1. Introduction
The shipping industry is the lifeblood of international trade and is of great importance in the import/export of manufactured goods and affordable food. Maritime cargo and passenger movements not only contribute to the annual gross domestic product of involved countries, but also provide a variety of jobs and support employment. The continuously expanding maritime trade necessitates an increase in the size, types and capacities of ships. The means of monitoring and managing massive ships on the ocean receive vital attention, which is essential for safety management and environment protection, such as reducing accidents and carbon dioxide emissions. With the harnessing of advanced technology, such as the deployment of Radio Detection and Ranging (RADAR), Automatic Identification System (AIS) and Electronic Chart Display and Information System (ECDIS), it is clear that information communication technology (ICT) facilitates the collection, storage, integration, transmission, exchange, display, analysis, fusion and application of maritime traffic and transportation information on the ship and ashore and on the water to improve and enhance navigation, operations and services to ensure security and safety at sea, as well as protecting the marine environment and ecosystem. However, adversely, ICT can result in significantly dangerous situations caused by cyber-incidents against the maritime transportation system via potential deliberate disruptions (Perrine et al., Reference Perrine, Levin, Yahia, Duell and Boyles2019). Therefore, it is vital to achieve powerful cybersecurity management, including deploying appropriate adversarial models, maintaining robustness risk frameworks and designing resiliency counterpart plans. For example, the situation awareness for navigation must reach beyond the physical observation domain (i.e. collision risk evaluation and prediction, the effect of environmental conditions on collision risk) (Fang et al., Reference Fang, Yu, Ke, Shaw and Peng2018a; Yu et al., Reference Yu, Fang, Murray and Peng2019, Reference Yu, Fang, Fu, Liu and Chen2021a, Reference Yu, Murray, Fang, Liu, Peng, Solgi and Zhang2021b, Reference Yu, Meng, Fang, Liu and Xu2023; Xu et al., Reference Xu, Chen, Chen, Zhang and Yu2021, Reference Xu, Yu, Chen, Du, Chen and Zhang2023; Liu et al., Reference Liu, Zhang, Zhang, Wang and Fu2023) and the mutual dependability risk reconnaissance between cyber and physical systems.
Maritime cybersecurity emphasises the new vulnerabilities of the maritime domain introduced by utilising advancements in ICT, and relies on a comprehensive understanding of cybersecurity to navigate, operate and communicate securely and safely. Cybersecurity in the maritime transportation industry engages in the availability and integrity of the shipping system. It not only protects information transmission, storage and usage, but also security mesh network, facilities, hardware and software from malicious and unauthorised use. Recently, cyber-attacks show their power to affect the maritime domain through crossing borders and breaking down the normal physical–cyber interaction, and they have the power to create revenue losses and provoke accidents (i.e. collision and grounding, etc.) by manipulating sailing information. The synthetic framework to deal with cyber-attacks in the maritime transportation domain and ensure security in the shipping system is highly correlated with the process of threats recognition, attacks classification, consequence assessment and mitigation recommendation.
Preventing cyber-attacks is attracting increasing attention in the maritime transportation industry; for example, on 16 May 2019, the Maritime and Port Authority of Singapore (MPA) announced plans to create the Maritime Cybersecurity Operations Center (MSOC) to strengthen and enhance the maritime transportation cybersecurity posture for Singapore.Footnote 1 This will have the potential to allow the MPA to closely cooperate with various entities to protect critical information infrastructures based on investigating and learning from cybersecurity threats. The MPA also plans to establish critical data linkages between the Port Operations Control Centre and MSOC against cyber-incidents in a more holistic and timely manner. In addition, the ‘Ship Cyber Security Network Construction and Design Safety Evaluation’ was launched by the Marine Engineering Research Centre of Samsung Heavy Industries in cooperation with the Classification Society Korean Register to enhance ship cybersecurity.Footnote 2 However, the current research on maritime security in the academic area is unknown, and it is worth filling in this gap.
