ECDIS Cyber Security Dynamics Analysis based on the Fuzzy-FUCOM Method

Abstract

ECDIS is one of the most important pieces of navigational and information equipment on board ships, as well as a vital component of the ship's cyberspace. ECDIS has cyber vulnerabilities because of its connections to external systems like RADAR or GPS, sensors via serial (IEC61162-1/2), analogue, and digital interfaces, as well as onboard Wi-Fi, internet, and LAN technologies. This study identifies and ranks the cyber risks that cause ECDIS control loss, as well as the barriers that can be put in place to stop them, the potential consequences if they are not stopped, and the mitigations that can be utilised to avoid them. Due to a lack of historical data and research on identifying and prioritising ECDIS cyber security dynamics in the literature and the fact that this field necessitates specialised knowledge in terms of computer science and operational maritime navigation, the Fuzzy Triangular Full Consistency Method (FUCOM-F), based on expert opinion, is used in this study. Then, a bow-tie framework is employed to visualize the dynamics of ECDIS cyber security and their hierarchical classification from the analysis as a cyber-architecture. The results indicate that the primary cyber threat for ECDIS is "malware infection via the internet and intranet (M1)." The primary potential consequence, in the event that these cyber threats targeting ECDIS cannot be prevented, is the unavailability of the system (O1). The most efficient barriers against M1 attacks are "up-to-date virus protection" and "scanning software," while the most crucial measure to prevent the impact of O1 is "network segregation." Consequently, in addition to its strong methodological foundation, this research offers significant benefits to maritime professionals and cybersecurity experts by providing valuable insights on preventing cyber-attacks on bridge system infrastructure, particularly ECDIS.

1. Introduction

Cybersecurity in the maritime field is about the physical and information infrastructures where cyberspaces intersect with maritime areas. Ships appear as critical infrastructures with information, communication, and navigation technologies integrated with industrial control systems. As technology continues to evolve, information technology (IT) and operational technology (OT) onboard ships are increasingly being connected to each other and to the world-wide network. This integrated network poses a great risk in terms of malicious attacks and unauthorised access to the ship's systems and networks. From this perspective, all machinery, navigation, and communication systems on a ship can be exposed to cyber threats.

In the ship environment, GPS, AIS, and ECDIS are the primary electromagnetic field-based communication and networking technologies used on bridges. Ships also carry RADAR, the Voyage Data Recorder (VDR), satellite communications, and integrated bridge systems receiving feedback from many sensors. ECDIS, however, is the main subject of this study. It is a significant item of navigation and information equipment on board vessels, and the SOLAS convention requires international vessels to carry it under certain criteria; it must be type-approved, maintained with updated ENCs, software maintenance, and backup arrangements.

ECDIS involves computer technology and marine electronics meeting IT and OT standards, with key specifications in IEC standards such as IEC 61162, IEC 61174, and IEC 62288. These interfaces, which transmit serial, digital, and analogue data from external sources to ECDIS, include vulnerabilities that allow unwanted network access, denial of service, system corruption, unavailability, and tampering. The NMEA 0183 protocol lacks encryption, authentication, and validation, leaving ECDIS devices vulnerable to spoofing, packet sniffing, and man-in-the-middle attacks. The NCC Group has shown that ECDIS can be influenced and infiltrated: viruses can be introduced via a removable USB disk or through an unpatched vulnerability over the internet, and attackers implant malware into ships' ECDIS via satellite.

From this point of view, this study aims at prioritising cyber security controls for ECDIS by considering cyber threats and their potential consequences. For this purpose, firstly, (i) ECDIS cyber threats, (ii) the barriers allowing to prevent these threats, (iii) the potential consequences of these threats, and (iv) the mitigations allowing to prevent these consequences are identified as ECDIS cyber security dynamics. Furthermore, the Fuzzy Triangular Full Consistency Method (FUCOM-F) is used to weight the importance level of the ECDIS cyber security dynamics. Finally, the findings derived from FUCOM-F analysis are presented in a bow-tie framework in terms of demonstrating a hierarchical order so as to show ECDIS cyber risks and their mitigation process as a holistic demonstration.

2. Literature Review

Academic studies, cyber events, and reports in the maritime sector have revealed that ECDIS contains several cyber vulnerabilities that cause critical consequences for ships, such as collision and grounding, and suggested that a risk assessment should be made for ECDIS. However, there are a limited number of studies focusing directly on ECDIS cyber security in the literature, and most of them offer risk assessment approaches for maritime cyber security performed on ECDIS as a case study. For instance, Svilicic et al. detected vulnerable servers and operating systems of ECDIS via a penetration testing tool and stated some cyber-attacks against these parts, offering general mitigations such as crew training, up-to-date operating systems, and cyber security policies, while Hareide highlighted cyber security awareness for integrated bridge systems and presented possible ECDIS cyber-attacks.

