# Formulating Cybersecurity Requirements for Autonomous Ships Using the SQUARE Methodology
## 5 Conclusions  
Ship sensor data affects the AI perception, judgment, and control, and AI, in turn, affects the ship control. In autonomous ships, individual systems are not independent; each system plays its own role and generates data that affects other systems. Cybersecurity threats can also affect not just one system but the entire autonomous ship. Autonomous ships, as anticipated, reduce operating costs and maritime accidents, and if an accident is caused due to a cyberattack on an autonomous ship, it will be difficult to achieve its goals. Hardenings, such as logical access control, separation of duties, and enhanced account security, should be relatively easy to apply. However, if hardening cannot address the problem due to the nature of ships, even if a security defect is discovered, a great deal of effort and money are necessary to take the appropriate measures. Therefore, to prevent cyberattacks, each component of the ship system must be designed so that they do not affect other systems during cyberbreataches.  
In this study, we investigated the vulnerabilities and threats in ship systems and AI technologies. We also investigated and analyzed potential cyberthreats to the AI technologies used on autonomous ships. As autonomous ships are still in the research stage, more advanced systems will, perhaps, be applied during the commercialization phase. The convergence of existing ship systems with AI technology also poses the possibility of new unidentified threats. Other studies pertaining to cyber risk and security requirement derivation for autonomous ships [4; 29] are limited to ship systems. In order to respond to new threats, we have presented attack scenarios utilizing currently existing threats when fused alongside artificial intelligence technology and applied security requirement engineering to derive minimum security requirements for autonomous ships. Our work provides motivation to think differently of the research direction of autonomous ship cybersecurity.  
In recent years, international organizations such as IMO and IACS have emphasized the application of cybersecurity on ships. Autonomous ships will require the same or higher level of cybersecurity than is currently required. Therefore, there is a necessity for cybersecurity research on to-be-applied AI technologies and autonomous navigation systems based upon a comprehensive understanding of the maritime cyber risk environment. Through cooperation and research between stakeholders in the shipbuilding and marine industries and the security industry, security requirements that must be applied in the design stage should be devised to ensure the safety of autonomous ships. It is believed that applying ship-specific penetration testing and risk assessment methods will lead to more in-depth security requirements. We look forward to the internalization of cybersecurity in autonomous ships by means of our research.  
Conceptualization, J.Y.; methodology, J.Y.; validation, J.Y. and Y.J.; resources, J.Y. and Y.J.; writing--original draft preparation, J.Y.; writing--review and editing, J.Y. and Y.J.; supervision, Y.J.; project administration, J.Y.; funding acquisition, Y.J. All authors have read and agreed to the published version of the manuscript.  
**Funding:** This research was a part of the project titled 'Development of network-based deception system for smart ship cyber threat response' funded by the Ministry of SMEs and Startups, Republic of Korea (No. S3218804).  
**Institutional Review Board Statement:** Not applicable.  
**Informed Consent Statement:** Not applicable.  
**Data Availability Statement:** Not applicable.  
**Conflicts of Interest:** The authors declare no conflict of interest.