ISM Code and Maritime Cyber Security

 

The increase in use of technology aboard vessels brings the increased risk of security hacks aboard vessels as also in companies. IMO in its guidelines to Administration has asked them to get companies and ships flying their flag to put cyber-security measures in place. Cyber security measures in ISM training got prominence after the major cyber hack on Maersk Line. There have been a few other hacks on the maritime systems since then including not too long ago aboard a chemical tanker off New York.

The ISM code uses a process-based approach to maritime safety management systems. This process-based approach is the same as prescribed by ISO 9001 as also by ISO 27001 for information security management systems. Incidentally ISO 27001 is also once of the standards prescribed by the FAL circular for implementation of cyber security controls and best practices. ISM training for personnel should include awareness of potential cyber risks and what are the measures that personnel aboard should take to prevent a cyber security incident/breach.

ISM training, on cybersecurity measures, may include measures to take such as regular updates of anti-virus software, not to connect any external pen-drives to the ship/office framework, not to divulge passwords as also to regularly change passwords, to ensure that information packets sent between ship and office are encrypted. Electronic operational equipment too needs to be protected based on the risk they present and if they are connected to the internet. Many ships these days have remote sensing equipment as also remote-control equipment based on the Internet of Things (IoT) concept.

Per the ISM code and as ISM training candidates will learn companies need to have someone similar to a DP assigned to deal with emergencies at all times as also to provide the vessel with support/resources as needed. The ship and company both will need to have controls for equipment defined based upon the risk assessment conducted. Emergency response procedures will need to be defined as also tested on a periodic basis. Non-conformities and breaches need to be identified and acted upon to prevent recurrence.

Reviews of the system will need to be done at periodic intervals to assess the effectiveness of systems and ISM training auditors will need to conduct audits of the cyber-security system to assess how well the system is working. Maintenance of cybersecurity measures including hardware and software will need to be ensured as also protection against malware and phishing emails. The crew should be aware of how to identify a phishing email and whom it should be reported to.

ISM training for all personnel is important to ensure they understand their contribution to the system and its effectiveness as also how they impact the system when they do not.