Maritime OT Ransomware Attack: Docking & Crane Operations Paralyzed

Generally, Port infrastructure includes marine structures (breakwaters, dredging areas, locks, basins, jetties, quays, and mooring piers), distribution infrastructure (internal roads, railways, and walkways), and buildings and terminals managed by the Port Authority. These facilities are usually leased to private terminal operators, who handle the superstructure (cranes, silos, fencing, control facilities, passenger terminals) to ensure smooth port operations. 

When vessel arrives at the port there are multiple services offered starting from Marine Pilotage, Vessel Berthing, Loading and unloading Services which includes container moving, storage and stacking; bulk solids conveyor belts operations and storage; grain conveyors and silos operations; bulk liquids pumping and reservoirs filling; general cargo storage; refrigerated cargo storage etc (depend on the types of Cargo) further followed by Distribution and Transfer services till exit from port.

All this is increasingly reliant on Operational Technology (OT) and automated interconnected IT – OT systems to manage critical operations. However, this reliance also exposes ports to significant cybersecurity risks. A recent ransomware attack on a major international port highlights the vulnerabilities and potential consequences of such incidents. 

Scenario & Impact 

Overview: A major international port uses OT systems to control automated cranes for cargo loading and unloading, docking and berthing operations for large container ships, and logistics and supply chain coordination between shipping companies, customs, and warehouses. A ransomware gang targets the port’s OT systems, encrypting control networks and demanding a multi-million-dollar ransom.

Business & Technical Impact:

• Automated cranes stop working, halting all cargo handling.
• Docked ships cannot offload or depart, causing massive delays and financial losses for shipping companies.
• Backlogged cargo disrupts international trade, leading to increased costs and potential legal actions from affected stakeholders. 

Risk Exposure: OT systems are often outdated and lack robust security measures, making them prime targets for ransomware attacks. The convergence of IT and OT systems further complicates security, as vulnerabilities in IT networks can be exploited to access OT systems.

Incident Response for Ransomware Incidents 

Immediate Action: Isolate affected systems to prevent the spread of ransomware. Engage cybersecurity experts to assess the extent of the breach and begin recovery efforts. Notify relevant authorities and stakeholders about the incident. 

Communication is the key. It is extremely critical to manage internal and external communications to ensure transparency and maintain trust. 

Remediation & Future Prevention 

Recovery: 

• Restore affected systems from backups, ensuring that data integrity is maintained. 
• Implement additional security measures to prevent future attacks. 

Root Cause Analysis and Lesson Learned 

Conduct a thorough investigation to determine how the ransomware infiltrated the OT systems. Identify and address any security gaps or vulnerabilities that were exploited. 

Preventive Measures: 

• Backup Strategies are the biggest weapon against any ransomware attack and should be planned and adhered as defined framework which can include Offsite and Offline Backup or rule of 3-2-1-1 and recovery test 
• Regular System Updates: Ensure that all OT systems are up-to-date with the latest security patches. 
• Access Control should be strictly on the basis of Least Privilege through PIM/PAM 
• Network Segmentation: Isolate OT systems from IT networks to limit the potential impact of a breach. 
• Cybersecurity Training: Provide comprehensive training for staff to recognize and respond to potential cyber threats. 

By taking these proactive measures, ports can mitigate the risks of ransomware attacks and ensure the continuity of critical operations. The maritime industry must prioritize cybersecurity to protect its OT systems and maintain the smooth flow of international trade.

Mukul Kulshrestha
CISO
Adani Ports & Special Economic Zone