S1: All right. Welcome to Unsupervised Learning. This is Daniel Meisler
S1: and happy to have on today Corey Ransom, CEO at Dryad.
S1: And Ismael Valenzuela, VP of threat research and Intelligence at BlackBerry.
S1: Welcome to the show.
S2: Thanks for having me.
S3: Thank you, thank you. Daniel.
S1: Awesome. So we want to talk about maritime security today.
S1: And it's good that we have Cory here because I
S1: did not feel, uh, qualified to be an expert there.
S1: So good to have everyone on and good to see
S1: you again, Ismail.
S3: You'll see again, Daniel.
S1: Well, very cool. So, um, I think the reason we're
S1: talking about this is because of the incident that happened
S1: in Baltimore. And I guess. The big part of my
S1: questions here are how does the maritime stuff generalize out
S1: to other areas? Right. Um, so so with the Baltimore incident.
S1: What are the things we should be thinking about with
S1: maritime security? Can you kind of give us an overview, Cory?
S2: Sure. That that's a that's a really good question because
S2: maritime in my opinion, and I think a lot of
S2: people in the industry, when you look at cyber security,
S2: is probably about 10 or 15 years behind the rest
S2: of the world. So there's a number of issues to
S2: look at. So when a little bit of background, Daniel,
S2: when you build a ship, that ship is usually going
S2: to be in service for 25, 30 plus years. And
S2: so the systems that are on that vessel, when it's built,
S2: you can imagine there's a there's a pretty interesting evolution
S2: of technology through the life of that ship. And you
S2: can't always replace those systems. So there are still vessels
S2: out there today that are operating with windows XP computers,
S2: because those were the systems at the time when the
S2: ships were built that are the controlling systems for the
S2: engine control systems or other vital systems on board. So
S2: there's really a number of things that you want to
S2: look at from a threat perspective on board the vessel
S2: and the legacy systems are really a big part of that. Now,
S2: the IT infrastructure on a vessel, it's much easier to
S2: upgrade that. But some of what you call the OT
S2: or the, the, the the other technology on board, um,
S2: is not as easy to upgrade. So that's one of
S2: the first things to look at with the vessel is,
S2: is what can you do to protect the the older
S2: kind of OT systems that are operating and then also
S2: the newer IT systems. And all of this has to
S2: work in an environment where there's sometimes there's no connectivity whatsoever. Um,
S2: the ships in the world will pass through regions where
S2: because of weather or other issues, they may lose connectivity
S2: for for a time period. So it's very interesting when
S2: you look at trying to apply a protection scheme to
S2: a vessel, it's very different than when you try to
S2: design that for an organization that operates on land.
S1: Yeah, that makes sense.
S3: It's interesting, Daniel, because, you know, you mentioned Baltimore before
S3: and obviously that's that's what's what's in everybody's head, right?
S3: Because of what happened recently. But Corey and I, we've
S3: been talking about this before the Baltimore incident. And we're
S3: like working on hey, you know, let's look at some
S3: threat models. I wasn't an expert. I'm not an expert
S3: in maritime security. But I was talking to to Corey
S3: well before that incident. When that incident happens, like everybody was,
S3: you know, thinking about that. But but this is something that,
S3: you know, in this case, Dryad has been working on
S3: for quite some time. And we, as you know, partners
S3: at BlackBerry, we have been looking into as well before
S3: the Baltimore incident. Right. Maybe we can talk about some
S3: other incidents that have happened before. Well, that that's.
S2: A that's an interesting one, Ishmael. Because when that incident
S2: happened on my phone started ringing off the hook because
S2: that was the first thing that most people thought is with,
S2: with the ship in Baltimore. Oh, this is a cyber
S2: attack 100%. And we find out, obviously, that it wasn't
S2: that this was more mechanical and other things that were happening,
S2: but it was just interesting that I was getting calls
S2: from people that I was not expecting to get phone
S2: calls from asking, was this a cyber incident? And at
S2: the time, the majority of the intelligence that we had
S2: was there was just not anything to indicate that it was.
