Briefings
Cyber security – the increasing threat to your business, May 2017
At the last count, it was estimated that Friday’s cyber attack impacted upon 200,000 victims in at least 150 countries. The attack used “WannaCry” malware to disable computer systems and present users with a ransom demand. The systems which suffered the attacks are said to have been vulnerable as they were operating outdated legacy software and because security upgrades had not been properly installed. At the time of writing this article, there is concern that the actual scale of this attack may not yet be known.
There has been a tendency by some in the shipping, ports, offshore and logistics industries to suggest that cyber security is not a real concern and that a cyber attack on their business is unlikely. However, this attack did not discriminate between the private and public sectors and it is likely that a number of shipping companies have been affected. Known victims of the attack are said to include:
- The British National Health Service where 48 trusts were affected and seven are still trying to restore systems (at the time of publication).
- Renault who halted manufacture at plants in France and Romania to prevent the spread of the malware.
- The German rail operator Deutsche Bahn who reported that some electronic announcement signs were infected.
- International express business FedEx Corp which said that some of its systems were breached.
- Telecommunications companies including Telefonica in Spain and Telecom in Portugal.
For these companies and many others, the weekend will have been spent frantically trying to identify where their operations were exposed, patching and restoring systems using back-ups, mitigating the risk of further breaches and trying to reassure customers and contractual counterparties that matters are under control. For many companies, repairing the damage of this attack may take several weeks if not months. Repairing the damage to a company’s reputation may take even longer.
It is now clear that no industry, however sophisticated, can consider itself immune from a cyber attack. The shipping, ports, offshore and logistics industries, with their reliance on electronic operations, have long been identified as being particularly vulnerable. If the industry needed a wake up call then perhaps this was it.
Shipping and logistics operators, offshore suppliers and ports and terminal operators should now be scrutinising their systems and operations to ensure that they have taken the necessary precautions to protect their business. Although there is little by way of national or international cyber legislation, there are now various guidelines, principles and recommendations that can assist with this process. Taking a pro-active response to risk also involves reducing the ‘human threat’ by educating employees and crews about the threat and how it may manifest itself. Identifying the risk and mitigating it should go hand in hand.
If they have not done so already, shipping, offshore, ports and logistics companies should be:
- Identifying the areas where they are exposed to cyber risks and vulnerabilities in the supply chain.
- Developing and testing written information security and incident response plans.
- Putting the incident response team through simulated exercises to see where the ‘gaps’ are.
- Making sure that suitable insurance (or contractual protection) is in place to cover any ‘gaps’ in cyber security.
Depending on the nature of the breach, there may be also be mandatory regulatory requirements which will need to be understood and acted upon.
HFW is a leading sector focused law firm with particular expertise in maritime crisis management and is able to assist you with your cyber security needs. We can help with crisis planning to avoid breaches and minimise their effects after a breach has occurred.
For more information, please contact Matthew Montgomery, Senior Associate, London, on +44 (0)20 7264 8403, or matthew.montgomery@hfw.com, or your usual contact at HFW.
