A modular cyber security training programme for the maritime domain (MarCy)

Abstract

The global maritime industry is continuing the rapid digitization of systems and dependency on advancing technology, in a trend akin to other industrial domains. One of the main issues that this integration has brought is an increased vulnerability to a growing number of cyber threats. While several security measures are being implemented to prevent or respond to cyber attacks, the human element is still one of the main weaknesses. Many of today's cyber attacks take advantage of human personnel's lack of awareness, which makes cyber security awareness and training activities of critical importance. Unfortunately, current research is still limited in its offerings for cyber security training specific to maritime personnel. Moreover, such training programmes for the professionals should be developed role-based in accordance with the suggestions of many credited maritime organizations. For this reason, we developed a modular cyber security training programme for the maritime domain called Maritime Cyber Security (MarCy) by implementing Critical Events Model (CEM). Then, we evaluated the MarCy programme by utilizing the Delphi technique with the participation of 19 experts from academia and industry. In this study, we offer cyber security training for seafarers and office employees in shipping companies. We proposed eleven elective modules to improve the knowledge, skills, and attitude of learners against cyber risks. The MarCy programme can be implemented by universities, shipping companies, training institutes, and governmental organizations for maritime cyber security training purposes.

1. Introduction

The maritime industry is a vital sector in global supply chains [134]. Currently, ships perform over 80% of the world trade by volume [134]. Modern vessels are equipped with many automation systems to improve safety and efficiency in operations. However, developing technology in the shipping industry also brought along concerns about cyber risks. Several studies revealed cyber threats and vulnerabilities onboard ships [5], with research highlighting how these vulnerabilities may play a significant role in various maritime incidents as well as financial losses [7, 83, 104]. Accordingly, the International Maritime Organization (IMO) took action, aiming to protect ships from cyber threats. Cyber risk management became mandatory for ship operators [59]. The human element is also a crucial aspect of risk management and should be carefully considered. Today, millions of professionals work in the maritime sector, with only seafarers numbering nearly 1.9 million professionals [13]. Their cyber awareness is crucial and should be reinforced with training for the effective prevention of cyber risks.

Several organizations (e.g. universities, class societies, and training companies) offer maritime education and training for cadets and professionals in different subjects. One of the domains of this training is cyber security. Cyber security training courses are offered because of occurred cyber incidents in the industry and the requirements of class societies, flag states, and vetting programmes. Even though role-based cyber security training is suggested in credited guidelines [14, 32, 100, 139], a majority of cyber security training programmes offer generic content, with each participant taking the same content in courses. However, each role in the maritime industry requires specific learning needs for cyber security.

2. Background

In this section, we present a comprehensive discussion and analysis of the current availability of maritime cyber security training. To achieve this, we conducted extensive research, which involved careful examination of relevant academic studies and utilization of search engines to identify institutes offering maritime cyber security education and training to cadets and professionals. Additionally, we sought out guidelines and questionnaires that include requirements and recommendations for maritime cyber security training.

2.1 Training institutes

Several institutes providing maritime cyber security training were identified. Solent University offers three courses regarding maritime cyber security. The Estonian Maritime Academy organized a summer school for maritime cyber security in 2018. The Norwegian University of Science and Technology (NTNU) provides a course titled Maritime Digital Security for master students. Other universities like Plymouth, BSA College in Greece, and ENSM in France also offer programmes. Class societies such as RINA and IRClass provide courses for professionals. The study found that training courses generally lack diverse teaching methods such as group discussions, case studies, and demonstrations, and limited curriculum information is available for many courses.

2.2 Guidelines and questionnaires

The IMO recommends following the Guidelines on Maritime Cyber Risk Management to prevent cyber risks onboard ships. Per the guideline, training and awareness are the key elements to avoid cyber threats and vulnerabilities. The awareness programme should cover maintenance routines (e.g. antivirus, patching, and backup), e-mail risks (e.g. phishing attacks), risks related to the use of the internet, risks of the use of own devices, and reporting procedure of cyber incidents. Other guides, such as the Cyber Security Workbook for on Board Ship Use [139], DCSA guidelines [32], and ABS guides [2], recommend role-based training and provide specific requirements for cyber security training for seafarers and office staff.

3. Related work

In this section, we reviewed scientific papers and research projects related to maritime cyber security training and education. The literature review was conducted using reputable digital scientific libraries. Objectives, learning outcomes, modalities, curriculums, target groups, advantages and drawbacks of training proposals were extracted. Findings collected in the literature review were later used to design the MarCy training programme.

Notable projects include the IAMU's CYMET project aimed at enhancing cyber awareness. Lee et al. [75] offered a training course for the Ship Cyber Security Officer (SCySO), while Lee et al. [76] proposed mandatory familiarization training for all seafarers within the STCW Code. Other studies explored simulation-based training and cyber ranges. Lovell and Heering [79] summarized findings in the Exercise Neptune organized by TalTech in 2018. Potamos et al. [111] introduced a maritime cyber range training environment simulating offensive and defensive actions. The literature review revealed that developing a methodology for designing a training programme attracted the attention of many researchers.