S2: And then that panned out. But there's been other incidents.
S2: We know that cyber has been related. And one of
S2: the things that I find really interesting in the maritime
S2: is post accident investigation with maritime. They're they're bringing in
S2: cyber experts all the time. And and we've never seen
S2: that before. And three, four years ago if there was
S2: an incident okay. We know probably mechanical or some other issue.
S2: But now as, as kind of those post incident investigations,
S2: you're seeing the cyber component or forensic cyber experts that
S2: are now in part of those investigative teams to say, hey,
S2: was there the potential of a cyber incident? And and
S2: it exists. I mean, Ishmael and I talk about this
S2: quite a bit, but that the potential of a cyber
S2: attack in maritime, um, we're just counting basically to time as,
S2: as when it's going to happen. It's it's definitely something
S2: that we see and we continue to try to provide
S2: information to, to our clients and stakeholders on what that
S2: threat landscape looks like and how prevalent this threat is.
S2: And it gets it gets more and more prevalent every
S2: single day.
S1: Yeah. I remember seeing a long time ago, uh, some
S1: aircraft carrier and it was running Nt4 and I was like, oh,
S1: that's that's really scary. Um, so what what are the
S1: threats scenarios look like that you put together? Both of you.
S1: If you look at the actual scenarios themselves, what do
S1: they start to look like? You've got like malicious. You've
S1: got like, you tell me if I'm wrong, but you've
S1: got convincing some sailor to bring on a USB drive
S1: or something, which hopefully they would have access to. Um,
S1: ports would be limited. But we all know the world
S1: is not a perfect place, so perhaps, um, yeah, external
S1: media coming onto the ship that could possibly compromise. Um,
S1: I imagine there's a whole bunch of systems that are
S1: internet connected, and I'm sure there's supposed to be segmentation,
S1: but that's another avenue. But like, what is that threat
S1: model actually look like?
S2: That. So I think that that trying to get someone
S2: to bring a USB on board that, that that's pretty
S2: difficult to do. Most of the Mariners that that we've
S2: talked to have that basic training so they know, hey,
S2: this is I'm not going to bring this media on board.
S2: It's interesting because up until about the last three years,
S2: that's how the majority of the critical systems were updated,
S2: is the manufacturers would actually have to send a USB
S2: or a CD ROM to the vessel to update the
S2: critical navigation systems and everything. And it was we were
S2: actually just talking about this internally, and it was really
S2: funny about 3 or 4 years ago that the major
S2: navigation providers for vessels were telling people, don't connect your
S2: bridge navigation systems to the internet. If you do anything,
S2: it needs to be trusted. Our updates come out like this.
S2: It was very specific. Well, fast forward to where we
S2: are today, and all of those same bridge navigation manufacturers
S2: are telling all of their vessels they have to have
S2: their bridge navigation systems connected to the internet now, because
S2: that's how the live updates are done. And it's a
S2: much more efficient process to be able to do that.
S2: So it's interesting to see the change that's just taken
S2: place in the industry in the last 2 or 3
S2: years with now, systems that were not connected to the
S2: internet are now being connected to the internet, and not
S2: just navigation, but the engine control systems, the generator, the
S2: engines themselves. When you look at cargo vessels, the cargo
S2: handling side of it, the ballast water systems, I mean,
S2: it's it's really interesting to see the number of systems
S2: and the connectivity on vessels that was just not prevalent
S2: even 2 or 3 years ago. So you really didn't
S2: see that threat where that's why we've seen a huge
S2: jump in the exponential potential of that as just because
S2: of the number of systems on board. And the the
S2: other interesting piece is, is post-Covid shipping companies, the cruise lines,
S2: large yachts are really having a difficult time trying to
S2: get crew members on board with little or no connectivity.
