Petya, the maritime sector and wolf packs Two

My previous article on petya indicated that it was not clear if this cyber attack was motivated by ransomware or the more destructive wiper. It is still being assessed and there is some discussion as to who was the main target. However the Ukraine seems to have experienced the most disruption. So whilst it is reasonable to conclude that the maritime sector was not specifically targeted by petya, it is fair to say that this is the first substantive attack that has had worldwide impact upon maritime operations. The attack started on 27 Jun and AP Moller-Maersk have stated that they expect their operations to return to normal by Mon 3 Jul. Maersk have reported that they have experienced multiple disruptions around the world: they were unable to handle cargo at some sites and some APM terminal operations were shut down. In addition, the USCG reported that the petya attack against (non US) business systems resulted in “disruptions in business continuity, cargo shipping and shipping in certain US ports”.

The maritime sector is aware that the IMO have proposed making “cyber risk management onboard ships mandatory” by 2021 and the USCG have consistently advocated a risk management approach. However, whilst Maersk responded in a proactive manner, others may not be as well prepared and waiting until 2021 may not be prudent. The world economy depends on the efficient and uninterrupted movement of good and it expects the maritime sector to be resilient to cyber attacks. The petya attack on Maersk and others demonstrated the vulnerable of the maritime sector to cyber attacks. The Sea Lanes of Communications are not yet been targeted by the cyber equivalent of WW2 “wolf packs’, however, the maritime sector has now experienced its first significant worldwide event and needs to be better prepared for future cyber attacks/events. We have the opportunity to learn from this recent incident, by choosing to improve our cyber resilience, bringing forward (to 2018 vice 2021) the IMO proposal to ensure that cyber risks are appropriately addressed in ship management systems and by implementing more robust cyber security strategies.