Pirates exploiting cybersecurity weaknesses in maritime industry.

• Author: Frodl, Michael G.
• Position: Viewpoint

* The increasingly common hacking attacks on government and private computer networks are now being perpetrated on companies and organizations involved in the burgeoning private maritime security industry.

In the last months of 2011, there was a flood of new firms offering private armed guards to companies whose ships ply the pirate-infested waters of the Gulf of Aden and northwest Indian Ocean. The competition in the counterpiracy industry grew heated, and it spurred a wave of cyber-attacks.

At least one private maritime security firm had its website hacked, which resulted in visitors having viruses downloaded surreptitiously into their machines. And a premier U.K. association that's dedicated to vetting the private maritime security industry also had its emails infected by a "spybot." The malicious program tracked every keystroke and relayed them to some unknown third party.

This is a ruthlessly competitive industry with tens if not hundreds of millions of dollars at stake. It would have been surprising if these firms did not try to spy on each other.

It appears that ship owners and shippers are mostly oblivious to even the most elementary rules of not only cybersecurity, but more importantly, of information security.

They should be paying more attention to this issue. Somali pirates and their confederates, especially their foreign bankrollers, are increasingly surfing the Web for loose information that can help them with targeting vulnerable and valuable ships. They are hiring experts who know how to break into the "secure" computers of ship owners and shippers and obtain information that is not being shared with the public, including blueprints to ships and the insurance they carry.

A recent European Union study found that ship owners and shippers have only a rudimentary understanding of cybersecurity, which is only one portion of the broader concept of "information security"--the protection of critical information regardless of whether it is stored, disseminated or used.

Kevin Mitnic.k, perhaps one of the world's most notorious hackers, once admitted that he was able to infiltrate some of the most protected computers in the world simply by calling up employees and pretending to be "security" and having passwords released to him.

This form of manipulation and deceit is called "social engineering."

And it is effective.

It is not enough to protect networked computers with technological fixes such as firewalls, tripwires and passwords...