The weakest link of any system, whether it be technical, procedural, organisational or industrial, will be the target of choice by cyber threat actors. We have seen these multiple times across various industries.
The Target Corporation breach in 2013 where the HVAC contracting company was compromised to gain access to third-party web portals is one such example. A little closer to home 3rd tier Defence contractors have been breached, where their systems were accessed to steal classified design documents such as aircraft build plans and the schematics of the ASIO building in Canberra.
This applies to the Maritime Industry, likewise, Mining and Oil & Gas. Along the supply chain, vulnerabilities can be exploited by nefarious groups in mis-configured networks, poor access controls and employees who are targeted in social engineering campaigns. Using your supply company as a launching block, attackers can then continue to gain access along the supply chain until they reach their ultimate destination: Sensitive commercial documentation or process equipment systems on ships, in mine sites and on oil rigs.
Specifically, for the maritime industry, this can result in altered cargo sheets, transportation of contraband, theft, physical damage to network connected machinery and ultimately the tampering of navigation equipment.
For the suppliers, there are ways to reduce the risk and prevent your systems from becoming compromised.
1. Cyber Hygiene
Taking a proactive approach to understanding the current state of your cyber security, including maturity levels of your asset management, user management, workflow documentation and procurement procedures. Gaining visibility of your vulnerabilities, and the threats that may be looking to exploit them, gives you a clear picture of what you are facing. The Dark Web, externally available devices and internal networks can all be scanned to gain intelligence on your current state.
2. Tighten Policies and Procedures
Aligning your organisation to a Cyber Security Framework can improve the overall security posture by identifying key controls to safeguard the business and to display what policies and procedures need maturing. Effective procedures around system patching, back-ups, data restoral, acceptable use by users and hardware/software procurement will go a long way in improving and maintaining a secure environment.
3. Access Control
Maintaining access controls such as Multi-Factor Authentication, using a Password Manager and limiting access to only applications individual employees need, will reduce the risk of account take-overs. Having suspicious logins and activities alerting to an operations help-desk will also seek to prevent any breach continuing