This paper aims to highlight the necessity and importance of maritime cybersecurity. Section 2 presents the data collection and the bibliometric approach used for this paper. Section 3 first presents a brief review of evaluation of potential consequences of a cyber-attack, focusing on which methodologies are applicable to analyse the impact for the different cyber-attack types considered. Second, a brief summary of maritime cyber-threats is provided, centring on the question of how maritime cyber vulnerabilities can be recognised from different perspectives. Then, the classification of cyber-attacks to the maritime industry is presented, including implications for convincing evidence that have been considered in cyber-attack risk analysis and extended uncertainty treatment. Fourth, a recommendation of risk mitigation actions on the scope of the analysis in attack events and consequences is illustrated. Section 4 attempts to identify the research gaps that are closely connected with promising future research avenues. Section 5 presents the conclusion.
2. Data and bibliometric approach
Scopus is one of the largest topics, abstract, full paper and citations databases of peer-review literature, covering both journal and conference articles. Thus, for this study, publications are retrieved from the core collection of Scopus. A search with the key topics/keywords ‘maritime’ and ‘cybersecurity’ yielded numerous records. After refinement and careful inspection, closely relevant records with access to the full paper were eventually reviewed. The sources of the studies were diverse and The Journal of Navigation is one of the journals with voluminous publications available. According to the categories that Scopus assigns to the publications, the studies on maritime cybersecurity are dominated by Engineering (57⋅44%), Social Science (40⋅43%) and emerging Computer Science (38⋅80⋅18%). The number of publications associated with the keywords before 2015 is surprisingly low (17⋅65%), but the topics appear to have had explosive growth beginning in 2015. That indicates that maritime cybersecurity has gained increasing attention recently and is a hot topic nowadays.
The keywords co-occurrence analysis based on VOSviewer SoftwareFootnote 3 is meant to detect research hotspots, as shown in Figure 1. The node size illustrates the appearance times of a specific keyword, and the width of links represents the number of papers in which the connected two keywords co-occur. The different colours indicate different clusters where keywords are more likely to occur together, as well as the evolution over time. Obviously, maritime cybersecurity has attracted attention since 2016, and especially after 2018, cybersecurity, ships and network security are more possible to link simultaneously. In comparison with cybersecurity studies in the finance areas, the study on cybersecurity of the maritime transportation system started later but has similar trends in the number of published papers. Impactful studies with more citations are continuously conducted and developed; for example, studies on maritime cyber security with more citations are increasing. A series of solid research studies are essential to figuring out the core problems and corresponding detailed solutions within each step of the maritime system operation (Figure 1).
Keywords co-occurrence analysis
3. Major research focuses and trends
3.1 Potential consequence of maritime cyber-threats
Cyber-attacks have the power to destroy maritime navigation systems partly or totally on a port, regional and global scale. The potential consequences derived from cyber-attack incidents are involved in sea navigation and routing, port operation, shipping systems, and network, etc. (Jones et al., Reference Jones, Tam and Papadaki2016; Hemminghaus et al., Reference Hemminghaus, Bauer and Padilla2021). Some of the studies explained the consequence from the theoretical analysis perspective. Some relevant examples are mentioned here. DiRenzo et al. (Reference DiRenzo, Goward and Roberts2015) stated that these attacks may control the navigation system of ships using false signals that overpower authorised signals, triggering false collision warnings by creating images of fake ships that were recognised as real; tilting an oil rig, forcing it to shut down; or releasing cargo to false trucks and stealing the cargo without the port's knowledge. These are examples are based on theoretical results of incidents, however solid impact-consequence assessment models and their potential solutions are missing. Spousta and Chan (Reference Spousta and Chan2016) asserted that buoys data under cyber-manipulation enable false impending tsunami announcements and even breach electric power systems through contextualising the connection between the buoy data, transmission network, warning system and infrastructure resilience. Shapiro et al. (Reference Shapiro, Maras, Velotti, Pickman, Wei and Till2018) discussed the actors, intention, tactics and targets of the Trojan Horse virus, explaining the dangers for maritime sectors exposure to this threat from the perspective of personnel, computer system and the physical environment, and advised a variety of safety and security measures for risk mitigation and emergency management.
