Superseded by MSC-FAL.1/Circ.3
MSC.1/Circ.1526
1 June 2016
INTERIM
GUIDELINES ON MARITIME CYBER RISK MANAGEMENT
1 The Maritime
Safety Committee, at its ninety-sixth session (11 to 20 May 2016), having
considered the urgent need to raise awareness on cyber risk threats and
vulnerabilities, approved the Interim guidelines on maritime cyber risk
management, as set out in the annex.
2 The Guidelines
provide high-level recommendations on maritime cyber risk management to
safeguard shipping from current and emerging cyberthreats and vulnerabilities.
The Guidelines also include functional elements that support effective cyber
risk management.
3 Member Governments
are invited to bring the contents of this circular to the attention of all
stakeholders concerned.
ANNEX
INTERIM GUIDELINES ON MARITIME CYBER RISK MANAGEMENT
1 INTRODUCTION
1.1 These Guidelines
provide high-level recommendations for maritime cyber risk management. For the
purpose of these Guidelines, maritime cyber risk refers to a measure of
the extent to which a technology asset is threatened by a potential
circumstance or event, which may result in shipping-related operational, safety
or security failures as a consequence of information or systems being
corrupted, lost or compromised.
1.2 Stakeholders should
take the necessary steps to safeguard shipping from current and emerging
threats and vulnerabilities related to digitization, integration and automation
of processes and systems in shipping.
1.3 For details and
guidance related to the development and implementation of specific risk
management processes, users of these guidelines should refer to specific Member
Governments' and Flag Administrations' requirements, as well as relevant international
and industry standards and best practices.
1.4 Risk management is
fundamental to safe and secure shipping operations. Risk management has
traditionally been focused on operations in the physical domain, but greater
reliance on digitization, integration, automation and network-based systems has
created an increasing need for cyber risk management in the shipping industry.
1.5 Predicated on the
goal of supporting safe and secure shipping, which is operationally resilient
to cyber risks, these Guidelines provide recommendations that can be
incorporated into existing risk management processes. In this regard, the
Guidelines are complementary to the safety and security management practices
established by this Organization.
2 GENERAL
2.1 Background
2.1.1 Cybertechnologies
have become essential to the operation and management of numerous systems
critical to the safety and security of shipping and protection of the marine
environment. In some cases, these systems are to comply with international
standards and Flag Administration requirements. However, the vulnerabilities
created by accessing, interconnecting or networking these systems can lead to
cyber risks which should be addressed. Vulnerable systems could include, but
are not limited to:
Bridge systems;
Cargo handling and management systems;
Propulsion and machinery management and
power control systems;
Access control systems;
Passenger servicing and management
systems;
Passenger facing public networks;
Administrative and crew welfare systems;
and
Communication systems.
2.1.2 The distinction
between information technology and operational technology systems should be
considered. Information technology systems may be thought of as focusing on the
use of data as information. Operational technology systems may be thought of as
focusing on the use of data to control or monitor physical processes.
Furthermore, the protection of information and data exchange within these
systems should also be considered.
2.1.3 While these
technologies and systems provide significant efficiency gains for the maritime
industry, they also present risks to critical systems and processes linked to
the operation of systems integral to shipping. These risks may result from
vulnerabilities arising from inadequate operation, integration, maintenance and
design of cyber-related systems, and from intentional and unintentional
cyberthreats.
2.1.4 Threats are
presented by malicious actions (e.g. hacking or introduction of malware) or the
unintended consequences of benign actions (e.g. software maintenance or user
permissions). In general, these actions expose vulnerabilities (e.g. outdated
software or ineffective firewalls) or exploit a vulnerability in operational or
information technology. Effective cyber risk management should consider both
kinds of threat.
2.1.5 Vulnerabilities can
result from inadequacies in design, integration and/or maintenance of systems,
as well as lapses in cyberdiscipline. In general, where vulnerabilities in
operational and/or information technology are exposed or exploited, either
directly (e.g. weak passwords leading to unauthorized access) or indirectly
(e.g. the absence of network segregation), there can be implications for
security and the confidentiality, integrity and availability of information.
Additionally, when operational and/or information technology vulnerabilities
are exposed or exploited, there can be implications for safety, particularly
where critical systems (e.g. bridge navigation or main propulsion systems) are
compromised.