S2: Shipping of the past. Again two three years ago, crew
S2: members knew that there was no connectivity or if they
S2: wanted it, they would have to pay a pretty exorbitant
S2: amount to be able to get that. Now it's becoming
S2: standard package on a lot of these vessels to have
S2: enhanced internet capabilities just for the crew. So you bring
S2: that dynamic that we didn't have a few years ago
S2: into the threat picture. So it's rapidly changing the different
S2: access points that could become vulnerabilities on board a vessel.
S2: And almost regardless of the type, whether it's a cargo
S2: ship or a cruise line or a large yacht.
S1: Yeah. The one similarity I think, I think I see
S1: is IX or, um, operational technology. It's almost like because
S1: we have been learning this lesson, albeit slowly, is securing
S1: SCADA systems, uh, which I've done a bunch of assessment
S1: work on. They were traditionally completely isolated, and then they
S1: ended up not being isolated and. More and more internet
S1: connected tech comes in and those environments are not used
S1: to that. So maybe there's some lessons we can get
S1: from that industry. I'm just skeptical that those last those
S1: lessons actually transfer. Well, they tend not to.
S3: And I was going to say even like autonomous vehicles. Right.
S3: We see the same kind of idea like vehicles that
S3: they need to be connected time, right. To receive, uh,
S3: instructions and to send telemetry to receive, you know, information. Um,
S3: but if you think about other like, older threat models. Right.
S3: We were discussing before. Uh, GPS spoofing, for example. Right.
S3: I mean, that's usually using, like, traditional technology to be
S3: able to redirect a vessel, right, to, to, to a
S3: different place, like, can that be done in this way
S3: by manipulating this, uh, this data. Right, that we're navigation
S3: data by, by maybe turning a ship, like, sideways and
S3: blocking the entrance of a port. I know that's actually
S3: a scenario, right? That has been, uh, evaluated. What could
S3: happen if a vessel enters the port of New York
S3: and then turn sideways and blocks? Uh, not accidentally. Yeah, that.
S1: Yeah, I wanted to hit on that, basically. What what
S1: are the, uh, not the threat scenarios for getting in,
S1: but what what could people do potentially, uh, to do that?
S1: One would just, I guess be. Yeah, blocking shipping actually
S1: seems like one of the worst ones. What else could
S1: you possibly do?
S2: I could take the first part of that if you
S2: want because that it's, it's this is this is really interesting.
S2: So I think there's a couple of things. Number one is,
S2: is to be able to, uh, spoof the vessel's navigation
S2: system in a tight maneuvering space, like the entrance to
S2: a canal or port. That is something that before the
S2: crews on board. These ships are very intelligent people. They
S2: are very good at their craft and what they're doing
S2: in running navigation and engine systems. But if you put
S2: them in a, in a, in a confined, um, fair way,
S2: entry point into a canal or a port, they still
S2: have to take time for their brains to process that
S2: something is wrong and then be able to react to that.
S2: And by the time that happens in a narrow channel,
S2: it's really difficult for them to counter what's happening, because
S2: as you saw in Baltimore, these very large cargo ships,
S2: even traveling at five, six, seven knots, have so much
S2: momentum that it takes a long time to stop these ships.
S2: So in in a narrow fairway, that's a really interesting scenario.
S2: One of the other scenarios that we've looked at is
S2: the actual kind of digital hijacking of the ship itself.
S2: So the ship may be in the middle of the ocean.
S2: Hackers take control of of engineering and navigation systems and
S2: block the crew out from being able to do anything,
S2: and then basically digitally hijacking the ship in the middle
S2: of the ocean, asking for a ransom payment. That is
S2: something that we really haven't seen yet, but we think
S2: that that is going to become more and more prevalent
S2: in the maritime industry as we see all of this connectivity,
S2: all of these things happening, that the prevalence of this
S2: may start to increase because you look at 90 plus
S2: percent of all the goods that we buy are on
S2: a ship at some point in your life. So that
S2: is a huge part of global GDP. So even one
S2: ship with 3 or 4000 containers, that that's a lot
S2: of value of cargo, that's that's moving in the in
S2: the ocean. And you know, don't even think about like
S2: some of the supertankers with oil on board how much
S2: those are worth. So there's a lot of value that's,
S2: that's floating around out there that that we think that this,
S2: this digital hijacking could potentially become an issue or even
S2: precede a physical attack like what we've seen in the
S2: Red sea and the Gulf of Aden.
