Major Cyber Risk Identified in Marine Equipment Assessments

• •94% of marine equipment assessed requires cyber risk treatment.
• •Reliance on CVE counts alone is insufficient for accurate risk assessment.
• •Older software and active service ports are significant vulnerabilities.

A recent CYTUR analysis revealed that 94% of assessed marine equipment systems require cyber risk treatment, with 60% classified as needing immediate action. The study evaluated over a dozen systems from various manufacturers, including propulsion and automation. Notably, the findings indicate that reliance on Common Vulnerabilities and Exposures (CVEs) alone is insufficient for assessing cyber risks. For example, an Integrated Automation System (IAS) with over 200 CVEs was rated at Risk Level 20, while another with only 20 CVEs was rated at 16, both necessitating treatment. The assessments highlighted issues like active service ports and outdated software as significant vulnerabilities. CYTUR recommends that shipowners and managers prioritize risk based on exposure and connectivity rather than solely on CVE counts. The study's implications extend across the vessel lifecycle, emphasizing the need for ongoing risk assessments and remediation strategies.