Across the choppy sea of news comes the storm warning that one of world’s largest maritime organizations, DNV, has suffered a ransomware attack during January 2023. The company is a major software supplier for ships.
At the heart of the attack was ransomware and the matter represents the latest in a string of ransomware attacks affecting the shipping industry.
Major players in the maritime industry stand as attractive targets for cybercriminals due to the considerable impact that a cybersecurity incident of this nature can have on the global supply chain and world economy.
In the case of DNV, threat actors were able to shut down the IT servers connected to DNV’s ShipManager software system, which supports the management of vessels and fleets in all technical, operational and compliance aspects.
Looking into the issue for Digital Journal is Almog Apirion, CEO and Co-Founder of Cyolo. As a former CISO and founder of the Cyber Unit of the Israeli Navy, Apirion has first-hand experience with how software security is evolving in the maritime context.
Apirion considers the context of cybersecurity incidents directed at shipping: “In recent years, maritime threats have become increasingly prominent as new naval systems like GPS, satellite communications and remote monitoring solutions are opening greater vulnerabilities in the organizations’ attack surfaces.”
Drawing on another example, Apirion finds: “Only two weeks ago, the third-largest port in Lisbon was hit by a LockBit ransomware attack. As attacks on the maritime industry become more common, the impact on organizations becomes more palpable.”
This leads onto the more recent incident: “With this recent DNV example, we see a clear impact on product availability. However, the effects go beyond, with consequences in economies and if worse comes to worse, even putting human lives and safety at risk.”
Consider the wider ramifications, Apirion opines: “Maritime shipping routes are a critical part of the global supply chain, so any disruption to the safe movement of goods is an economic crisis the world cannot afford right now. In this context, maritime organizations must examine their security posture and their dependency on and access from software suppliers, more so as many devices on maritime vessels share credentials or use default accounts.”
As such, these types of incidents may well increase. As Apirion finds: “As shipping vessels become more digital, securing the software companies use becomes paramount. If this third-party reliance is not controlled and secured properly – whether in port or at sea – it can become a catastrophic problem for maritime shipping companies resulting in major safety and business challenges.”