4. Methodology

Several models for designing and developing training have been proposed over the years. The Critical Events Model (CEM) [93], initially developed by Leonard Nadler in 1982, stands out as one of the most well-established and thoroughly described methods in training design. The CEM provides a comprehensive approach to designing any types of training courses, applicable not only to formal education but also to the diverse training needs of various organizations. In our study, we incorporated the CEM with several modifications, including the addition of a modular approach and changes to the evaluation step.

In the modular training approach, relevant parts of a training structure are offered to learners by considering personalized training needs. This approach is especially effective for vocational training [38]. Given that only required knowledge is provided to attendees by considering their learning needs, it does not cause lost time in business life. That is why modular training is a cost-effective method and can be given online, as well [123]. It provides flexibility to the training designer and learner.

In addition to the modifications mentioned, the Delphi technique was performed to evaluate the effectiveness and usability of the MarCy programme. The Delphi technique is considered a well-suited research instrument to obtain judgement and opinion on incomplete knowledge about a problem or phenomenon. A panel of 19 experts from academia and industry was selected. Two rounds of Delphi were conducted, with additional questionnaires answered by participants who could not participate in the previous rounds. A total of 7 hours were spent during the discussions of the two Delphi rounds.

5. MarCy: Maritime Cyber Security Training Programme

In this section, we discuss in detail the MarCy programme for maritime cyber security training. The MarCy programme comprises a total of nine steps, derived from the CEM with modifications to suit the specific needs of the maritime industry. Below is a brief description of each step of the programme.

5.1 Identify the needs of the organization

The objectives of this step are to identify the nature of the problem [93]. In the first step, the training needs of the company should be identified, such as international regulations and class notations. Determined training needs identify the required training modules. Eleven elective training modules are proposed in the MarCy programme: M1 Basic Cyber Security, M2 Advanced Cyber Security, M3 Regulatory Requirements, M4 Vetting Requirements, M5 Critical Deck Systems, M6 Critical Engine Systems, M7 Other Critical Systems, M8 Cyber Security Investments, M9 Cyber Security Practices, M10 Cyber Security Management, and M11 Advanced Skills.

5.2 Specify job performance

The objective of this step is to investigate employees' roles and responsibilities [93]. We analysed seafarers onboard and employees on the shoreside of companies. A typical ship crew was divided into three departments: deck, engine, and catering. Typical departments in a company include claims & insurance, IT, operations, chartering, accounting, finance, vetting, HSEQ, training, crewing, technical, purchasing, and marine. The Cyber Security Officer (CySO) role is proposed as a new position to manage cyber security matters.

5.3 Identify learner needs

The objective of this step is to understand the specific learning needs of roles [93]. The training modules for each specific role are determined in this phase. Training modules are mapped with responsibilities as represented in the tables. After the required training modules are determined, an exam can be given to assess the knowledge of participants. If a participant has sufficient knowledge, it is unnecessary to give him/her such a training module.

5.4 Determine objectives

The purpose of this step is to identify the specific objectives and learning outcomes for each training module [93]. The learning outcome comprises three components to reach the objectives identified: knowledge, skill, and attitude [93]. Knowledge is defined as the state of knowing about a particular fact or situation. Skill is defined as the ability to do something well. Attitude is defined as a feeling or opinion about something.

5.5 Build curriculum

The purpose of this step is to build a syllabus to meet the learning objectives stated [93]. The contents are specified by considering module objectives and desired learning outcomes. The contents are divided into two groups: essential and helpful. A content list for each training module was offered as represented in Appendix 1.

5.6 Select instructional strategies

The objective of this step is to determine the appropriate instructional strategies for the curriculum identified [93]. Five instructional strategies are proposed for the modules identified: lecture, discussion, case study, drill, and demonstration. A module can be given with a strategy or a combination of multiple strategies.

5.7 Obtain instructional resources

The objective of this step is to ensure that all required resources for the training are in place. We focus on physical and human resources, and training materials. Physical resources are regarding the facility, tools, and equipment. Lecturers should be selected studiously. The training materials are books, scientific papers, guidelines, animations, videos, presentations, and photos.

5.8 Conduct training

The objective of this step is to perform the training designed. Before the training, a schedule can be identified. The modules can be slightly modified by considering the attendees' needs. The duration of the modules can be identified by considering the learning needs of the participants. Recommended training duration is 2 hours each for M1-M8, 8 hours for M9, 40 hours for M10, while M11 depends on the participant's background.

5.9 Evaluation and feedback

The evaluation phase is to examine the outcomes and objectives of the training designed. According to CEM recommendations, training evaluation should occur two-fold: (1) continuous formative evaluation of training components during course design, and (2) summative assessment at the conclusion of training. The data collected by formative and summative assessments are critical for improving and revising the training offerings developed using the MarCy programme in successive iterations.