Other methodologies have tried to assess consequences from the qualitative perspective, including impact magnitude and the likelihood of vulnerabilities (Svilicic et al., Reference Svilicic, Rudan, Jugović and Zec2019a, Reference Svilicic, Brčić, Žuškin and Kalebić2019b, Reference Svilicic, Kamahara, Celic and Bolmsten2019c, Reference Svilicic, Kamahara, Rooks and Yano2019d; Meland et al., Reference Meland, Nesheim, Bernsmed and Sindre2022), a maritime cyber-risk assessment framework integrating the tier divisions of attackers and targets (Tam and Jones, Reference Tam and Jones2019a), risk scenario likelihood associated with consequence scores (Abkowitz and Camp, Reference Abkowitz and Camp2011) and a discrete-event simulation (Bou-Harb et al., Reference Bou-Harb, Kaisar and Austin2017) model under a distributed denial of service. These methods enable the evaluation of risk more intuitively and effectively; nevertheless, the risk assessment mostly focuses on the direct degree of vulnerabilities in maritime cyber systems and it is hard to estimate the actual real impact in the physical shipping industry, for example with economic loss and indirective impacts throughout sea routing and the whole shipping network. A fruitful consequence assessment must focus more on the larger impact of cyber-attacks rather than on localised effects. The accurate risk values for maritime cyber-attacks are unavailable beforehand, and can only be modelled based on the data of an accessible incident. Thus, the construction of the incidents database is meaningful and useful. In addition, they mixed some qualitative and subjective analyses; for example, the limited description for considered scenarios, the division of the level in the scoring process highly relies on participants, and the quality-control relative to empirical data is important for the reasonableness of results. Furthermore, extending the proposed model to diverse maritime security cases, comparison among different models and providing resiliency mechanisms is the intention of future work for the safe maritime operation (Figure 2).
Statistics of potential consequence assessment in the maritime cybersecurity domain
3.2 Recognising maritime cyber-threats
The maritime shipping system consists of people, facilities, equipment, technology, information and networks that are intertwined and interactive. It is the resultant complexities and sophistication that make it challenging to protect maritime transportation from cyber-attacks. Maritime cyber-attack reconnaissance is the most important phase, which informs us that one attacker will pursue whatever means available to obtain vital information about targets in the maritime transportation system. Cyber-threat recognition is closely linked to a comprehensive understanding of the entire configurations of the maritime transportation system. A potential cyber-attacks vector of the maritime transportation system can be obtained based on in-depth knowledge of operational, communicational and technical aspects of such a system. Figure 3 summarises the cyber-attacks recognition in the view of the ship, port, maritime sector, shipping companies and logistics industry.
Statistics of maritime cyber threats recognition
Ships and ports are the central roles of maritime transportation with several shipboard navigation systems, such as ECDIS and AIS, as well as Voyage Data Recorder (VDR), providing real-time sailing information to ensure safety and efficiency (Söner et al., Reference Söner, Kayisoglu, Bolat and Tam2023). Meanwhile, the number of ship- and port-involved cyber-attacks (Silverajan et al., Reference Silverajan, Ocak and Nagel2018) has increased, using such instruments as code injection, tampering and modification, GPS and AIS spoofing, signal jamming and information eavesdropping, as well as link disruption, which can utilise one or several vectors, such as a positioning system, firmware, sensors, VDRs, intra-vessel networks, vessel-to-shore communications, remote operation systems and so on. The cyberattack vectors in shipping companies and the maritime logistics industry are close to the ships and ports; thus, the cyber-risk recognition method is an alternative for increasing protection against cyber-attacks.
In order to identify the potential cyber-risks from this embedded software, the recognition approaches can be grouped into scanning tools, online surveys, participators interviews, introducing threats and simulation, conception and elaboration method and attack graph generation, as well as the cyber-attack path discovery method (Balduzzi et al., Reference Balduzzi, Pasta and Wilhoit2014; Kalogeraki et al., Reference Kalogeraki, Papastergiou, Mouratidis and Polemi2018b; Lee and Wogan, Reference Lee and Wogan2018; Möller et al., Reference Möller, Jehle, Froese, Deutschmann and Koch2018; Mouratidis and Diamantopoulou, Reference Mouratidis and Diamantopoulou2018; Polatidis et al., Reference Polatidis, Pavlidis and Mouratidis2018; Jacq et al., Reference Jacq, Brosset, Kermarrec and Simonin2019a; Tam and Jones, Reference Tam and Jones2019b). For example, we can use the industry-leading vulnerability scanning tool (i.e. Nessus Professional Version) to detect weak components (Svilicic et al., Reference Svilicic, Rudan, Frančić and Doričić2019e) in a system. The threats can be derived from out-of-date and unsecured setup and bad health of the underlying operating system, insufficient training and lack of awareness of navigational ranks, establishing unauthorised access to the internet connection, inability to continuously assess and respond rapidly to cyber-risk, and a lack of self-contained cybersecurity procedures and policies (Svilicic et al., Reference Svilicic, Rudan, Jugović and Zec2019a).
