A framework for cybersecurity assessments of critical port infrastructure

Nearly all global economic trade flows through the ports and a broader intermodal transit system in which supporting technology networks are often privately owned and operated. The majority of government oversight and industry cooperation focuses on physical access and the safe construction and operation of ships. The cybersecurity of critical maritime and interconnected infrastructure remains largely unregulated with minimal, if any, assessment or mitigation of cybersecurity risks. These critical infrastructure networks encompass industrial control, SCADA, and information technology systems — much of it proprietary and dependent on operational support or interdependencies in intersecting domains, from energy to transportation. While many operators of the infrastructure are concerned about cybersecurity, the complexity of their systems, interdependence with other sectors, and an outsized public interest in mitigating cyber risks against such crucial economic arteries demonstrates a compelling need for standardized frameworks for assessing cybersecurity risk in the maritime domain. Our work identifies cyber risk factors affecting maritime infrastructure, present barriers to mitigating risks, and proposes the creation of an independent public/private entity for assessing, containing, and mitigating potential risks.