Cyber Security in the Maritime Industry: A Systematic Survey of Recent Advances and Future Trends

Abstract

The paper presents a classification of cyber attacks within the context of the state of the art in the maritime industry. A systematic categorization of vessel components has been conducted, complemented by an analysis of key services delivered within ports. The vulnerabilities of the Global Navigation Satellite System (GNSS) have been given particular consideration since it is a critical subcategory of many maritime infrastructures and, consequently, a target for cyber attacks. Recent research confirms that the dramatic proliferation of cyber crimes is fueled by increased levels of integration of new enabling technologies, such as IoT and Big Data. The trend to greater systems integration is, however, compelling, yielding significant business value by facilitating the operation of autonomous vessels, greater exploitation of smart ports, a reduction in the level of manpower and a marked improvement in fuel consumption and efficiency of services. Finally, practical challenges and future research trends have been highlighted.

1. Introduction

Maritime transportation is central to the economic sustainability of many regions throughout the world. Growth in population, improvements in living standards, and elimination of trade barriers all drive ever-increasing reliance on the industry, which is responsible for 90% of the transportation of all goods. Recent developments in the Internet of Things (IoT), Big Data, and Artificial Intelligence have enabled the migration to more digitalised maritime infrastructures and, consequently, have necessitated a renewed assessment of cyber-security provision. Furthermore, connectivity and reliance on intelligent devices play a pivotal role in motivating cyber criminality such as social engineering, identity theft, and spam emails. The protection of the integrity of next generation maritime infrastructures is a pressing need.

Connectivity through navigation systems such as AIS, GNSS, and RADAR impacts negatively on the security level of infrastructures. Moreover, shipping companies have been subjected to highly complex and new classes of cyber attacks targeting in-port information systems and inflicting damage on on-vessel core equipment. Reliance on the Internet, operating with unprotected computers, and the fact that crews do not receive appropriate security training further increase the probability of a successful cyber breach. There is clear evidence that the absence of structured security awareness training across the supply chain is a major source of vulnerabilities, so hackers can use classical approaches such as spam emails or Denial-of-Service (DoS) attacks to achieve successful breaches. This paper presents a comprehensive review of cyber-security frameworks and provides a classification of cyber-attacks within the maritime industry. A description of on-vessel equipment/functionalities and in-port services provides the reference against which a classification of vulnerabilities in both operational environments is carried out, in turn informing on the optimum strategies to enhance existing cyber security protection.

2–3. Methodology and Literature Review

The methodology by which the review has been executed is founded on published literature enabling a mapping of state-of-the-art methods and analysis, interpretation, and implications of cyber security within the maritime industry. Paper selection followed reference guidance through phases: Review, with the principal question "what is the impact of cyber-crimes on maritime infrastructures"; Search, based on journal papers, conference papers, official websites, and published reports in the ScienceDirect, Springer, and IEEE databases using keywords such as "Maritime", "Cyber-attack + Maritime", and "Cyber-attack + Port", with documents selected by citation count and relevance; then reporting of key findings segmented into: classification of on-vessel core equipment/systems, in-port architectures and services, classification of cyber attacks, and the impact of new technologies. A statistical study showed the number of vulnerable components in-port to be higher than on-ship.

The role of the maritime industry in the transportation sector is receiving increased attention owing to its growing economic importance. However, the quest to optimise efficiencies has motivated migration to increasing levels of digitisation of operations and infrastructures, which in turn has resulted in the proliferation of cyber security challenges. There is clear evidence that a deep knowledge of the skills, strategies, and objectives of cyber criminals is fundamental to establishing secure infrastructures; confidentiality, integrity, and availability of sensitive data remain essential targets for hackers. Recent examples include a model-based tool observed as a three-dimensional matrix decomposing the problem with variables such as "attacker" and "target" to identify and quantify maritime cyber-risks, and the MAritime Threat INtelligence FRAMEwork (MAINFRAME) established to aid threat intelligence collection and analysis in maritime environments.

The identification of potential in-port cyber threats has been the subject of significant governmental interest worldwide: a study centered on Colombian ports revealed the absence of a security plan enabling easy unauthorized access to on-vessel information systems, while a study based on two industry workshops in Europe and Asia showed cybersecurity is perceived differently between geographies with insufficient intrusion-identification protocols and tools. The Cyber Security National Security Action Plan (CNAP) describes the US Government strategy to reduce cyber crime risks on critical infrastructures, and the use of new technologies in Ship Information System (SIS) implementations such as IoT, artificial intelligence, and machine learning increases the scope of vulnerabilities, enticing hackers toward new attack classes. Another consideration is the impact of global events on cyber security, most strikingly the COVID-19 pandemic, with a dramatic increase in cyber attacks on the maritime industry reported since February 2020 as criminals targeted home computers with ransomware and phishing emails.

