LRQA Nettitude Blog

By Nettitude Research and Innovation Team

Communication technologies and protocols are an essential part of a vessels electronic systems. However, the unique aspects of marine and offshore environments present challenges to their use; in which the nature of their use and the widespread use of legacy systems affect all security activities and agendas.

This has become a particularly high topic on the cybersecurity agenda over the last two decades, as the explosive growth in communications services has dramatically changed the way that businesses operate in all sectors, improving efficiency and providing new opportunities. In the maritime sector, we can see this from the original adoption of VHF a hundred years ago for ship communication, through to more recent safety technologies such as AIS and satellite communication. However, the limited bandwidth and high cost of these technologies has historically limited the sector’s ability to leverage them in many of the ways seen in other industries.

The following blog post will outline some of the key trends in cybersecurity vulnerabilities in technologies utilised by the Marine and Offshore sector.

By Joel Snape | Cybersecurity Researcher at Nettitude

In our previous blog post for the ‘Cybersecurity and the Cloud’ series, we looked at what considerations should be made when considering migrating to the cloud. To follow on, the next step is to establish a strategy for how you are going to migrate your business over to a cloud platform.

There are a number of options to choose from when considering what cloud platform provider you are going to go with. From public cloud spaces to private, community and hybrid; each one has its own benefits and drawbacks and establishing which one is best for your company will depend on the way you will be using it and what for. In order to ensure you select the right platform for your businesses needs, it is essential to establish a clear cloud migration strategy.

In this post, we’ll discuss the five key steps to take in order to create an effective cloud migration strategy.

By Graham Sharples | Threat Analyst 

Internet of things (IoT) devices are now embedded in every part of our lives, with more and more devices becoming connected to the internet each day. This is a trend that can trace its origins back to the start of the 1990s wherein a toaster was created by John Romkey that could be turned on and off over the internet. This demonstrated what could potentially be achieved with everyday household appliances. Today, IoT devices are in nearly every electronic device we use and with IBM’s announcement in 2018 that they had made the smallest computer in the world measuring 1 millimetre by 1 millimetre, there is almost nothing an IoT device can’t fit into.

By Nettitude

For many years, aerospace and aviation security has been primarily focused on the physical aspects of maintaining safety; from airside safety checks to ensure unauthorised personnel cannot access critical areas, to airport safety measures that ensure the safety of passengers and crew on board the plane. However, as passenger convenience and safety has advanced, as well as increased connectivity between airports, aboard a plane, and the outside world, the previous security model has become obsolete.

In line with this, we have recently seen the introduction of CAA ASSURE, a new cybersecurity audit model for third parties providing services to the Aerospace industry. Find out in the below post about what ASSURE entails and what Nettitude can offer in relation to this.

By Graham Sutherland, Senior Vulnerability Researcher

Developing and implementing secure remote access solutions can be a challenge in itself. As new threats continue to emerge and existing threats evolve, ensuring both your physical communications infrastructure and your communications operations are secure is vital to the day to day operations of your business. However, when factoring in the challenges of remote communications at sea, things can begin to get even more tricky if you don’t follow the correct procedures for establishing secure methods of remote communication.

At sea, the two main challenges are the availability of resources and connectivity. These two factors have over the past decade have been the driving force for the continual development of remote access solutions. Whilst today, we are in one of the best positions to defend our assets against ongoing threats, there are still an extensive set of considerations to be made when evaluating an approach or vendor offering.

Below, we will outline 9 key considerations which must be made when implementing remote access communications.

By Mike Buckley at LRQA Nettitude 

Effective network design is crucial for the smooth running of every business. As the heart of your business activity, your network is relied upon day-in, day-out by your staff to keep business flowing, and customers returning. As most of us have experienced before, when the network goes down, chaos usually follows. When this happens, it can often be a mammoth task to get everything back up and running and the time lost is irreplaceable. However, by following best practice for network design and configuration from the beginning, you could prevent many issues before they arise.

Below, we’ll explain why establishing a well-designed and configured network is important, as well as detailing the six factors that are essential to the smooth running of your network…

By Nettitude 

In the nearly fifteen years since Amazon launched its initial cloud computing offering, the ways we develop, deploy and manage applications have been changing at pace. More businesses are finding that the transition away from traditional data centre technology is offering advantages such as increased flexibility, more rapid time-to-market, and allowing them to scale to meet customer demand.

 Of course, many of the security considerations of using cloud infrastructure mirror those for more traditional infrastructure, and organisations should draw on existing expertise to manage them. However, different ways of working in the cloud mean that there are new aspects to consider to ensure that you are secured against the latest threats. It’s also worth remembering that these new ways of working can also offer an opportunity to adopt more secure ways of working at a lower cost – but only if deployed effectively.

Below, we’ll take a look at the main advantages of adopting cloud technology, as well as four key considerations your business should take.

By Graham Sutherland, Senior Researcher & Consultant at Nettitude

Modern ships utilise networked technologies in order to provide faster, more accurate, and more convenient operations of the vessel. This connectivity unfortunately brings with it new threats to the security of the vessel, its crew, and its cargo, while additionally bringing unique challenges in terms of systems maintenance.

Whilst the benefits of these technologies bring huge value to day to day operations, there are certain precautions which should be taken to offset any risks associated with integrating such technologies. Below are some of the most common security issues faced on today’s ships that you should be aware of.

By Nettitude

We are pleased to announce, Nettitude will be exhibiting at the 20^th PCI London event this month at Park Plaza, Victoria. The annual PCI events are well known for delivering the latest industry insights, updates and keynote talks on all things PCI-DSS, and are not to be missed by anyone working within the industry.

The shipping sector has traditionally stood apart from the developments in cybersecurity over the past decade. With the majority of critical functions and assets physically isolated by miles of ocean, the need to secure these resources against cyber threats has seemed similarly remote.

However, in recent years, this hands-off approach to cybersecurity and assurance has become riskier and ultimately, costlier. In the modern cyber threat landscape, less capable adversaries such as hacktivists and teenage virus writers take a back seat to organised criminals and even nation state-sponsored threat actors. The cyber-crime economy is now mature, well-established, and well-developed.

Below we will take a look at the key learnings for ship owners and operators which can be taken from previous research and attacks, most notably the NotPetya attack in 2017 which caused major implications for global shipping giant Maersk.