The Transportation Research Board hosted the 15th Biennial Harbor Safety Committee and Area Maritime Security Committee Conference, in Philadelphia, Pa. August 26-27th, 2014. The conference explored best practices, innovations and technology that address critical harbor and maritime safety and security issues.
Cmdr. Nicholas Wong, chief of the Coast Guard domestic ports division, was a panelist in a session titled, ‘Securing Our Ports Through Technology.’
Wong’s remarks focused on seven cyber security areas:
• Cyber in the Maritime Transportation System
• Coast Guard Cyber Strategy
• Significant accomplishments
• Cyber guidance
• Reporting requirements
• Ongoing initiatives
• Best practices
Cyber in the MTS
Wong discussed how cyber threats are a growing portion of the total risk exposure faced by the MTS and the need to address cyber holistically. He also spoke on the importance of now viewing cyber as an IT problem.
Coast Guard Cyber Strategy
The Coast Guard is in the process of developing its Cyber Strategy that will consist of three parts, computer network defense, maritime superiority and MTS cyber security.
The first two parts are what support protection of internal Coast Guard networks and using intelligence to enhance Coast Guard missions.
“The third piece is the most complex and dynamic part because it involves privately owned proprietary systems, quickly evolving technologies and global supply chain implications,” said Wong.
Wong identified accomplishments in the arena of cyber. The first one Wong identified was the Coast Guard providing general cyber guidance to its own field units. Additionally, Wong pointed to the alerts, advisories and best practices being shared on Homeport for the benefit of the maritime community.
These two achievements have led to increased cooperation with interagency pilot tools that can be used by industry as well as increased awareness with partners at local and nationwide levels.
Wong noted the importance of continued cyber discussions amongst stakeholders to identify best practices and increase security levels.
Wong provided Coast Guard guidance and reference materials on the topic of Cyber.
• NVIC 9-02, change 4
• ALCOAST 323/13
• ALCOAST 122/14
• Cyber Capability Maturity Model
• Cyber Security Assessment and Risk Management Approach: contact Department of Energy for details
The Coast Guard understands that industry can be hesitant to report a cyber incident because of business implications.
There is a distinction with how a report of a pollution event is treated compared to security incident. Laws and regulations are in place to safeguard sensitive security information and protected critical infrastructure information from improper disclosure.
Wong discussed how it is important to follow existing regulations when reporting.
“When reporting required incidents such as a marine casualty, pollution event or event that could lead to a transportation security incident, and you feel there is a cyber nexus to it, it is critical that you make that distinction…We can treat that report properly and get the information out to the right partners,” said Wong, “There are thousands of unsuccessful attempts to hack into firewalls that are thwarted by proper cyber defenses that may not meet the threshold of leading to a transportation security incident…if in doubt, please report it.”
Report cyber suspicious activity and breaches of security to the National Response Center at (800) 424-8802.
Reporting is required for incidents meeting the definition of 33 CFR 101.305.
Wong discussed ongoing initiatives within the Coast Guard.
• Continued development of the CG Cyber Strategy
• Continuing to evaluate and distribute voluntary risk assessment tools to industry
• Incorporate Cyber Security in pending Facility Security Officer Course regulation
• Incorporate cyber to port security assessments
• Improve NVIC 9-02, ch-4 guidance to Area Maritime Security Committees
At the conclusion of his remarks, Wong provided recommendations for both organizations and individuals.
For organizations, Wong suggested the establishment of a healthy cyber security culture, reporting of insider threats and high-risk behaviors, perform regular exercises, scrutinize contracting practices and emphasize the overall importance of cyber security.
Wong also emphasized the importance of the individual when it comes to the prevention of cyber security incidents. He suggested that individuals maintain updated software and operating systems, use difficult passwords, encrypt files, enable certificates, secure personally identifiable information devices and recognize electronic means of phishing.
This blog is not a replacement or substitute for the formal posting of regulations and updates or existing processes for receiving formal feedback of the same. Links provided on this blog will direct the reader to official source documents, such as the Federal Register, Homeport and the Code of Federal Regulations. These documents remain the official source for regulatory information published by the Coast Guard.