4. The Maritime Infrastructure

The maritime infrastructure can be represented by two essential platforms: on vessel and in port. On-vessel infrastructure is segmented into two systems: electro-mechanical and communications; the former comprises elements related to engines/power whose safety depends on human observation and preventive maintenance, while the latter enables information exchange between port and vessel to facilitate critical process stages. Classified electro-mechanical and electronic components in three groups (power, security, control) include: the Power Management System (PMS) automatically controlling diesel generators for optimal performance; Programmable Logic Controllers (PLCs) combined with power management, alarms, and engines for process automation; Water Ingress Detection Systems (WIDS) mandatory under SOLAS; bow thrusters for efficient maneuvering; Emergency Shut Down (ESD) systems; heavy fuel oil treatment, lubricating oil, and starting air systems; plus the gyro compass, echo-sounder, electrical cranes, navigation lights, loading computer, fresh water generators, cooling systems, incinerators, sewage treatment plants, stabilisers, and anchor/mooring winch controls — all critical components, some requiring dual power and rapid response to ensure safety.

On-vessel communications systems include: internal communications where VHF plays an important safety role, the mandatory GMDSS for contacting authorities, and networked information systems gathering and processing sensor data; navigation, where GNSS is recognised as the most vulnerable infrastructure in the maritime industry given its lack of authentication and encryption — GPS, GALILEO, and GLONASS provide flexibility and easy public access but rich attack surfaces for injecting fake information; RADAR as a core collision-free navigation tool on 10 GHz and 3 GHz bands; passenger-facing networks (Wi-Fi and satellite TV entertainment); the mandatory ECDIS real-time navigation system replacing paper charts, connected to RADAR and AIS and updated via internet, email, or USB; cargo management with a dynamic database; AIS broadcasting static, dynamic, and voyage-related data under SOLAS, with an architecture of TDMA, DSC, GMSK modulation, and GNSS; and the Ship Information System (SIS) comprising sensors, network architecture, information processing, and information transmission.

The port is the interface between the vessel and land, and efficient transportation and tracking of goods and vessels rely heavily on in-port service quality, with three important groups: vessel services, commercial transportation and tracing services, and security-linked facilities. Safety capabilities include: cargo X-ray scanners reducing inspection time and detecting suspicious goods, high-resolution CCTV for real-time monitoring, and metal detectors under the ISPS Code. Operational equipment includes: remotely controlled cranes via wireless connectivity — an evolution creating new vulnerabilities for malicious takeover — plus tugboats and dredging vessels. The Port Community System (PCS) provides real-time goods tracking and customs declarations through modules: core, cargo, tracking and tracing, berth management, storage allocation, interface to other transport modes, billing, and statistics. The Single Window (SW) environment standardizes services between ports by unifying rules across governments, while the port terminal life cycle comprises four subsystems: ship-to-shore, transfer, storage, and delivery and receipt.

5. Cyber-Attacks in the Maritime Industry

Cyber attacks associated with key equipment and systems are classified, including on-ship attacks: the AIS attack, where data identification is carried out by calculating the Frame Check Sequence (FCS) with the CRC polynomial equation, and an attacker executes a successful spoofing attack by transmitting the message on the appropriate radio channel of the AIS receiver using an FCS similar to the one calculated by the target AIS decoder, potentially causing collisions between ships by changing localisation (latitude, longitude, altitude) or injecting a false message; and GNSS attacks — GPS, GLONASS, Galileo, and BeiDou — facilitated by the lack of authentication and encryption, where fake position information significantly increases collision probability (as in the striking Black Sea exemplars), with spoofing carried out in two steps: synchronization with the satellite signal followed by increases in transmitted signal power, and extensive research on GNSS spoofing detection using spatial processing methods and an IRIDIUM-based deciphered Ring Alert message method.

In-port cyber-attacks include: spear-phishing with emails containing suspicious links to obtain unauthorized access, followed by key-logger installation to capture logins/passwords and build a precise mapping of port status — though port managers prefer minimal reporting given sector sensitivity; distributed denial of service (DDoS) flooding the port information system with excessive traffic and denying access to its sites, compromising maritime services and goods tracking; port scanning to discover service status via IP fragmentation to confuse firewalls or interrogating UDP ports, with TCP-wrappers preferred for mitigation; supply chain attacks through the most vulnerable part of the end-to-end network, most understandably by changing a container's destination via modified critical information; and social engineering exploiting human curiosity or compunction via social media, false identities, baiting, and quid pro quo, mitigated only by strictly applied security policies.

Malware, ransomware, and Trojan classes generally aim to damage the information system or server by targeting networked computers. On 8 July 2019, an attack targeted a US vessel causing critical credential mining; the Coast Guard and FBI reported that the lack of security strategies — the entire crew sharing the same login and password, use of external devices, and absence of antivirus protection — was the main enabler. The second example is the 27 June 2017 attack named Petya, which hit the Maersk shipping company's servers with encrypted malware that destroyed operating systems by infecting the master boot record (MBR), affecting 17 terminals and inflicting damages exceeding USD 200 million.

