# Cybersecurity Challenges in the Maritime Sector
## 5 Security and Safety Countermeasures
The shipping community must implement a Public Key Infrastructure (PKI) for the electronic trust system to function; this is because the PKI will allow users and systems to validate the legitimacy of certificate-holding entities, while also securely exchanging information among them. Many PKIs are already in operation, with the majority being established on a commercial basis by private entities. A shipping PKI with the IMO as the top trusted entity (\"root Certificate Authority (CA0\") and flag states directly underneath can be set up [75]. Flag states have the authority to issue new keys and certificates to coastal state authorities, ships flying their flag, recognised organisations, ports, and others who require an internationally available public key certificate. Certificates can also be issued to ship owners or other organisations that play important roles in the international shipping community for secured communication and sharing of digital information [76]. The study in [77] indicated that based on spatial correlation, an antenna array structure is used to detect and mitigate spoofing signals. This method can detect interfering signals, and array calibration is not required or any array orientation information. This technique is capable of effectively distinguishing spoofing attacks that use a single transmit antenna. Furthermore, because all spoofing signals share the same propagation channel properties, their performance is unaffected by multipath propagation. Since it requires the use of multiple antenna branches, this procedure increases the hardware complication of the GPS receiver, because it must acquire and track both spoofing and authentic signals to distinguish spoofing PRNs; this method increases the computational density of the GPS receiver. In addition, third-party access to systems, such as remote access solution providers, can be problematic because it is difficult to determine the security posture of these organisations and their networks are not typically included in security assessments. This should be performed in a manner that is confirmed by an entity actually present on the vessel. It is important to evaluate each of these factors to reduce the likelihood of a security vulnerability that could allow an attacker to access a ship's system or traverse the network without obstruction [33]. One of the first steps in mitigating a potential attack is to be aware of the vulnerabilities, which are essentially a niche in the network. However, integrating a comprehensive security plan into the ship's network systems provides the most effective way to prepare for the worst and know how to get back. To achieve this, a comprehensive risk assessment should be carried out, and this will assist in the development of a robust cybersecurity risk strategy. In the maritime security policies, the human factor plays a significant role within an organisation, as this can be the weakest link, but on the other hand, the first defence in the cyber chain [33, 78, 79]. Under this prism, the human factor becomes even more challenging with a complex interconnected ecosystem such as the one that exists in the maritime sector. Ships, ports, and third-parties are often operating with rotating crews with different levels of cybersecurity understanding, who may not be fully familiar with the safe operation of the related systems and established cyber hygiene practices. A lack of a cybersecurity culture may be beneficial to any attacker that wants to gain access to a vessel and its systems, steal actual information, or disrupt the vessel's operations. Hence, there is a critical need in the maritime industry to enhance the level of awareness and understanding related to the actual cyber risks. The most effective way to achieve this is with the promotion of a cybersecurity culture that, among others, includes cybersecurity awareness training, education, and certification for the relevant parts of the vessel's operation (crew, third-parties, ports, operators) [60].