On the other hand, reviewing the literature on maritime cyber risk assessment methodologies shows diverse approaches. Kavallieratos and Katsikas offered the STRIDE and DREAD methodologies for the identification and analysis of emerging threats on ships, both qualitatively and quantitatively; Bolbot et al. proposed the Cyber-Preliminary Hazard Analysis method; and Tam and Jones proposed MaCRA, a model-based framework for maritime cyber-risk assessment. However, these risk assessment approaches were proposed for general maritime cybersecurity and did not specifically cover ECDIS cybersecurity, and they present the cyber risk level of the considered system without prioritising the suggested mitigations for risky threats and their consequences.

There is a critically low number of studies aiming at the prioritisation of cyber dynamics for the maritime sector, including Karahalios's study ranking ship cyberattacks in a piracy case with the FAHP method and Yoo and Park's study conducting a qualitative risk assessment analysed with AHP to prioritise improvement measures. To the best of the authors' knowledge, the prioritisation of cyber dynamics for ECDIS within a whole system has not been considered in the literature, nor has the utilisation of fuzzy FUCOM for maritime cyber security been investigated, despite its use in other fields such as cyber risk evaluation of general security technologies and energy management systems. This study therefore introduces a novel weighting application to the cyberspace of ships (ECDIS).

3. Methodology: the Fuzzy FUCOM Method (FUCOM-F)

This study examines the cyber security system for ECDIS onboard ships. First, the cyber threats exploiting ECDIS vulnerabilities and the consequences that may occur as a result are revealed through the solution proposals in the DNV-GL report on maritime cyber security, alongside analysis of ECDIS technological standards and qualifications and the weaknesses of its infrastructure via the literature, the ECDIS operational handbook, type approval certificates, manufacturers' catalogues, and IHO standards. Barriers to prevent these threats are then defined by referencing DNV-GL recommendations, consequences are identified from literature and technical reports, and mitigations are determined to prevent critical consequences for ECDIS. FUCOM-F is then used to weight the importance of the identified threats, barriers, consequences, and mitigations, and a bow-tie diagram is created to show the overall dynamics in a single hierarchical diagram.

The FUCOM-F method, proposed by Pamucar and Ecer, extends the traditional Full Consistency Method into the fuzzy environment for weighting the importance of criteria in a multi-criteria decision-making system. Triangular fuzzy numbers express expert opinions through a fuzzy linguistic scale comprising: equally important, weakly important, fairly important, very important, and absolutely important, which are transformed into triangular fuzzy numbers. A linear problem is then solved to find the weight coefficient values satisfying full consistency, where the minimum deviation from full consistency is achieved only when transitivity among weight coefficients is fully satisfied. FUCOM features an easy implementation algorithm and trustworthy weight coefficients aiding rational decision-making, reduces experts' preference inconsistency in the final weights, and requires fewer pairwise comparisons than other methodologies.

Two stages of FUCOM-F application are performed: the first determines the importance of the main ECDIS cyber threats and consequences, and the second determines the importance of barriers for threats and mitigations for consequences. After the local importance weights of barriers and mitigations are obtained, they are multiplied by the corresponding importance weights of threats and consequences respectively to reveal the global optimal weights. The steps are applied to each expert's scores separately with the linear problem solved in Excel for all factors, and the arithmetic mean of the resulting defuzzified crisp values is taken to obtain the final criteria weights.

4. Application and Findings

For the FUCOM-F method, a hierarchical criteria table of ECDIS cyber security dynamics was created covering threats, barriers, mitigations, and consequences. Five main threats were identified: malware infection via internet and intranet (M1), introduction of malware on removable media (M2), intrusion via remote access (M3), vulnerabilities of standard components of IT systems and other control systems connected to the internet (M4), and human error and sabotage (M5). Barriers were designed as sub-criteria of threats, including: protection against malware (M11) and security management (M12) for threat M1; closing USB ports, a single fixed external memory, and pre-scanning for threat M2; whitelisting, VPNs, and authentication procedures for threat M3. The main consequences are: system unavailable (O1), system corrupted (O2), files deleted or changed (O3), connected devices such as GPS and AIS hijacked (O4), and infrastructure damaged (O5), each with sub-criteria mitigations.