However, there are several limitations that require further study. First, most of the current recognition research based on cyber-threats and cyber-assets will be problematic without considering physical and cyber interaction. Second, most of these approaches are theoretical solutions, and they lack practical implementation and considering privacy requirements. The validation as proof for application of real cyber-attack scenarios is missing. Third, the studies are limited to application in the real port and supply-chain cyber-risk assessment without incorporating the physical nature of infrastructure on cyber-risk estimation reasoning, results and potential cascading effects, as well as incident management practices. Finally, further research is required regarding cyber-attacks predictions integrating vulnerabilities, attack paths, the importance of assets, previous attack incidents database and the possibility of exploiting mitigation recommendation methods and defence strategies.
3.3 Categorising the maritime cyber-risk
Increased digitalisation, automation and informatisation in maritime transportation appears to open a new gateway of vulnerability for shipping systems concerned with cybersecurity. There are few differences between maritime cyber-attacks and general information-security threats, including worms, viruses and other types of malware, as well as email scams. The information technology system in maritime transportation has suffered from an increasing number of ongoing cyber incidents, as a result affecting operators, ports and shipping companies. In most of these cases where the shipping industry is a direct target of cyber breaches, they were sometimes affected by threats to other perspectives; for example, the NotPetyaFootnote 4 aimed at destroying an Iranian nuclear centrifuge, posing a breakdown of servers and computers of the Maersk Line. In addition, the components of the maritime shipping industry are not self-contained units, being linked with each other. An obvious example is that ship-based and shore-based information technology systems are cyber-connected, which opens the door to a cyber-attack reaching the critical operating technology systems of a vessel via shore-based information systems, resulting in troubling accidents. This type of threat could also penetrate the entire fleet system and spread quickly, causing devastating and costly consequences across the fleet.
Maritime cyber-risks can be classified into maritime transportation business disruption and maritime system execution failure, maritime data breach, theft or manipulation or loss of maritime information, theft or loss of funds from maritime sectors, and theft or loss of cargoes based on cyber-incident consequences (Curti et al., Reference Curti, Gerlach, Kazinnik, Lee and Mihov2019). The exemplified cyber-incidents are shown in Figure 4, and the detailed description and source link are illustrated in the Supplementary Materials. Cybercriminals can target the servers and computers of shipping companies, cargo management systems, the movement controlling and locating system, the customer service system, shipboard network and the positioning system, among others. Each component of electronic communications is vulnerable to cybercriminal attack. The purposes of cybercriminal activity can be to track illegal cargos and reroute them away from custom checking, producing fake bills to steal cargo and defraud money, infiltrating some information systems and stealing confidential data to request ransom payment, and disrupting internal administrative functions and destroying continuous operations, as well as diverting deliveries of unmanned ships. Cyber-incidents are mostly aimed at gaining profit from shockwaves among maritime transportation systems or increasing costs for the shipping industry.
Exemplified cyber-incidents
Another attack method is denial-of-service to prevent authentication access to the official system. Most of the GPS-spoofing instances appear around sensitive regions in Crimea and Russia during the periods when presidents and high-ranking officials were presented. These attacks emphasise the weakness and vulnerability of AIS because the widespread disruption for a huge number of ships causes navigation difficulties and changes in course, perhaps even collision accidents in congested waters. Questions of how to detect such attacks and prepare for the denial-of-service and develop countermeasures based on the big AIS movement data are worth exploring. The detailed database for maritime cyber incidents is included in the Supplementary Material, including the attack form, time of occurrence, targets, purpose, and potential results and costs, which are fully portable and extendible, and meaningful to further research incorporating real accident data.
