Building cybersecurity in maritime world

The talk follows Swan, a 54-metre ferry that Rolls-Royce's research centre in Turku converted into a demonstrator for autonomous navigation. The cyber security lead on the project starts by separating levels of maritime autonomy, from crewed ships with automation up to fully autonomous vessels, and notes that autonomous and uncrewed differ. Because international conventions said little about autonomous ships, the team built its design on class society rules, a US Coast Guard maritime profile of the NIST framework, and the failure-mode methods Rolls-Royce already used for aircraft engines.

The team concluded that a ship and its shore station needed separate architectures, since a vessel must fail safe without a human while a remote operator is always present. Systems were containerised, duplicated and isolated behind one-way links, with a goal of distributed, immutable and ephemeral components and a minimal attack surface. Security testing exposed navigation equipment that could be manipulated to shift the ship's position. Because satellite links were slow and unreliable, the remote station received a computer-generated view built from lidar point clouds instead of video.

Two weeks before the voyage, a suspicious connection to a Ukrainian server raised alarms. It turned out to be a time server misconfiguration combined with a network misconfiguration that hid the outgoing traffic. The maiden voyage in December 2018 carried about 120 passengers, with roughly half of the 42 minutes in autonomous mode and the rest under remote control. The main takeaways: security incidents often become safety incidents, so plan for fail-safe states and do not hesitate to get outside help.