News Content

US ports step up cyber security defences to reduce risk of attack

US PORT authorities are urgently seeking ways to prevent terminal operating IT systems from cyber attack while still sharing information to improve supply chain performance.

Renewed urgency has been triggered by the June hack on the Maersk Group, which was an industry-wide wake-up call.

Port authorities told JOC's Port Performance North America Conference that they had taken steps to assess the security of their computer systems.

Port of Virginia CEO John Reinhart said the port believes that it is no longer a question of "if" an attack happens, but "when", reported IHS Media.

"I think we are all in the same place," Mr Reinhart told the conference, speaking on a panel with five other port heads who had examined the problem.

"Let's assume we are going to get hit. How quickly can we shut it down and then get it back into operations? And try to shorten the time to recover. So it's one of the things that keeps us all awake at night," Mr Reinhart said.

However, that task is made more complicated by the rising demand for ports and other stakeholders in the supply chain to "connect" with each other, said the Northwest Seaports Alliance chief operating officer Dustin Stoker.

Demands by beneficial cargo owners (BCOs), logistics providers and other stakeholders in the supply chain for more "visibility", so that they can better track cargo and prepare for its arrival, increasingly require players to share information. That requires their computer systems to talk to each other, which potentially could provide an entry point for a cyber attack.

So even as the ports and other stakeholders "are doing the right thing and trying to connect, trying to get more stakeholders to exchange data", Mr Stoker said, they are also raising the risk of a hack. That risk was smaller in the past, because if a single terminal fell victim to a cyber attack, it was only one terminal not the entire network, as could happen now, he said.

"So security becomes ever more important as we are doing the right thing in trying to integrate the supply chain," he said. "The cyber security portion is going to become ever more a risk factor that we have got to make sure we are accounting for."

The attack on Maersk by a virus dubbed Not Petya was part of an attack that compromised an estimated 2,000 systems in Europe and North America, according to computer security firm Kaspersky Labs. Aside from the shipping line business, Maersk units affected by the virus included its terminal operating arm APM Terminals, and its forwarding unit, Damco.

Two cyber specialists speaking on a different panel at the conference said that although the attack heightened the shipping industry's awareness of the need to prepare for cyber attacks, many companies are still vulnerable to major disruption from such an attack.

Yet many companies have taken few serious steps to protect themselves, said law firm Mitchell Silberberg & Knupp partner Susan Kohn Ross.

Ms Kohn Ross said she sees a lot of companies, especially smaller companies, who have the attitude of: "Jeez, I can't do anything about it anyway. So I am just going to hope for the best."

The port executives, however, said they regard cyber security as a top priority.

Although companies cannot completely eradicate the possibility of an attack, they can limit the risk, and the impact, said Ms Kohn Ross. That includes looking at all the ways that external computers connect to a corporate computer system and offer a hacker a potential way in. That list now includes smart phones and the "internet of things" (IoT), including webcams, refrigerators and televisions.