# Maritime Cyber Security: A Global Challenge Tackled through Distinct Regional Approaches
## 2 Literature Review
### Maritime Transport Sector  
The maritime transport sector consists of three main components: (1) mobile assets, (2) infrastructure, and (3) financial activities. Specifically mobile assets include: ships and auxiliary platforms. Infrastructure often described as maritime critical infrastructure includes: port infrastructure, offshore energy infrastructure, safety and security controls, navigation aids, communication systems (onshore, offshore, satellite), underwater cables, and pipelines. Finally, financial activities include: insurance agencies and vendors, booking/charter agencies, and banking-economic transactions [10].  
Raising awareness is a challenge in the maritime transport sector, as senior maritime transport stakeholders are struggling to understand the changing risk environment. Identifying how cyber threats are affecting their organizations and allocating the necessary resources to address this is not straightforward. Staff engaged with cyber security are struggling to provide concrete evidence regarding the return on investment (ROI) for cyber security measures. This is becoming more difficult due to the abstract nature of cyber threats. Unlike piracy or extreme weather conditions, the consequences of a cyber breach are not always visible.  
Safety and security at sea has paramount importance for shipping, a sector with a good safety and security record of accomplishment. Cyber security has been identified as a key part for maintaining safety and security for ships and port operations. Managing cyber threats, according to the Maritime Security Strategy [11] and the related Action Plan of The European Union (EU), is integral to achieving maritime transport security. NATO acknowledged the importance of the maritime cyber security back in October 2016, when it organized the first dedicated maritime cyber conference at the NATO Maritime Interdiction Operations Training Centre (NMIOTC) in Crete [12]. A key initiative aiming to contribute to the better understanding of cyber risk is the International Maritime Organization (IMO) guidelines on maritime cyber risk management (MSC-FAL.1/Circ.3) and the consequent IMO resolution MSC 428(98) (July 2017) on maritime cyber risk management in safety management systems [13; 14]. The latter document suggests that, as of 1 January 2021, all stakeholders engaged in the industry should demonstrate cyber capability.  
As cyber risk management is now a requirement of the IMO, it would be expected that all maritime transport stakeholders should take similar actions in meeting this requirement and, consequently, address cyber risk within their operating environment. This is not the case, though. Maritime transport stakeholders around the world adopt a different posture to the issue. One key reason for this is that the origin of each individual reflects their level of understanding of a specific topic, including cyber security, as demonstrated in Section 3. Specifically, the maritime transport sector is multinational in nature as several stakeholders from various countries are involved. Typically, a ship may be registered in a particular flag state but may have a crew of many nationalities, none of whom may be from that country. The owners may be from different countries and the vessel operator may be from yet another country.