3.4 Mitigating maritime cyber-risk
Scholars, industry experts, and government and municipal authorities have jointly advocated for more solid cybersecurity checks and balances in every part of the maritime system, navigator competency enhancement (Hareide et al., Reference Hareide, Jøsok, Lund, Ostnes and Helkala2018; Akpan et al., Reference Akpan, Bendiab, Shiaeles, Karamperidis and Michaloliakos2022) to recognise and deal with cyber-attacks appropriately, and a build-up of synthetic reliable systems, including raising awareness of cybersecurity, improving the competence of involvers, maintaining robustness risk estimation framework, deploying confrontational methodologies and models, and designing flexible counterpart plans (Amro and Gkioulos, Reference Amro and Gkioulos2022). It is essential to develop the incentive to actively collect cyber-attacks evidence with scrutiny of every part of the maritime shipping industry under every minor or significant threat. This requires in-depth actions at multiple levels, such as policy, technical, training, enforcement and implementation.
With respect to crews, raising awareness and training about cyber-attacks for crews can be an important solution to mitigate maritime cyber-risk. Vigilant seafarers who become highly situational aware and make wise navigation decisions onboard ships can be the most important asset for maritime security (Spidalieri and McArdle, Reference Spidalieri and McArdle2016; Hareide et al., Reference Hareide, Jøsok, Lund, Ostnes and Helkala2018; Lund et al., Reference Lund, Hareide and Jøsok2018b; Thant, Reference Thant2018; Jacq et al., Reference Jacq, Laso, Brosset, Simonin, Kermarrec and Giraud2019b; Pseftelis and Chondrokoukis, Reference Pseftelis and Chondrokoukis2021; Tam et al., Reference Tam, Hopcraft, Moara-Nkwe, Misas, Andrews, Harish, Giménez, Crichton and Jones2021a; Kayisoglu et al., Reference Kayisoglu, Bolat and Tam2022; Hopcraft et al., Reference Hopcraft, Tam, Misas, Moara-Nkwe and Jones2023; Potamos et al., Reference Potamos, Theodoulou, Stavrou and Stavrou2023). Converselly, the seafarers’ lack of competence and system awareness will present risk factors rather than risk reductions (Heering et al., Reference Heering, Maennel and Venables2020). The holistic framework to increase cybersecurity awareness and competence of seafarers includes theoretical education and practical training, and demonstrations and experiments, as well as assistance procedure development of identifying and dealing with cyber threats (Becmeur et al., Reference Becmeur, Boudvin, Brosset, Héno, Merien, Jacq, Kermarrec and Sultan2017; Zăgan et al., Reference Zăgan, Raicu, Hanzu-Pazara and Enache2018; Lovell and Heering, Reference Lovell and Heering2019; Tam et al., Reference Tam, Moara-Nkwe and Jones2021b). The cross-sector capacities in the overlapping domains of automation, digital system, robotic, artificial intelligence, cyber, maritime shipping and navigation are the skills requirements for intelligent maritime shipping (Harris, Reference Harris2021). Thus, the introduction of training for these key technologies means that various combinations of professional and interdisciplinary courses are essential in all short-, medium- and long-term cyber-security training of mariners.
In the case of ships, the protections and risk mitigations are comprised of controlling access to the shipboard network; limiting unauthorised personnel to access the information operation system, such as enforcing per-user accounts and passwords; adhering to security protection procedures; and timely updating of installed software for the ships and patching regularly, among others options. The owner of the vessels can extend cooperation with anti-cyber-attacks companies, such as Gatehouse Maritime and James Fisher Mimic, to invest and develop cyber-surveillance products and release a set of efficient patches to monitor, inspect, find and respond to suspicious incursions and to build solid firewalls to recognise and detect anomalies that are essential for early alert and avoiding serious impacts. Another important part of cyber-risks understanding and cyber-incidents detection is forming the forensic readiness of ships for seafarers’ training and management, as well as developing secure evidence-handling measures.
