Maritime Sector to Catalog Nautical Software Vulnerabilities

Critical Infrastructure Security , Governance & Risk Management , Operational Technology (OT)

A new public access database launched Monday will catalog IT and industrial control systems software vulnerabilities that affect maritime systems.

See Also: When You Can’t Just Pull The Plug: Designing Incident Response For OT

The Blue Initiatve will be fed by data from vulnerability advisories, the common vulnerabilities and exposures database and Known Exploited Vulnerabilities catalog kept by the U.S. Cybersecurity and Infrastructure Security Agency. It's being rolled out by a coalition of vendors, testing and certification providers and a non-profit threat intelligence-sharing organization.

The vision "is to have a public and open single source of truth for maritime-related vulnerabilities," said Nir Ayalon, CEO of Cydome, a British vendor of cybersecurity products and services for the maritime sector. He said the database would help with the "major challenge" of "identifying which vulnerabilities actually matter to the systems maritime companies operate."

Apart from Cydome, the other founders of the Blue Initiative are Rakuten Maritime, a two year old start-up selling cyber solutions for smart ships and autonomous vessels, inspection and certification providers ClassNK and Bureau Veritas. The Maritime Transportation Sector Informational Sharing and Analysis Center is also participating.

The Blue Initiative is an open industry collaboration, said Ayalon, urging other "relevant organizations in the maritime community" to join and help expand the database.

The dangers to the maritime industry of unpatched vulnerabilities was underscored in August when the Coast Guard and federal agents boarded two commercial oil tankers to investigate suspected cyberattacks. The attacks stemmed from known, unpatched vulnerabilities in on-board systems, a federal official told ISMG earlier this month (see: Coast Guard Boardings of Hacked Vessels: New Details ).

The Blue Initiatve "delivers essential vulnerability intelligence that addresses a critical vulnerability gap," said MTS-ISAC Vice-President for Operations Christy Coffey. MTS-ISAC supports the kind of community-led program that Blue Initiative represents and has restructured the way it shares cyber intelligence to make better use of the service, Coffey said, "MTS-ISAC strongly endorses this collaborative model and has integrated its operational workflows to both contribute to and leverage this vital initiative."

An entry is added to the initiative's Maritime Vulnerabilities Repository, its website says, "when a published CVE affects a product that we see, or know to be, used on vessels, on offshore facilities, in ports, or in the onshore infrastructure that maritime companies depend on."

A general Linux kernel flaw would not be indexed, the website says, because it is not specific to the Maritime sector. "The same flaw shipped inside an ECDIS firmware image is [indexed], because we can name the maritime product it sits in."

The initiatve will filter CVEs for relevance by keyword, vendor and other techniques, the website says. New vulnerabilities will undergo review by cyber researchers from Cydome and the other contributing partners, who validate and refine them before publication. "Select entries also receive more elaborate analyst notes."

“In most cases, vulnerabilities are only published once a patch is available, in line with standard responsible disclosure processes," said Ayalon.

The database currently tracks 29,505 vulnerabilities, the vast majority of them in fleet IT systems including enterprise platforms like email and web servers as well as fleet management apps and other specialist software. Just 37 are in maritime-only systems specifically built for ships and ports.

The initiative categorizes vulnerabilities across , propulsion, communications, industrial controls and onboard IT systems.

"I think this maritime report is fantastic," said John Strand, owner of Black Hills Information Security, "because it examines vulnerabilities from end to end across an entire ecosystem, in an industry that has traditionally been underserved by the security community."