2.1.6 Effective cyber risk
management should also consider safety and security impacts resulting from the
exposure or exploitation of vulnerabilities in information technology systems.
This could result from inappropriate connection to operational technology
systems or from procedural lapses by operational personnel or third parties,
which may compromise these systems (e.g. inappropriate use of removable media
such as a memory stick).
2.1.7 Further information
regarding vulnerabilities and threats can be found in the additional guidance
and standards referenced in section 4.
2.1.8 These rapidly
changing technologies and threats make it difficult to address these risks only
through technical standards. As such, these Guidelines recommend a risk
management approach to cyber risks that is resilient and evolves as a natural
extension of existing safety and security management practices.
2.1.9 In considering
potential sources of threats and vulnerabilities and associated risk mitigation
strategies, a number of potential control options for cyber risk management
should also be taken into consideration, including amongst others management,
operational or procedural, and technical controls.
2.2 Application
2.2.1 These Guidelines are
primarily intended for all organizations in the shipping industry, and are
designed to encourage safety and security management practices in the
cyberdomain.
2.2.2 Recognizing that no
two organizations in the shipping industry are the same, these Guidelines are
expressed in broad terms in order to have a widespread application. Ships with
limited cyber-related systems may find a simple application of these Guidelines
to be sufficient; however, ships with complex cyber-related systems may require
a greater level of care and should seek additional resources through reputable
industry and Government partners.
2.2.3 These Guidelines are recommendatory.
3 ELEMENTS OF CYBER RISK MANAGEMENT
3.1 For the purpose of
these Guidelines, cyber risk management means the process of
identifying, analysing, assessing, and communicating a cyber-related risk and
accepting, avoiding, transferring, or mitigating it to an acceptable level,
considering costs and benefits of actions taken to stakeholders.
3.2 The goal of
maritime cyber risk management is to support safe and secure shipping, which is
operationally resilient to cyber risks.
3.3 Effective cyber
risk management should start at the senior management level. Senior management
should embed a culture of cyber risk awareness into all levels of an
organization and ensure a holistic and flexible cyber risk management regime
that is in continuous operation and constantly evaluated through effective
feedback mechanisms.
3.4 One accepted
approach to achieve the above is to comprehensively assess and compare an
organization's current, and desired, cyber risk management postures. Such a
comparison may reveal gaps that can be addressed to achieve risk management
objectives through a prioritized cyber risk management plan. This risk-based
approach will enable an organization to best apply its resources in the most
effective manner.
3.5 These Guidelines
present the functional elements that support effective cyber risk management.
These functional elements are not sequential all should be concurrent and
continuous in practice and should be incorporated appropriately in a risk
management framework:
.1 Identify: Define personnel roles and
responsibilities for cyber risk management and identify the systems, assets,
data and capabilities that, when disrupted, pose risks to ship operations.
.2 Protect: Implement risk control processes
and measures, and contingency planning to protect against a cyberevent and
ensure continuity of shipping operations.
.3 Detect: Develop and implement activities
necessary to detect a cyber event in a timely manner.
.4 Respond: Develop and implement activities
and plans to provide resilience and to restore systems necessary for shipping
operations or services impaired due to a cyberevent.
.5 Recover: Identify measures to back-up and
restore cyber systems necessary for shipping operations impacted by a
cyberevent.
3.6 These functional
elements encompass the activities and desired outcomes of effective cyber risk
management across critical systems affecting maritime operations and
information exchange, and constitute an ongoing process with effective feedback
mechanisms.
3.7 Effective cyber
risk management should ensure an appropriate level of awareness of cyber risks
at all levels of an organization. The level of awareness and preparedness
should be appropriate to roles and responsibilities in the cyber risk
management system.
4 BEST PRACTICES FOR IMPLEMENTATION OF CYBER RISK MANAGEMENT
4.1 The approach to
cyber risk management described herein provides a foundation for better
understanding and managing cyber risks, thus enabling a risk management
approach to address cyberthreats and vulnerabilities. For detailed guidance on
cyber risk management, users of these guidelines should also refer to Member
Governments' and Flag Administrations' requirements, as well as relevant
international and industry standards and best practices.
4.2 Additional guidance and standards may include, but are
not limited to:1
The Guidelines on
Cyber Security on board Ships by BIMCO, CLIA, ICS, INTERCARGO and INTERTANKO.
ISO/IEC 27001
standard on Information technology Security techniques Information