Cyber security is highly relevant to a raft of autonomous and remotely controlled systems including Marine Autonomous Surface Systems (MASS), Unmanned Surface Vessels (USVs), Remotely Operated Vessels (ROVs) and Autonomous Underwater Vessels (AUVs) able to operate from Remote Control Centres (RCCs) often referred to as Unmanned Underwater Systems (UUVs); and to Unmanned Aerial Vehicles (UAVs) commonly known as drones. IMCA has recently published a 3-page Information Note on the subject.

As information technology (IT) has advanced, the opportunity for cybercrime has also increased. Technological advances now make USVs common place with many of these small craft (< 5m) already in use for survey operations. Future larger systems will have varying levels of autonomy ranging from remotely controlled vessels operated from a shoreside RCC to, eventually, fully autonomous vessels.

These will use situational awareness sensors to assess and decide appropriate courses of action (albeit monitored from shore with a human override/final decision mode). These systems rely on data from sensors on various parameters communicated to the RCC for control and monitoring purposes. Robust and secure communication systems are central to their operation and performance.

IT cyber security remains of prime importance for any USV, UUV or AUV operation but operational technology (OT) must also be incorporated into the cyber security system.

Traditional IT cyber security protects the IT system and data held in it, whereas OT cyber security protects the complete system (vessel, people and environment).  

The traditional IT-based definition of cyber security is:

• Technologies, processes, and practices designed to prevent malware from doing damage or harm to networks, computers, programs, or data

But modern, distributed, interconnected remote systems demand a more comprehensive and robust OT-based cyber security system defined as:

• Technologies, processes, and practices designed to prevent the intended or unintended use of a cyber technology system to do damage to the cyber technology (networks, computers, programs, data), and vessel, or harm to people, and environment

To achieve this level of protection we need to be able to verify the satisfactory performance of the OT cyber security system by ensuring correct, safe, efficient and reliable operation through software quality engineering; and also preventing malicious and non-malicious threats through the cyber security system.

Functional testing will help assess a system against known errors or threats but makes no allowance for, as yet, unknown events. Using a maturity model provides ongoing monitoring, assessment and improvement to a cyber security system and will help defend against these unknown events.

To be comprehensive, an evaluation of any system must include the processes used by the technology system owners, designers, users and suppliers, and should consist of active audit and testing of known threats, access points and protection from potential threats such as spoofing and phishing using penetration and scanning tests.

One final consideration is the stage in the life cycle where these security measures are applied. Ideally, they should be integrated as part of the initial design. Robust security systems are much harder to ensure when viewed as an afterthought and their safety is harder, maybe impossible, to guarantee. Each component of a system, where threat access could occur, should have adequate threat protection designed and built in by the equipment manufacturer.

The London-based Willis Towers Watson consultancy estimates that human errors led to 90% of cyber security claims it has assessed. So, high levels of training and competence are both essential for following the (see illustration) Athens Group’s sensible ‘Identify, Detect, Protect, Respond, Recover’ strategy.