6. Evaluation of the programme

As previously discussed in Sect. 4, the evaluation of the MarCy programme was conducted using the Delphi method across two rounds. In both rounds, experts engaged in discussions concerning various aspects of maritime cyber security training and provided feedback on the MarCy programme.

6.1 Main considerations that distinguish maritime cyber security training

In the context of maritime cyber security training, the unique operating environment of the maritime industry presents distinctive challenges compared to other sectors. Vessels face a range of complexities that demand specialized training approaches. One notable consideration is the potential difficulty in responding to a cyber attack promptly. Accessing a vessel for immediate response by a cyber security expert may prove challenging due to its remote location and limited connectivity.

6.2 Recommended training methods

Participants have given various recommendations, ranging from simulation-based approaches to classroom training. The main advantage of simulation-based training is allowing hands-on training based on realistic scenarios without causing security risks to vessels. It was recommended to combine simulation-based and classroom-based training when possible, and keep a focus on real-life scenarios.

6.3 Limitations of current offerings

Several limitations were highlighted by participants regarding current maritime cyber security training. These included lack of IT background of seafarers, limited material available for training, lack of resources (e.g. time, fatigue, and onboard broadband internet), lack of IMO requirements, lack of qualified trainers, budget limitations, heterogeneous systems between vessels.

6.4 Solutions to current limitations

To resolve the limitations previously mentioned, participants suggested several measures including: focusing on real-life case studies and scenarios to engage participants; updating training regularly; mandating training to new employees and ensuring it is repeated for existing employees; adapting training to different languages; adding maritime cyber security training to formal education of cadets.

6.5 Methods & criteria for evaluating training

Evaluation of training was noted to be often less prioritized. This has been considered a key challenge in maritime cyber security training. Participants suggested using performance indicators and metrics, ranging from multiple-choice exams to log and system analysis. For qualitative evaluation, recommendations included discussion-based or survey-based feedback collection.

6.6 Additional considerations/comments

Participants proposed introducing a new role: a dedicated CySO for either onboard (SCySO) or off-board duty (CCySO). The real-life effectiveness of training was also discussed, as certifications obtained post-training often do not guarantee proper cyber security.

6.7 Feedback on the MarCy programme

When it comes to the evaluation of the MarCy programme, the majority of the participants found it to be well-structured and comprehensive. That being said, a number of recommendations for improvements were reflected to the programme. Table 13 summarizes all recommendations made during the multiple rounds of Delphi.

7. Discussion

The MarCy programme is an effective tool for instructional designers in designing maritime cyber security training programmes. The recommendations were developed not solely based on the authors' opinions but also with contributions from experts in the field. In other words, the MarCy is a programme agreed upon by multiple experts. To the best of our knowledge, this aspect is unique in the literature.

Although the MarCy programme has not been implemented in a real training session, real-world applications are in place in the literature. We also intend to organize training sessions with various learner groups in the maritime sector to evaluate all stages of the MarCy programme and present our findings in an additional study. While the MarCy programme is customized for maritime purposes, its modular approach can be used to develop a wide range of training programmes. It is not limited to maritime contexts or cyber security training alone. It can also be applied to designing formal education beyond industry-specific training.

Through this work, we extend the CEM and contribute scientifically to the literature while facilitating the design of maritime cyber security training for industry experts. In other words, we believe that our study not only holds scientific value but also addresses the practical needs of the maritime sector.

8. Conclusions

In conclusion, the mounting concern surrounding cyber risks within the maritime industry has necessitated a call for swift, proactive measures. The potential fallout from a successful cyber attack—including economic losses, data breaches, and compromised operational safety—underscores the utmost importance of cyber awareness. Training emerges as an indispensable tool to heighten cyber awareness and subsequently shield against these threats. This need has garnered support, finding its place within vetting programmes, cyber notations of class societies and flag states, and even proposed integration within the STCW for seafarers.

The distinct responsibilities and roles held by employees necessitate customized training methodologies. In response, we proposed the MarCy training programme by implementing the CEM to address the unique demands of professionals in maritime cyber security training. The MarCy training programme encompasses a meticulous nine-stage process: (1) identify the needs of the organization, (2) specify job performance, (3) identify learner needs, (4) determine objectives, (5) build curriculum, (6) select instructional strategies, (7) obtain instructional resources, (8) conduct training, (9) evaluation and feedback. Eleven elective training modules were specifically designed to enhance the knowledge, skills, and attitudes of seafarers and office personnel in safeguarding against maritime cyber risks. The robustness of the MarCy programme was subsequently confirmed through a Delphi technique involving 19 experts from both academic and industrial backgrounds.

Acknowledgements

We would like to express our sincere gratitude to experts, particularly Ahmed Amro, for their comments towards improving our study. This paper has received funding from the Research Council of Norway through the Maritime Cyber Resilience (MarCy, project number 295077) project. The content reflects only the authors' views.

References

The full reference list (140+ sources) is available at the original article on SpringerLink.

This article is licensed under a Creative Commons Attribution 4.0 International License (CC BY 4.0).