Cyber-attacks have been growing in number in recent years. This growth has been even more aggressive in the wake of the Coronavirus pandemic, with ransomware emerging as a particularly effective tactic for cyber criminals. Indeed, current estimates suggest that an attack occurs every 11 seconds. As part of theICEway ecosystem of companies, CRIBB Cyber Security works with clients in healthcare and cruise, both of which have been targeted heavily post-COVID. Today we focus on the latter, as ransomware is now a much more common threat to the maritime industry in general.
Last week, our friends at Seatrade Cruise featured an article on the growing need for cruise lines to improve their knowledge of cyber security, with ransomware incidents a more common enemy than ever before. Given the fact that these two things are very close to our hearts, we were understandably keen to dig a little deeper, so we spent some time with CRIBB’s Patrick Carolan to hear his thoughts…
Cyber security in cruise
Patrick, the Seatrade piece made it clear that cyber security in cruise is a particularly hot topic – what are your thoughts?
It’s always been a hot topic for me and the rest of the team at CRIBB because we’re aware of all the dangers out there and how they are growing, plus we know all about the cruise industry and the various security challenges it faces on a daily basis. Connectivity is a massive issue of course, because everybody these days expects to be able to go online whenever – and wherever – they are, so you have an increased use of the cloud, literally thousands of connected devices and an overabundance of sensitive data all on board a single ship at any given time. It is a dream scenario for would-be cyber attackers to be honest, especially when you then go on to consider just how lacking the cruise industry is when it comes to security knowledge.
Top Tips to safeguard against ransomware attacks
- Ensure everybody takes information security seriously
- Ensure that everyone is aware of email phishing scams, because these are still the preferred method for instigating a ransomware attack
- Use anti-malware, mail server content scanning and filtering, keep systems up to date and regularly back up your data
Security knowledge is growing in the cruise industry now though, isn’t it?
It is and we are certainly doing all that we can to help our own clients in cruise but it’s not easy, particularly when you find yourself in the middle of a shooting gallery! What I mean by that is security in maritime and cruise is complex at the best of times, but even more so when attacks are becoming more concentrated. The piece in Seatrade Cruise suggested that cyber criminals are always on the lookout for easy targets and that’s true, and unfortunately there are lots of reasons why targeting a cruise ship or a port, for example, would represent less of a challenge to them. Things are definitely getting better in terms of overall awareness but at the same time, digital transformation in the cruise industry and Internet of Things are just two more examples of the additional avenues presenting themselves to potential hackers.
Ransomware grew in 2020
Another article was published this week in Tech Spot, in which it was revealed that the first 6 months of 2020 saw Ransomware accounting for almost half of the cyber insurance claims that were made…
That’s a scary number, and more proof if it were needed that we all need to be aware of the dangers out there; if you are dealing with sensitive data, you are a target, and organisations in travel obviously deal with high volumes of data on a regular basis.
What is the solution?
At CRIBB we adopt a ‘security by design’ approach from the outset and I would encourage everyone to do the same. It is critical to have a robust framework in place that everybody within your organisation is aware of and understands. Communication is vital to ensure awareness, it is not enough to simply have a set of policies in place, the whole team needs to know about them and critically, must follow them at all times. Of course, by ‘the whole team’, I also mean third parties and partners where appropriate; in the Seatrade Cruise article they talk about working towards a common goal and that is of the utmost importance, if just one person is unclear on what that is then it can prove to be disastrous.
As part of theICEway, a lot of the work we have done is for cruise lines and we have actually developed a security framework specifically catered for maritime – ‘CMCA’, CRIBB Maritime Cyber Assurance.