control inspections across the Pacific region, making it an important actor.
It is therefore clear that ports are key targets for cyber attacks. There are many different companies and actors who could be targeted with attacks. Ports’ complex networks of public and private actors also makes securing the ports a challenge. Actors include storage providers for oil and goods, terminal operators and logistics firms. It is a big challenge to ensure all of these actors maintain good security hygiene, in order to prevent attacks and limit successful breaches.
In order to solve this challenge and improve the cyber security of critical industries, the European Union approved new cybersecurity regulations which obligate critical infrastructure companies to become more secure. The regulations include technical measures such as encryption, cyber risk assessments and due diligence too. Hundreds of firms which operate out of Europe’s largest ports will need to use these basic security measures and report attacks to authorities from 2024. Non-adherence will result in fines of up to 10 million euros or two percent of revenue, whichever is higher.
It is hoped that the rules will help to secure the global supply chain of critical goods, especially relating to pharmaceuticals, transportation and energy. Ports play a significant role in maintaining smooth global trade, making it an important task to keep them secure so that global supply chains cannot be disrupted. The consequences of disruption to global trade are widespread and significant.
The opinions expressed herein are the author’s and not necessarily those of The Maritime Executive.
Reference: https://www.maritime-executive.com/editorials/protecting-ports-for-a-secure-global-supply-chain