In the case of shipping companies, they must carry out regular cybersecurity assessments for their information management system to identify new security weaknesses and breaches, and install corresponding patches. This requires scrutiny in checking that the vessels are operated with a contracted crew formed from multiple layers of outsourcing to track assigned responsibility for the information technology system. Ship companies should introduce uniform security standards for technology, payment, organisation, analytics and automation (i.e. International Organization for Standardization, etc.) to decrease friction and enable communication between various cyber-risk control actions activated by different security platforms and products, as well as embrace ships, terminals, ports and stakeholders, forming coordination across the entire industry (Jensen, Reference Jensen2015). Most importantly, ship companies should be more proactive in assessing and responding to any risks in cybersecurity, no matter how minor or impactful. Finally, cybersecurity awareness and cyber-hygiene, as well as cyber-incident training for the personnel of the shipping company, is vital for avoiding or abating the damage of cyber-threats to shipping operations.
Regarding the shipping industry regulation, the maritime safety committee of the International Maritime Organization (IMO) released Resolution MSC-FAL.1 and MSC.428 (98) in June 2017, implemented in January 2021, to introduce measures to tackle cyber-risks in maritime safety supervision and management systems, and cyber-code has potential as a binding instrument to assure the security and improve the efficiency of the maritime industry in confronting cyber-attacks (Hopcraft and Martin, Reference Hopcraft and Martin2018). The new legislation will likely be ongoing to make sure that only vessels with the cybersecurity certificate issued by authorising institutions are allowed to operate and sail on marine.
The General Data Protection Regulation can also be applied to regulate the storage and processing of shipping data, for example providing data with the consent subjects rather than giving freely. Furthermore, backend databases must be queried weekly to identify new suspicious data according to malicious records. The maritime transportation industry should upgrade cybersecurity in accordance with advances in technology and information communication, such as integrating experts in cybersecurity products, devices, and services, as well as data protection. Moreover, the maritime cybersecurity management certification system should be built in the maritime industry to provide certification services for ships, ports, companies, shipping networks and communication systems. These can help the maritime industry to better prepare for serious cyber-attacks and develop counterattack strategies quickly, decreasing costs successfully.
Establishment of appropriate continuity plans is essential for countermeasures targeting cyber-incidents. That means that even though the worst event occurs, the maritime transportation system can continue to operate by utilising alternative modes and subsystems. That means applying the principle of creating maritime shipping system layers with independent information communication levels, to ensure the reliability of the transportation system. In order to counter the loss of critical systems, the standardisation of information transmission and interfaces and operations enabling integrate navigation and communications is meant to duplicate key components and strategy development. Frøystad et al. (Reference Frøystad, Bernsmed and Meland2017) believed that public key infrastructure solutions can protect future maritime domains through the introduction of authentication and cryptograph systems into the communication between ship and ship, as well as between ship and shore. However, the international trust hierarchy establishment requires a huge amount of both technical and political effort, and it may be the ongoing process after the standardisation achievement of worldwide maritime communication in the future (Figure 5).
Risk mitigation recommendation
3.5 Research gaps and promising avenues
Digitalisation and information integration will enhance the operational efficiency through earlier visibility regarding the transport modality of each ship, better yard planning for rail ports and heavy trans-shipment, and online management of logistics. However, the risk to the maritime shipping industry to cyber-attacks is rising as quickly as such solutions and defences are created. Cyber-attacks can be delivered inexpensively and from any place, which means it is almost impossible to detect and trace, but can cause serious damage. The goal of cybersecurity situational awareness and comprehension is to successfully recognise cyber-attacks, underline origins and causality, and assess potential consequences and impacts, as well as predict and project vulnerabilities in the future. Current works generally focus on analysis involved with simple cyber-attacks through concept methods, qualitative analysis and simple scenario-driven simulations. However, deeper and more sophisticated analysis is required to deal with complex attacks. For example, the technology and methodology are enabled to create the timeline of cyber-attack events based on search and mining over a huge amount of spatiotemporal heterogeneous information. It is worth mentioning that the principles of the graph and complex network theories are valuable to figure out streamlines and pivots among the linked information (Fang et al., Reference Fang, Yu, Lu, Feng and Huang2018b).
