KPMG, one of the largest professional services companies in the world, has issued a stark warning to the maritime industry that the open seas are the next playground for hackers.
Wil Rockall, director of KPMG’s cyber security, says that the cyber security of maritime control systems controlled by engineers and not chief information security officers (CISOs) and chief information officers (CIOs) are making these systems vulnerable to pirates, the new hackers.
“Most ports and terminals are managed by industrial control systems which have, until very recently, been left out of the CIO’s scope.”
“Historically, this security has not been managed by company CISOs and maritime control systems are very similar.”
“As a consequence, the improvements that many companies have made to their corporate cyber security to address the change in the threat landscape over the past three to five years have not been replicated in these environments.”
“Instead engineers have often been left to implement and manage these systems – people who focus normally on optimising processes efficiency and safety, not cyber and security risks. It has meant that many companies and their clients are sailing into uncharted waters when they come to try and manage these risks.”
Rockall added KPMG has found that one of the main blockers in improving this is a “real translation problem when corporate IT security teams attempt to impose their standards on industrial control systems or maritime control systems”.
“KPMG’s work with the operator of one of the largest fleets of crude oil and oil products tankers and liquefied natural gas carriers in the world, found that bridging that gap and coming up with pragmatic solutions to improve industrial control systems security without compromising process efficiency or safety, are vital to the success of industrial control systems cyber risk management.”
