DNV GL: Cyber Attacks on Ships, Offshore Structures Growing Threat

As ships and offshore structures become increasingly dependent on programmable control systems at the same time they are an ever-larger target for cyber threats.

“Ships and offshore structures are becoming more and more interconnected,” said Tor E. Svensen, CEO DNV GL – Maritime, when taking the stage at this year’s CMA (Connecticut Maritime Association) event in Stamford, CT.

“In theory, all programmable components may be exposed to cyber threats, be it machinery, navigation or communication systems. This is a weak spot,” says Svensen.

“There are many ways something can go wrong with the systems or software – be it caused by technical or human error, or cyber criminals.”

The industry has seen its first cyber events, e.g. the manipulation of AIS, ECDIS and GPS data. Just last year, more than 50 cyber security incidents were detected in the Norwegian energy and oil and gas sector.

“At DNV GL, we have always favored a risk-based approach and also advocate this to reduce cyber risks,” Svensen said.

He also recommended that asset owners and operators should consider cybersecurity self-assessments, third-party assessments, audits, testing and verification, and suggested that such requirements could also be implemented into future regulations.

Cybersecurity audits or “health checks” are starting points. With a combination of so-called Hardware In-the-Loop (HIL) and cybersecurity testing, DNV GL’s  has developed its Marine Cybernetics unit that can address typical threats such as network storms and penetrations, password attacks, disconnections and communication failures.

DNV GL introduced its own Integrated Software Dependent Systems (ISDS) standard in 2009. Originally developed for the offshore industry and enhanced ever since, ISDS helps ensure that the integrated and stand-alone control-systems of a vessel perform reliably and safely.

“If you have already taken care of software integrity, installed data protection and assessed the risks e.g. with HIL testing or ISDS, you are in a good position to take the next step in improving cybersecurity.”

DNV GL also consults organizations such as the US Coast Guard (USCG) on building a regulatory framework. Just recently, DNV GL has provided comments to the USCG on “Guidance on Maritime Cybersecurity Standards,” drawing on DNV GL’s competence and cross industry cyber security knowledge in the Maritime, Oil & Gas and Energy industries.