Maritime Cybersecurity

NMEA Public Service Announcement on networked Marine Electronics for Cyber Securing the Boater's Interest

CyberBoat Challenge & Maritime Cyber Institute

Internet connections on boats has become extremely common, and cyber-attacks are happening.  The first line of cyber defense is to know the products installed on your customer’s vessel and how to prevent cyber issues at time of installation and commissioning. GPS, AIS, VHF Radios, EPIRBs are all technologies in place to help the boater communicate in a life critical event. The main challenge is the position information received on older systems can be hacked or spoofed.  Navigation equipment should be routinely checked for any known issues with software/firmware. To take this to the next level of complexity, information provided by NMEA 2000 and ethernet based systems deliver virtually all vessel vitals to help navigate, control, and assess conditions on the water. This data going to the cloud creates additional cyber security considerations.
The NMEA would like to highlight these technologies, their vulnerabilities, and what you can do to help protect your customers. See below considerations for the boater, installer, boat builder, and equipment manufacturer as a start.  A full technical reference published by NMEA called NMEA Protocols Vulnerability to Cyberattacks and Mitigation" is available upon request to members. Email [email protected] to obtain your copy.
​
Boater Considerations

1. Do you have an internet connection on your vessel?
2. If so, check that the equipment has a minimum of WPA2 Wi-Fi security settings.
3. Look to facilitate a WPA3-capable router and check your router manufacturer for firmware updates to WPA3.
4. Create a Password; make strong passwords. 
5. Routers: Existing used routers given or purchased should be manually reset by the new user. Do not use the router if you cannot find the user's manual or reset operation.  
6. Understand the different networks on your boat and the potential for network outages due to rogue device addition.
7. Know where all your devices are installed and have the means to unplug them.
8. Update devices with the latest security firmware or software from the manufacturer.
9. Use a personal PC in a private Wi-Fi network for personal security.
10. Read the disclosure of mobile or computer application permissions before accepting the developer's agreement terms.
11. Avoid applications with malware; read the application's public comments.
12. Consider purchasing dedicated or purpose-built hardware from a reputable marine electronics company.
13. If you are using a personal computer for navigation, consider making this dedicated to just navigation and disable internet connectivity.
14. Ensure any personal computer connected to the internet, has latest Anti-Virus and Malware protection software installed.
15. Consider having two separate ethernet networks, one for navigation and one for internet connectivity.

Marine Electronics Installer Considerations

1. Look to facilitate a WPA3-capable router and check your router manufacturer for firmware updates to WPA3.
2. Select popular updatable products and teach the user how to use them.
3. Physically label the device's location and include it in an accessible diagram they can use to locate and unplug the equipment.
4. Electronically Label the NMEA 2000 products on the network using PGN 126998 (Configuration Information) to help identify and locate devices connected to the network and the process for their removal if/when necessary.
5. Configure cyber information alerts- if available.
   - create alerts to Detect any monitored PGNs for Data not available.
6. Install diagnostic test connections, gateways and NMEA 2000 T-Pieces in locked areas.
7. Vessel commissioning reports generated for the captain or owner can be helpful.
8. Consider fitting a latest Network Intrusion Detection device that validates and records the status of the network when commissioned and provides early warning detection of potentially, nefarious devices being added to the network after commissioning.

Boat Builder Installer Considerations

1. Ensure the product selection includes NMEA certified products with the latest security installed.
2. Attempt to install products in secured locations. Ensure the product update ports are easily accessible to the user or technician.
3. Ensure Manufactured systems meet the minimum statutory requirements (check a device for a CE mark, ETSI 303, NIST, FCC, IEC 62443 ).
4. Install diagnostic test connections, gateways and NMEA 2000 T-Pieces in locked areas this may include lock boxes.
5. Boatbuilders integrating white labeled products need to ensure these products transmit the boatbuilder’s manufacturer code.
6. Consider fitting the latest Network Intrusion Detection device that validates and records the status of the network when commissioned and provides early warning detection of potentially nefarious devices being added to the network after commissioning.

NMEA Equipment Manufacturer Considerations
Things to consider when creating new networked products:

1. Gateway Security (use trusted Source solutions).
2. Advanced Gateway Requirements- add 2nd-level application protection using a password.
3. Define Security Level Requirements – Disclose risk levels to users (do not connect the system to the internet notice).
4. Manufacturer website for discovered vulnerabilities to be reported (contact details & acknowledge of receipt notice).
5. Manufacturers should securely publish all software updates and provide full information for users.
6. Verify that your IT specialist secured and monitored the maintenance backdoors of any telematic or telemetric systems.
7. Manufacturers should provide a product end-of-support period for security patches.   
8. No universal default passwords (unique per device, generated in a random way).
9. ​​Securely store sensitive security parameters (tamperproof/encrypted storage).
10. Communicate securely (use best practice in cryptography).
11. Minimize exposed attack surfaces (unused network interfaces disabled, debug etc.).
12. Ensure software integrity (secured by boot mechanism, alert if tampered).
13. Ensure that personal data is secure (best practice cryptography).
14. Make systems resilient to outages (clean recovery, no corruption).
15. Examine system telemetry or vessels data recordings (look for security anomalies).
16. Make it easy for users to delete user data (provide a simple method).
17. Make installation and maintenance of devices easy  (best practice, minimal user decisions).
18. Validate input data

Contributors
Dr. Chris Quigley Warwick Controls.
Paul Sumpner Digital Yacht
Andrew Bazan Brunswick, Mercury Marine Engineering
Nate Karstens Garmin International
Dr. Jeremy Daily, PH.D.,P.E  Colorado State University
Ryan Pickren PH.D Cyber-Physical Security Lab-Georgia-Tech