Researchers have tried to examine the cyber-attack incidents statistics, responsibility division, and counterpart strategy recommendation through a qualitative elaboration approach. Mraković and Vojinović (Reference Mraković and Vojinović2019) described the connectivity between the components in the systems of a ship and advocate the adequate proactive framework to solve onboard cybersecurity problems by integrating situation awareness, building competence, and solidification, and prediction to turn the conceptual framework into practical applications. Daum (Reference Daum2019) and Karim (Reference Karim2022) emphasised that the legal environment should keep pace with various advances in the cybersecurity domain of maritime shipping, including duty and sanction catalogue clarification. The IOM guidelines and regulations with specific and detailed maritime cybersecurity actions are precedents and predecessors for legislation and amendments. The complement of the legal environment may be realised in the near future. Ahvenjärvi et al. (Reference Ahvenjärvi, Czarnowski, Kåla, Kyster, Meyer, Mogensen and Szyman2019) discussed safe information exchange considering type, characteristic, mode and role, however they are still formulating the relative contents, as with the cybersecurity incidents sharing among navigation systems reported by Silverajan and Vistiaho (Reference Silverajan and Vistiaho2019). Maritime cybersecurity is confronted with numerous challenges from the perspectives of legislation and technology and implementation. All technological loopholes declassification and their impacts on the entire shipping systems evaluation are outside the scope of the existing research.
With respect to the abuse of AIS data, the means to detect these anomalies, deter the false sentences forwarding to official and navigational pages, and recover the true information and transmission are currently unknown. Perhaps the various popular machine-learning technologies can be applied to recognise anomalies and asymmetric cryptography works to protect the AIS data (Botunac and Gržan, Reference Botunac and Gržan2017). The cryptographic countermeasures will increase one layer of safety, including a key-pair of security (signature with private key and verification by the corresponding public key) and the specialised identity-based signature strategy(the public key with identity and no need to certificate) (Lund et al., Reference Lund, Gulland, Hareide and Weum2018a). Data encryption based on implementing advanced encryption standards and algorithms (i.e. Truecrypt, Blowfish) is the option for making maritime data acquisition systems more resilient. In addition, incorporating the multi-source data to generate the alternative results and cross-referencing the veracity with the ability to detect anomy driven by the application of Big Data Paradigm could also be a potential future maritime security enhancement (Spousta and Chan, Reference Spousta and Chan2016).
In addition, there is an essential shift from analysing the concept model of the maritime cybersystem to the real system, which requires defining the challenges and complex interdependencies instead of heavily relying on the instrumentation and functional block and unified modelling diagrams. Polemic and Papastergiou (Reference Polemi and Papastergiou2015) elaborated the MITIGATE project (Kalogeraki et al., Reference Kalogeraki, Apostolou, Polemi and Papastergiou2018a) evolution from CYSM and MEDUSA to define the methodologies used to identify multi-order dependencies among the vulnerabilities of cyber-assets and cyber-threats covering the multi-sector cross-border simulation scenarios to guide security knowledge representation; however, this is limited to application in the real port and supply-chain cyber-risk assessment without incorporating cyber-risk estimation reasoning results and potential cascading effects. The synergy of physical and computational components is the true way to develop the modern physical–cyber system (Tam et al., Reference Tam, Hopcraft, Moara-Nkwe, Misas, Andrews, Harish, Giménez, Crichton and Jones2021a). That indicates that more research is needed in this direction. Undoubtedly, we endeavour to conquer significant challenges to achieve the envisioning goals that pinpoint tangible maliciousness and provide resilience and security of maritime transportation, despite that fact that many factors, including lack of sufficient empirical data working for capturing, inferring, analysing maritime cyber-attacks, and hard-to-access obvious diversity of cyber–physical controlling and operating systems with complete and elaborative technical details that are related to privacy constraints enforced by maritime shipping and logistics.
