# Cybersecurity Challenges in the Maritime Sector
## 3 Cyberattacks on the Ship Automation Systems
### IT Network Systems  
Several types of networks are used in the maritime industry for the transmission of the data gathered and processed by networked information systems. Examples of these technologies include SHIPNET, SAFENET, C3I system, RICE 10, SHIP system 2000, Smart Ship, and TSCE [24]. These technologies have many security vulnerabilities because the design and configuration of communication links between IT networks pay little attention to authentication and encryption methods, resulting in potentially vulnerable and outdated systems being available on the Internet. Actually, shipboard information technology systems are frequently linked to onshore facilities, increasing the risk of systematic and continual threats [49]. Financial pressures, legal requirements, and remote monitoring and management requirements increase the need for IT systems and network connectivity in the modern shipping industry; however, these systems will increase the size of the attack surface that security teams must defend [3, 12, 46] and create additional points of access that hackers could use to enter the ship's system. Therefore, vulnerabilities in these automated systems should be investigated carefully. Further, critical control networks must be isolated from the ship's IT and Internet networks in a secure area.  
Moreover, the human factor becomes even more challenging with the complex interconnected ecosystem in the maritime sector. Therefore, a lack of a cybersecurity culture may be beneficial to any attacker that wants to gain access to a vessel and its systems, steal actual information, or disrupt the vessel's operations. Table 2 summarises the main vulnerabilities of modern and autonomous ship systems and their consequences.  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Systems** & **Vulnerabilities** & **Consequences** \\ \hline \multirow{4}{*}{Automatic Identification System (AIS)} & - Signal interference & - Ship hijacking \\  & - False information sharing & - Destruction of data \\  & - Malware & - Theft of valuable data \\  & - Spoofing & \\  & - No encryption & \\  & - Signal jamming & \\ \hline Electronic Chart Display Information System (ECDIS) & - Obsolete OSs & - Loss of communication with the NS \\  & - Insecure update mediums & - Hijacking of a ship \\  & & - Sensitive data theft \\  & & - Compromising computers and OSs \\ \hline \multirow{4}{*}{GNSS and GPS} & - Jamming attacks & - Ship hijacking \\  & - Weak signal strength & - Problems with the NS \\  & - Interference & - GPS signal false information \\  & - Spoofing attacks & - Disrupt vessel operation \\  & - DoS/DDoS attacks & - Delays in services \\  & - Packet modification & \\ \hline \multirow{4}{*}{Radar} & - Jamming attacks & - Loss of communication with the NS \\  & - Spoofing attacks & - Loss of lives and cargo \\  & - DoS/DDoS attacks & - Delays in cargo management \\ \hline Global Maritime Distress System (GMDSS) & - Malware & - Wrong position of the ship \\  & - Spoofing attacks & - Further attacks on ECDIS \\  & - DoS/DDoS attacks & \\ \hline \multirow{4}{*}{Industrial Control Systems (ICSs)} & - Inadequ ACM & - Ship hijacking \\  & - No support for integrity check & - Unavailability of the ICS \\  & - Information exposure & - Data leakage \\  & - Poor patch management & - Physical damage to facilities \\  & - Hardware failures & - Interference with safety systems \\  & - Improper security configuration & - Unplanned shutdowns \\  & - Lack of network segmentation & - Damage to equipment \\  & - Weak password policies & \\  & - Lack of firewalls & \\  & - Lack of encryption & \\  & - Weak remote access policies & \\  & - Weak USB policy & \\  & - Lack of training for SOS & \\ \hline \hline \end{tabular}
\end{table}
Table 2: A summary of the main vulnerabilities of modern ship systems and their consequences.