Estimating economic losses from cyber-attacks on shipping ports: An optimization-based approach

Abstract

The Maritime Transportation System (MTS) accounts for more than 80% of global merchandise trade in volume and roughly one-sixth of the Total Gross Output of the United States. Given that national and global economies depend upon efficient supply chains, port stakeholders must develop security plans to respond to all hazards, natural and manmade. Given recent cyber-attacks affecting shipping ports, along with the multi-billion dollar cyber insurance gap, ports need to understand the tradeoffs between increased competitiveness and higher risk through investment in automation and advanced logistics technologies. This article addresses the need to understand the economic impact of cyber-attacks that affect shipping port operations and thereby enable risk assessments that holistically evaluate interactions among port Information Technology (IT) and Operational Technology (OT) systems. Using a Nearly-Orthogonal Latin Hypercube (NOLH) experimental design, we construct transportation disruption profiles based on actual cyber-attacks that specify the range of operational effects of IT/OT dependencies on stakeholder transportation assets. To capture the costs of the physical disruption, we extend Boland et al’s Dynamic Discretization Discovery (DDD) algorithm to capture capacity constraints and enable delay modeling to accommodate commodities arriving late due to disruption. Economic loss functions for seven commodity categories based on the willingness to pay literature are used to compute delay costs so that stakeholders can estimate the range of economic and operational impacts within a disruption profile. Results based on data for cyber-attacks on landlord port and terminal operator assets provided by Port Everglades, FL illustrate impacts at $80,000 and $1.2M on average during one week in October 2017 and at $141,000 and $2.8M for May 2017 respectively. The runtime performance of our enhanced DDD algorithm improves on the state of the art by an order of magnitude and on larger problem sizes based on real-world port networks.