Use of a Cybersecurity Laboratory in Support of the Virtual Vessel Concept to Increase Safety Onboard Marine and Offshore Assets

Abstract

Abstract Owners and operators of marine and offshore assets must understand what is on "the wire" in their automated and highly-integrated systems. This information allows them to define the transforming functions where virtual data is converted into actionable cybersecurity knowledge. The ABS virtual vessel concept is the computational representation of the data that is sensed, stored, analyzed and transferred as actionable information on a marine or offshore asset. This paper discusses the concept through experiments designed to evaluate assumptions and hypotheses in a purpose-built cybersecurity test laboratory. Increasing use of integrated control systems onboard the assets and complex integrated technology in the maritime and offshore industry to manage business comes with a higher risk of cyberattacks. These attacks are getting more sophisticated and, in many cases, can have significant impacts on critical areas of operation. Maritime control system software is not constrained by the same physical laws that predict the physical behavior of equipment and vessels. Software systems behave differently and are evaluated by very different metrics. Because behavioral and security test methods are often conducted on in-service assets, comprehensive testing is impractical and potentially hazardous to perform onboard an asset. Therefore, assessments of cybersecurity solutions and guidelines are performed more on simulated systems in a laboratory environment rather than on actual in-service systems. ABS is developing cybersecurity "use cases" in which patterns of cybersecurity threats, risks and solutions can be examined, characterized and gauged using field device level information for marine and offshore systems. This research can help the industry understand the nature and risks imposed on virtual vessel computerized elements and inform the development of guidelines and rules to increase the safety and security of real vessels. This paper describes the process of building a cybersecurity lab and research capabilities for marine and offshore assets. Specific projects examine current maritime, government and private sector approaches to research, identify and characterize cybersecurity events in maritime industrial control systems.