When Danish shipping giant A.P. Moller-Maersk’s computer system was attacked in 2017, the attack led to a domino effect of worldwide port disruption from the Port of New York and New Jersey to India’s largest container port near Mumbai. This was not an isolated incident; attacks on industrial operations, and T&L companies in particular, are expected to increase in volume in the years to come.
The rise of autonomous vehicle technology, intelligent GPS systems and other transformative technologies has revolutionized the worldwide supply chain of goods and has made human transport safer and more efficient.
However, as with other industries transitioning to IIoT-based technologies and devices, the adoption of digital technologies also dramatically increased the T&L sector’s exposure to cyber-risk, often posed by sophisticated, state-sponsor hacking groups.
T&L systems are by nature highly-distributed and interconnected along supply chains and transportation routes. They rely on elaborate geo-tracking systems (shipping containers are often tracked individually) and other information technologies (for weather and travel conditions) for real time re-routing of goods in transit.
While the majority of attacks on T&L firms were ransomware attacks focused on stealing financial and other business-related information (such as the 2018 attack on Cathay Pacific and many more), some attacks were aimed directly at OT operations, often using the IT-OT barrier as the gateway into the OT network.
That said, ships, planes, trains and automobiles can be hacked: in 2017 DHS demonstrated how a commercial jetliner can be hacked; and the same goes for autonomous vehicles. The logistics sector is constantly targeted by attempts to manipulate cargo systems, to redirect shipping containers and even make them disappear. We’ve witnessed attacks on rail systems, bus networks and more. The conventional wisdom, which T&L operators should embrace, is that every industrial automation network will be attacked at one point or another.
However, even with the writing clearly apparent on the wall, the T&L industry has not put in place adequate mechanisms to tackle cyber attacks. According to an 2020 SJSU/MTI study, about half of all transit companies surveyed experienced a cyber attack of some sort (either by directly phishing for information, data breaches, ransomware or through their supply chain). Yet, only 60% actually have a cybersecurity preparedness program; 43% do not believe they have the resources necessary for cybersecurity preparedness; and only 47% audit their cybersecurity program at least once per year.
As recent cyberattacks on T&L companies reveal, by and large the T&L industry is ill-equipped to handle the risks it’s facing, due largely to three factors: inadequate regulation (compared to other national-critical infrastructure like power generation), lack of awareness among decision makers and the overarching shortage of OT-security experts.
As mentioned, the transition to lloT-based automation, communications and operation management systems has increased the attack surface in the T&L sector. This is due to the large amount of data and interconnected systems that they handle, which makes them prime targets for hackers. For example, the International Maritime Organization’ (IMO) strategic transition to e-navigation allows continuously collecting, integrating, and analyzing ship and container information to track ships’ locations, cargo details, maintenance issues and more; this means that a breach into the e-navigation system would affect the entire spectrum of shipping operations, rather than disrupting on area of operations.
As for regulation, despite the sector’s global operations—or perhaps because of them—regulators have had a hard time agreeing or focusing on a set of cybersecurity standards that T&L companies should follow wherever they operate. Among the regulations proposed or already established are the EU’s Network and Information Security (NIS) directive and the soon-to-be-implemented CLC/TS 50701 and EN 50126 standards for railroads, as well as a series of rules for ships promulgated by the International Maritime Organization.
Finally, the T&L sector is competing with practically all other OT and IT sectors over a small pool of cybersecurity talent. As many as four million cyber specialist jobs were unfilled in 2020, according to the information security trade group ISC2. To makes matters worse for the relatively slow-moving T&L industry, it has little appeal to recent information security graduates, who tend to be drawn to industries that involve more innovation and creativity.
Whether protecting a rail system’s switching system or protecting autonomous vehicles, the framework for efficient protection is the same:
Radiflow offers a variety of products and services for protecting and improving the resiliency of T&L operations, which allow you to:
• Map network assets, the connectivity between the assets and group the assets into zones and business processes using our threat detection tool.
• Assess the risk posture, per business unit, and for the network overall, by simulating relevant attack techniques on the digital image of the site (using Radiflow’s unique OT BAS (Breach Attack Simulation) tool. Radiflow’s risk assessment platform supports multi-site analysis so you can see in one glance the risk-status in your overall domain.
• Generate an optimized network hardening plan, which prioritizes mitigation controls by their contribution to reaching the user’s security and/or other goals (e.g. focus on critical industrial units only, or budgetary constraints).
• Continuously monitor the T&L network for anomalies as well as for changes in the risk posture due to the changes in the threats landscape and in the site.
Radiflow’s industrial cybersecurity platform enables users to take advantage of a host of sector-specific integrated solutions (for railway operations and others), as well as solutions for asset and asset lifecycle management, specialty firewalls, datalake solutions and more. Radiflow’s solutions were also designed for OT-MSSP operation, which allows small-to-medium T&L operators to outsource monitoring and ongoing risk assessment operations to cloud based security providers.