S1: Okay. So so what does that what does that actually
S1: look like? That is basically economic disruption. And also you
S1: have to worry about the actual crew that's on board.
S1: But they would in that sense they would only be
S1: affecting the cargo that was on that one ship along
S1: with the crew. And I guess they would just be
S1: out in the ocean and say. What? We're not going
S1: to deliver the stuff. We're going to dump it in
S1: the sea, and also we're going to hurt the crew.
S1: Is that the scenario?
S2: No, not necessarily that I think the scenario is more
S2: along the lines, Daniel, of of of an attacker taking
S2: control of the ship. And these guys are financially motivated
S2: unless it's a state actor for the most part in
S2: the maritime it's 100% financial motivation. So what we would
S2: see is that they would take control of the ship
S2: and then ask the owner or management company, hey, you
S2: need to pay us 10 million Bitcoin for a 10
S2: million in Bitcoin for us to release the ship back
S2: to your control. So I don't think it's anything to
S2: potentially dump the cargo or hurt the crew. It's more
S2: along the lines of what financial gain can we get
S2: out of this very quickly and and be able to
S2: get a fairly quick payday, just like what we've seen
S2: in other industries? Hey, we've got all your data, we've
S2: got all of your your websites are down. We have
S2: all of this. In order to get it back. You're
S2: going to have to pay us so much in ransom
S2: and we'll give you your your ship back. That's kind
S2: of the scenario that's interesting.
S1: It it, uh, tripped me up because in that case,
S1: it's really stuff. And it's really people that you are
S1: ransoming which transfers to the physical world. But the attack
S1: you're talking about is actually technically ransomware in the cyber world. Sure. Yeah. Yeah, yeah. Fascinating.
S3: And just to put things into perspective, I was mentioning
S3: to Corey, uh, before that, uh, two weeks ago, I
S3: was at the Panama Canal. Right. And it was very
S3: enlightening because, you know, we have been working together on
S3: this for quite some time, and I've been doing a
S3: lot more reading on maritime transportation, maritime security. And, uh,
S3: I didn't realize, I think vessels pay like up to
S3: $1.5 million, right, to go through the, uh, the Panama Canal.
S3: And when you look at the cost of that's obviously
S3: very high, but some of these vessels, they can have
S3: up to 13,000 containers, right, Corey? Or even more.
S2: With some of the new super container ships, you could
S2: see 20,000 containers. So what's a 1 million or a
S2: $1.5 million cost divided by 13,000 is.
S3: 100 bucks, right?
S2: Yeah, it's 100 bucks a container. Yeah.
S3: So we don't want obviously we don't want, uh, to give, uh,
S3: ideas right to the bad guys, but obviously they know
S3: this already. And we're talking about, uh, minimum cost per container.
S3: If somebody had to do this and something that they
S3: would probably say, you know what, let's pay it because
S3: we need to release these goods and we need to
S3: to move forward.
S1: Yeah, that. That makes sense. So are there any, uh,
S1: benchmarks here? Like you talked about? One thing with which
S1: Ismael and I might have talked about as well. When
S1: you have, like, traditional network security, you learn all these lessons.
S1: It takes a very long time for people to learn
S1: these lessons. Then you go to web security and nobody
S1: knows those lessons. So you basically need to spend another
S1: decade almost starting over because none of the knowledge transfers.
S1: But in terms of like all these different spaces, you know, web, mobile,
S1: all these other cyber spaces and I would say other
S1: industries as well. How does maritime compare? Like where would
S1: you put us on like a maturity model for maritime cybersecurity?
