Cyber Risk Comite Maritime（网络风险拉西的海上）.pdf

Cyber Risk A Joint Hull Committee paper in conjunction with Stephenson Harwood September 2015 Contents EXECUTIVE SUMMARY 1 JHC CYBER RISK ASSESSMENT GUIDANCE 2 PART 1 - THE ANATOMY OF A CYBERATTACK 4 PART 2 – DEFENCES 8 PART 3 –THE ASSESSMENT OF RISK 12 APPENDIX 22 REFERENCES 26 Executive summary An evolving issue There is no single answer to the question of cyber exposure and the meaning of cyber as an issue is often misunderstood. Leaving aside the Iranian centrifuges sabotaged at the design stage, the only proven physical damage loss triggered by cyber to date has been at a German smelting plant which was damaged when a safety device was disabled. No identified systemic risk to ships The risk of a loss to a ship as a result of cyber disruption is foreseeable, but is not yet a reality. A systemic threat which could conceivably result in multiple losses on a scale which might impact the solvency of the world’s insurers and reinsurers does not yet exist. For example, even if electronic navigation systems were disabled, a ship would still be able to manoeuvre and could either anchor or navigate using more traditional means (provided that the skills to do so exist on board). There is time for owners and operators to plan and ensure that computer systems on board ship and ashore are as secure as is reasonably practicable. Growing exposure Ships are mostly isolated units but as shipping embraces information technology, it becomes exposed to cyber risks some aspects of which are already well known in retail and banking. As the International Maritime Organisations E-Nav programme gains momentum, the technologies required, as well as the aligned commercial demands of an ever more interconnected world, will increase the exposure to loss as a result of a cyber attack or intrusion. Specialised vulnerability This report argues that the risk of loss or damage caused to or by a ship as