Abstract:The integration of IT, OT, and human factor elements in maritime assets is critical for their efficient and safe operation and performance. This integration defines cyber physical systems and involves a number of IT and OT components, systems, and functions that involve multiple and diverse communication paths that are technologically and operationally evolving along with credible cyber security threats. These cyber security threats and risks as well as a number of known security breach scenarios are described in this paper to highlight the evolution of cyber physical systems in the maritime domain and their emerging cyber vulnerabilities. Current industry and governmental standards and directives related to cyber security in the maritime domain attempt to enforce the regulatory compliance and reinforce asset cyber security integrity for optimum and safe performance with limited focus, however, in the existing OT infrastructure and systems. The use of outside-of-the-maritime industry security risk assessment tools and processes, such the API STD 780 Security Risk Assessment (SRA) and the Bow Tie Analysis methodologies, can assist the asset owner to assess its IT and OT infrastructure for cyber and physical security vulnerabilities and allocate proper mitigation measures assuming their similarities to ICS infrastructure. The application of cyber security controls deriving from the adaptation of the NIST CSF and the MITRE ATT&CK Threat Model can further increase the cyber security integrity of maritime assets, assuming they are periodically evaluated for their effectiveness and applicability. Finally, the improvement in communication among stakeholders, the increase in operational and technical cyber and physical security resiliency, and the increase in operational cyber security awareness would be further increased for maritime assets by the convergence of the distinct physical and cyber security functions as well as onshore- and offshore-based cyber infrastructure of maritime companies and asset owners.

An Analysis of Adversary-Centric Security Testing within Information and Operational Technology Environments

Risk-based safety scoping of adversary-centric security testing on Operational Technology

A Model Based Framework for Testing Safety and Security in Operational Technology Environments

Vulnerabilities and Attacks Against Industrial Control Systems and Critical Infrastructures

The Global State of Security in Industrial Control Systems: An Empirical Analysis of Vulnerabilities Around the World

Security of IT/OT Convergence: Design and Implementation Challenges

Assessing MITRE ATT&CK Risk Using a Cyber-Security Culture Framework

Industrial Control Systems Security Validation Based on MITRE Adversarial Tactics, Techniques, and Common Knowledge Framework

Quantifying the Effects of Operational Technology or Industrial Control System based Cybersecurity Controls via CVSS Scoring

Helping IT and OT Defenders Collaborate

Insecure by Design in the Backbone of Critical Infrastructure

Position Paper: On Using Trusted Execution Environment to Secure COTS Devices for Accessing Industrial Control Systems

Dead Man's PLC: Towards Viable Cyber Extortion for Operational Technology

Cyber Physical Systems Security for Maritime Assets

Application Perspective on Cybersecurity Testbed for Industrial Control Systems

Cybersafety: A System-theoretic Approach to Identify Cyber-vulnerabilities & Mitigation Requirements in Industrial Control Systems

The industrial control system cyber defence triage process

Requirements and Recommendations for IoT/IIoT Models to automate Security Assurance through Threat Modelling, Security Analysis and Penetration Testing

Analyzing the Attack Surface and Threats of Industrial Internet of Things Devices

Development and Analysis of P2SCP: A Paradigm for Penetration Testing of Systems that Cannot be Subjected to the Risk of Penetration Testing

SpecRep: Adversary Emulation Based on Attack Objective Specification in Heterogeneous Infrastructures