6–7. IoT and the Future of Maritime

The IMO created the International Safety Management Code (ISM) and the International Ship and Port Facilities Security Codes (ISPS) as standards ensuring safe shipping and harbour operations. The industry has recently adopted new technologies to optimise evolution toward digitalisation, including the Internet of Things (IoT) — a technology platform interconnecting 'objects' through the Internet to exchange data — where the connected 'things' in maritime are predominantly sensors monitoring operational equipment and environment. A suite of appropriate sensors has been deployed on vessels and in port operations to reduce the risk of critical component failures and increase key practice efficiencies, as extensive monitoring provides real-time information such as cargo temperature, gas emissions, and other vital data informing operational optimisation, lowering maintenance costs and increasing whole-ecosystem safety — yet growing reliance on data and complex network connectivity has gated a proliferation of new vulnerabilities that attackers exploit.

Sahay et al. provided detailed insight into the on-vessel role of sensors and actuators in automated ship systems as integral to the physical components of bridge, engine, and propulsion control systems, with generated data central to Integrated Bridge Control and Autonomous Engine Monitoring Controllers — though increased automation creates new security vulnerabilities. The use of IoT-gathered data to derive meaning has gathered pace, with evidence on the benefits of Industrial IoT (IIoT) in safety-critical applications and Big Data Analytic tools proven to enhance maritime productivity. IoT attack surfaces depend on technology implementation — architectural design, component modus operandi, protocols — and include: network links via network-layer protocol vulnerabilities, application links, network design flaws, and weak password key management. IoT has inherent security challenges from bi-directional cloud data storage and retrieval; examples include LogicLocker (a self-spreading ransomware worm via PLCs) and attacks on IoT-enabled field devices such as Automated Tank Gauges (ATG) and small-scale SCADA systems.

This section focuses on cyber-security concerns around advancements toward an extensively digitised maritime industry, considering autonomous or unmanned vessels and their attack surfaces. Two classes of autonomous vessels — self-driven vessels piloted by artificial intelligence — have seen significant R&D: remotely monitored and operated vessels by shore-side operators, and independently operated vessels with onboard decision support undertaking all operational decisions, with phased evolution beginning remotely before full independence. Autonomous vessel adoption faces operational, safety, and regulatory challenges: remotely operated counterparts comprise large sensor networks driven by algorithms interpreting acquired data for accurate navigation, exposing new attack surfaces in sensor networks, remote controls, and shore-operator communication links. While autonomously operated vessels may be less susceptible to traditional attacks (e.g., crew held hostage), increases in GPS spoofing via the communication link attack surface are inevitable, with concerns over collision-causing attacks, loss of life, environmental damage, weak key management, and bi-directional cloud storage. Digitalisation offers undoubted business benefits — transforming analogue operations into streamlined cargo handling, procurement, and logistics practices enhancing efficiency, growth, innovation, safety, and competitive advantage — relying on blockchain, Big Data, real-time control, AI, autonomous vehicles, robotics, VR, and IoT, through three phases of optimisation, extension, and transformation, with researchers agreeing Big Data and AI offer viable solutions to digitalisation challenges.

8. Conclusions

A review of current components, systems, and services within the maritime industry, segmented as in-port and on-vessel, is presented as the foundation for determining future exposures of a critical global-wide infrastructure to cyber crimes. Reported cyber attacks are classified and their impact quantified in each core sub-infrastructure within the state-of-the-art context. Sector migration toward ever-increasing levels of smart in-port services and autonomous vessels necessitates new cyber-security protocols and enhanced protection practices. Clear evidence exists that every port or vessel is at risk of cyber-attacks if key information systems are not adequately protected, and proliferation of new technologies further expands vulnerability scope within the most operationally critical infrastructures, heightening exposure to significant risk of unauthorized access and new classes of cyber-attacks.

An important strand in achieving more robust cyber protection is improvement in cyber-security awareness across the community. In support of awareness, a legal framework and updated insurance methodologies should be established to strengthen solutions to cyber threats. Moreover, all cyber security issues should be transparent among stakeholders to increase understanding and catalyse collective practice development, with details and impact of new cyber-attacks communicated throughout the supply chain. Integration of acceptable governance practices in ports, together with adoption of a universal security protocol, will further reduce the probability of successful cyber attacks and inform effective protection strategies. In the future, among many remaining challenges, developing a plan for standardizing digital services for autonomous vessels is the most pressing, and a new security standard reducing the number and scope of cyber-attacks for autonomous vessels and smart ports must be defined for the sector's economic sustainability.