News + Resources

Amid the noise surrounding the US elections and President Trump’s departure from office on 2 December 2020, the White House released a document entitled the National Maritime Cyber Security Plan. This document indicates the readiness, if continued by the Biden administration, to give significant impetus to US cyber security policy around maritime cyber security.

While long on aspiration and light on detail, the plan nonetheless deserves attention, not least because it identifies the need for much improved coherence in US Coast Guard’s approach to cybersecurity for the maritime domain as a whole.

More importantly, however, it sets out where the government needs to do more to support the private sector in dealing with the threats to its operations. And while it does not try to tell business what to do, it does set out steps that the administration might wish to take to mitigate cyber risks to maritime transportation in the US and perhaps globally. It puts civilian suppliers on notice that, if they supply services involving IT or OT to the US government, they will be required contractually to improve their cyber security approach.

Things to watch out for

The US government will seek to:

• Reduce the number of bodies involved in maritime security, or at very least radically to improve coordination
• Encourage and improve reporting on attacks
• Develop common risk modelling approaches for OT networks (may well be a more confusion if the OT and IT are kept separate)
• Use contracts to drive improvements in cyber security by private sector companies contracting with the public sector (clearly important but depends on the detail – handled badly and costs will simply shoot up); and all ports will need to adopt similar behaviour with their suppliers and their customers rather than just creating the asymmetry for the federal government
• Investigate OT systems to find vulnerabilities (as an economy with more than 360 ports and more than 3,500 maritime facilities, there will be many vulnerabilities)
• Establish a cyber forensic process to help maritime operators establish if a cyber incident is the cause of any outage (the document rightly points out the difficulty of ascribing cyber security failures as the cause of an incident). It is not clear exactly what they intend under the establishment of the cyber forensic process: one could argue that one already exists, albeit bespoke to each company that does forensic analysis on cyber security events. However, the implications are clear

Sharing information

If the US government is able to share more intelligence information with the maritime sector about the threat, this can only be to the good. However, information needs to be passed in such a way that it is actionable and that private sector organisations can benefit from it.

This would be a useful model to provide to analogues globally, so that more companies and more ships can benefit from such insight from their national authorities. Information sharing has always been a missing component of the cyber security equation, since information about cyber security breaches is hard to share, e.g. for reasons of embarrassment and reputational damage, loss of competitive advantage, stock price reductions, to name a few.  Then there is the quid pro quo:  if you share information, it is reasonable to expect to receive information.

People skills

The emphasis on upskilling workforces is largely to be welcomed, although the difficulties around implementation should not be under-estimated, and the costs will be material.  Exchanges between government and industry are to be welcomed too, but the issue is more about the extra numbers of people competent enough on either side to perform this function and whether there are enough of them given the global shortage of cyber skilled people.

Astaara’s observations

In the absence of any budget for the activities identified in this document, and given the imminent change of administration, it remains to be seen whether the Biden administration will choose to follow this particular path. It is clear that the issue is one of concern to the departments concerned. And it is important enough to get presidential attention, whatever the colour of the incumbent. It is also interesting to note how dependent the US military is on commercial shipping and the provision of strategic sea lift to move material around the world in support of the US military. In essence, this plan boils down to three key areas: more people, more information sharing, and more complete standards across both IT and OT for cyber security. Our view, however, is that de-conflicting the organisations involved in marine security, both in the US and the rest of the world, would be extremely advantageous, as would common standards to approach risk management reporting. Without a budget, however, it is hard to see how this plan will ever be more than just a final issuance from a past regime – here’s hoping that the Biden administration can take the content and apply it quickly – the work has been done, after all.