Collaboration set up to combat increasing cyber risk

Tenable OT’s product is based on gaining a full inventory of a vessel’s software so that it can gain a complete understanding of what is behind the screens, monitor vulnerabilities and communicate risks with a view to prioritising necessary actions.

”There are always some unique risks with maritime, like tampering with the sensoring – faking where the vessel is going, pretend it’s somewhere it’s not – but most of the risks are like those in other industries,” says Matti Suominen, director Maritime Cyber Security at Wärtsilä.

“It’s a business now. Anyone who wants to run crime as a business can do it from anywhere now, and it’s people trying to earn money – which means it’s tricky because you are facing people who have the financial means to carry this out and they are able to make a very good living out of it.”

He says research shows that businesses are paying up to ransomware criminals, although it is difficult to get statistics because victims rarely report it. It’s only a matter of time before it gets worse in the maritime sector, he says.

“We’ve been looking for the perfect tool for about six years, starting with power plants,” says Ross Bailey, cyber security expert at Wärtsilä. “We decided on Tenable OT, which uses proprietory protocols to do active scanning. A lot of these tools are passive scanning – they use a SPAN port to look at traffic on the network and do analysis like that – but what we wanted was this active scanning so that we could actually query PLCs (programmable logic controllers) in a safe way but also at factory acceptance testing. It’s very impressive, the amount of information you can extract.”

An asset list is thus created, which is added to Tenable OT’s database – which customers can see, and which Tenable OT can alert them to if they notice anything unusual – with the ultimate aim of setting up digital twins, perhaps for a vessel or for a power plant system.

In the past, the suppliers who installed the equipment for Wärtsilä’s customers created an asset list in an Excel spreadsheet. The manual process was time consuming, error prone, and only relevant for a specific point in time. Technicians had to merge files when new devices were added.

“The workflow of the Tenable OT Security tool was a great fit for our own needs but beyond that, we realised that using the solution allowed us to develop and introduce new services to benefit our customers too,” says Bailey.

“One of the key reasons that people look at the Tenable product suite is that we provide coverage for a variety of cyber security installations – in this case our OT product – which is really good for industrial installations,” says Marty Edwards, vice president of Operational Technology Security at Tenable OT.

“If that was a cargo ship, for example, going into a port, it’s likely that the cranes and industrial machinery in that port were also being monitored by Tenable OT solutions – Tenable cyber solutions literally span all aspects of a business, whether it’s a floating ship, or a cloud-based e-commerce platform, our customers can get the data they need and we can put it into a common, analytical platform.

“One of the challenges in the past was these solutions were specialised – the ship’s systems didn’t necessarily communicate with anything else.”

Threats growing visibly within five years

“I would say that the maritime industry is in a bit of a state where we are starting to get the push from the market,” says Suominen. “Five years ago, cyber security wasn’t a major theme – now we are at the point where it makes a lot more sense to be aware. We are definitely early rather than late on this one. But I think a lot of companies are outsourcing this kind of thing that they can’t do in house.”

Tenable has been in business for more than 20 years, and acquired a company in 2019 that designed and patented the specific capability to do this sort of thing – the ‘black box’ computers in ships that also exist in water treatment plants or power grids around the world, says Edwards.

“So we integrated our expertise from the IT side of the house and specialised expertise from the OT side, to come up with a tooling technology that enables you to query the status of an asset no matter what that asset is,” says Edwards. “We basically build a map of all these devices on a vessel and how they communicate with each other, to continually evaluate the threat against these networks.”

”There are a lot of requirements coming out now, new cyber requirements going into force next year,” says Suominen. “Some owners know, some of them don’t. We are becoming one of those industries where cyber security is becoming part of the daily work, and solutions like this one are part of how we tackle those problems. It’s not just something that IT nerds are doing somewhere else that’s not my problem.”