The development of a blueprint for maritime cybersecurity training of ship crews and managers can be as important as the technical solutions. The workbook and guidelines published by IMO, the International Chamber of Shipping, the International Union of Marine Insurance and others can provide some support and guidance. However, there are some significant challenges that the maritime shipping sector must overcome in the nearest future for the cybersecurity training of crews. First, the collaboration between the educational institution and the shipping sector must be enhanced to ensure that there exists an adequate number of institutions to provided ship officers with specific cybersecurity education. Second, the International Convention on Standards of Training, Certification, and Watch-Keeping for Seafarers (STCW) should include a requirement for cybersecurity education and provide guidelines for the development of study materials in various native languages (Kidd and McCarthy, Reference Kidd and McCarthy2019). Third, the bachelor's and master's programs on water navigation in the maritime university should include cybersecurity courses that are comprised of theoretical cybersecurity knowledge and practical exercises based on simulators and cyber-attack vectors. The curriculum of maritime education and training methods of maritime professionals should keep up with technological innovation and prepare for future unmanned ships (Yamada, Reference Yamada2020).
4. Conclusion
With the increasing standardisation, informatisation, efficiency and automation of shipping systems, the systems seem to lose robustness proportionally, especially for cyber-attacks, and become vulnerable to small internal and external mistakes or impacts. The modernisation and robustness proceed in opposite directions in the maritime system. In other words, the current complicated maritime system is susceptible to disturbances and errors. Especially with the development of remote control technology and unmanned surface vehicles, experienced mariners will control and operate the autonomous vessel from state-of-the-art onshore facilities through satellite communications instead of through actual people on board. Therefore, maritime cybersecurity is vital in the current maritime industry. Participants take steps and actions to preserve servers, computers, control systems, communication systems, digital equipment and other components from stakes associated with insufficient cybersecurity.
Currently, maritime cyber-threats recognition and potential consequence assessment are mainly based on the conceptual model, theoretical framework, designation graph, qualitative methods and simulation, and thus quantitative methodologies are in great demand to fully consider physical and cyber interaction on cyber-risk estimation, reasoning results, potential cascading effects assessment and incident management practices. Maritime cyber-risk analysis, modelling and predicting are multiple-discipline domain research questions that require input from computer science, shipping agents, port authority, seafarers, technology management and others. Human knowledge, technology, and legislation are the primary pillars with respect to the cybersecurity process. Human training and education and legislation are ongoing processes. These are still great opportunities that encourage scholars from multiple disciplines to contribute to the related cybersecurity studies.
Alleviation of the cyber-risks and reduce cyber-incidents, the cyber-risk assessment toolkit that enables researchers to model cyber properties and interactions, analyse the dependencies among threats, identify vulnerabilities and disruption level, detect possible contingency requirement, determine and deploy safety countermeasures, as well as provide intuitive and interactive tools to represent, organise, and management all cybersecurity contents, is the central technology part of the collaborative security management and risk prevent system (Karantjias et al., Reference Karantjias, Polemi and Papastergiou2014; Papastergiou and Polemi, Reference Papastergiou and Polemi2014, Chiappetta and Cuozzo, Reference Chiappetta and Cuozzo2017). There are still numerous challenges to turn the concept into practice, such as the visualisation and analysis of the dependencies among business entities-based designation graphics, making it hard to reflect the interconnected assets. The collaborations among the cybersecurity management system foster the interaction and communication among different ports and all the operators and navigators to share and distribute information, knowledge, experience, skills and expertise. This communication and interaction can raise the cybersecurity awareness and culture and draw a more digital safety practice-aid strategy for the involved stakeholders. For example, the visualisation of vulnerabilities and risks offers quick and intuitive risk value and erroneous characteristics. Meanwhile, it will assist operators and managers to behave in compliance with the legislation and regulations. Maritime cybersecurity research is a multidisciplinary question that is worth cooperation among network security, maritime shipping, information communication and internet security entities.
Supplementary material
The supplementary material for this paper can be found at https://doi.org/10.1017/S0373463323000164.
Acknowledgements
This work was supported in part by the National Natural Science Foundation of China, No. 42101429; Open Fund of State Key Laboratory of Information Engineering in Surveying, Mapping and Remote Sensing, Wuhan University (Grant No. 21S04), Fund of Sanya Science and Education Innovation Park of Wuhan University of Technology (Grant No.2021KF0026), the National Key Research of China, 2022YFC3302703, and the Young Elite Scientists Sponsorship Program by China Association for Science and Technology (CAST) (No. YESS20220491).
Competing interests
The authors declare that they have no known competing financial interests or personal relationships that could have occurred to affect the research reported in this paper.