Five expert opinions with diverse information-security backgrounds — spanning information processing, security, software engineering, and maritime cyber security — with experience ranging from 3 to 18 years were used. Experts scored the pairwise comparisons of criteria and sub-criteria on a 1–9 scale by importance level, and the arithmetic means of their scores were used in the FUCOM-F steps. Ranking scores were transformed into fuzzy linguistic scales and then into triangular fuzzy numbers by referencing the linguistic table, and linear models were solved to obtain the optimal values of the weight coefficients for each factor.

The results show that the most important main cyber threat for ECDIS is malware infection via the internet and intranet (M1), followed by introduction of malware on removable media (M2), intrusion via remote access (M3), vulnerabilities of standard components (M4), and human error and sabotage (M5). The most important barriers for M1 threats are up-to-date virus protection and scanning software (G1), followed by up-to-date IT systems (G2) and documentation and monitoring of changes (G3); among the security management (M12) sub-barriers, security system and software update procedures for ECDIS (Z1) rank first, followed by human-factor procedures (Z2), adoption of standards such as ISO/IEC 27001 (Z5), personnel training (Z3), and regular password change (Z4).

Regarding consequences, the most important potential consequence is system unavailability (O1), followed by system corruption (O2), then files deleted or changed (O3) and infrastructure damaged (O5) at the same rank, and finally hijacking of connected devices (O4). The most critical mitigation to prevent O1 is network segregation (B1), followed by network traffic information collection (B2) and machine-readable reporting of current security settings (B3). The complete hierarchical results are displayed in the bow-tie diagram, with threats and consequences ranked hierarchically and barriers and mitigations ordered left to right by their influence level.

5. Discussion

In this study the dynamics constituting ECDIS cyber security have been analysed and prioritised with a holistic approach, and a hierarchical system has been obtained accordingly. With the hierarchical model, ECDIS cyber security is envisaged to be provided at a high level of convergence at the technical level. The model can guide ship officers responsible for ECDIS cyber security, company managers, and even insurers in any cyber incident to make policy on the proposed hierarchical diagram. Company managers in particular can strategically invest in cyber security, including ECDIS, by thoroughly analysing the hierarchical model. It must also be acknowledged that uncertainties are inevitable in all scientific endeavours, especially in multi-criteria decision-making, and expert elicitation enables the incorporation of parameters which are actually "informed estimations" to measure the level of uncertainty arising from data scarcity.

Malware infiltration through both the internet and intranet is the most prominent risk to ECDIS cyber security, as Trojans, viruses, spyware, ransomware, rootkits, and worms can infiltrate computer systems, compromising data and causing harm. To mitigate malware infections, it is imperative to utilise up-to-date malware protection and scanning software on IT systems, keep computers updated, ensure any onboard IT systems are regularly updated and valid, and thoroughly document and monitor modifications to current systems. This encompasses formulating and implementing comprehensive security protocols, overseeing their enforcement, upgrading security infrastructure, complying with international standards like ISO/IEC 27001, training ship staff, and conducting periodic password changes, prioritising proactive over reactive measures.

Remote access intrusion ranks next in severity, since IT staff often need remote maintenance access to the ship instead of going physically, and ECDIS chart updates are realised over the internet, exposing the system to unauthorised access when required barriers are absent. Such breaches can be mitigated through remote access management with whitelisting, safe data transmission over protected networks using robust encryption, mandatory encrypting VPNs where remote access is permitted, and authentication mechanisms for companies, IT staff, and service providers. The most severe consequence is system unavailability: ransomware can disrupt availability by propagating through drivers, connected PCs, and servers, and protection measures encompass network segmentation, network traffic data collection, and machine-readable reporting of security settings per ISA/IEC 62443.

6. Conclusion

In this study, the importance weights of ECDIS cyber dynamics are obtained: the threats and consequences related to the loss of control of ECDIS are defined, their barriers and mitigations are developed, and their importance weights are found via the fuzzy-integrated FUCOM method, with a bow-tie model built to demonstrate a holistic view in accordance with the hierarchical ranking. FUCOM-F is considered an easier and more effective method for defining the importance of criteria than other weighting methodologies because it requires fewer expert comparisons, while fuzzy set theory deals with the abstruseness and ambiguity in expert decisions and yields more reliable and valid results. The results provide detailed guidelines for shipping companies and maritime stakeholders in adopting a methodology for cyber security investment and improvement, in line with the IMO requirement that SOLAS-compliant ships include the cyber security clause in their safety management system.

For further studies, the importance weights obtained for IT and OT dynamics related to ship cyber security should be identified separately for other ship cyberspaces such as RADAR, GPS, and AIS, using the same method or state-of-the-art methods such as artificial neural networks and Bayesian networks. The number of experts (five) can be considered a limitation despite their experience, and both the number and qualifications of experts can be improved; additionally, uncertainties and bias cannot be eliminated due to the lack of statistical data.