S2: I. I want to hear what Israel has to say,
S2: but I, I think honestly, from a cybersecurity in general,
S2: when you look at the maritime industry and specifically at vessels,
S2: is probably about 10 or 15 years behind the rest
S2: of the world, um, on this, it's just not a problem.
S2: The industry up until the last few years has really
S2: been awake to the fact that, hey, this is something
S2: that we need to look at and deal with. We
S2: we are talking to clients now that we never thought
S2: we'd be talking to about cybersecurity and protection, and people
S2: are realizing in, in the, in the global maritime industry
S2: that there's a cost to be able to do business.
S2: And now cyber protection is part of that cost. But
S2: if you look at what the costs are to mitigate,
S2: a potential issue could be 10 or 15 times what
S2: the cost is to provide some of the basic protections.
S2: So the industry, it seems like, is now really waking
S2: up to the fact that this could be a real
S2: potential threat. And the threat can be sitting almost, almost
S2: anywhere in the world. But our feeling has been that
S2: the industry is is pretty far behind the time when
S2: it comes to the type of of knowledge and protection
S2: and things that the industry is doing to employ to
S2: be able to mitigate this. Now, some people are on
S2: the other end of the spectrum. There's companies that that
S2: we've dealt with that have incredible protection and have standards
S2: that meet the rest of the world. And then there's
S2: other companies that don't even have a firewall operating on
S2: board their ships and are running old legacy systems, and
S2: networks aren't bifurcated. Some of the basic things that you know,
S2: that you would see, um.
S3: It's very interesting that it's not very different from what
S3: we see in other critical, uh, sectors. Right. And I'm thinking, uh,
S3: transportation in general or factoring where you have, uh, sometimes,
S3: you know, small companies with not a lot of employees,
S3: but they, they have a, you know, really high revenue
S3: and they're being ransomed on a regular basis or they're
S3: being targeted by, uh, threat actors. Um, you know, we've
S3: been looking at, uh, typhoon activity recently, uh, as probably know,
S3: an actor related to, uh, you know, China and how
S3: they're very interested in, in critical infrastructure, especially in the US,
S3: like Cisa has been reporting about this, uh, in the
S3: last few months. And we see on a regular basis,
S3: on a daily basis, activity coming from full typhoon targeting, um,
S3: some of these critical sectors. So legacy systems, right. The interest,
S3: the geopolitical interest from threat actors, that makes an interesting cocktail.
S3: And if you add to that, that there is a
S3: lot of cybersecurity solutions today that they were not designed
S3: for these type of infrastructure. Corey touched on this before, uh,
S3: these ships, these vessels that are in the middle of
S3: the ocean with as they have connectivity. Right? But it's
S3: GPS connectivity, low bandwidth, a lot of these security solutions,
S3: endpoint solutions, for example, they they rely on having a
S3: lot of, uh, a persistent connection, uh, where they can
S3: send a lot of data out and then do all,
S3: all of the analytics in the cloud and all of
S3: the AI, all the fancy stuff that doesn't always work
S3: when a system that it's an older OS and doesn't
S3: have that, uh, high bandwidth. So that that adds up
S3: to the challenge.
S1: Yeah. Interesting. And I think, Corey, you mentioned that this
S1: is going to happen more in the future and that
S1: it's even happening in the past, or at least it's
S1: been tested. But what are some of those other things
S1: that have already happened?
S2: So there's one thing that that pops out in my
S2: mind is there was back in 2013, there was an
S2: attack on an oil rig where the attackers gained access
S2: to the navigation system on an oil rig. As you know,
S2: a lot of oil rigs are floating platforms, and there
S2: is navigation where they move to stay in a particular spot,
S2: and the attackers actually gained access remotely to the navigation
S2: system and pulled the oil rig basically off station and
S2: was shut down, I think, for 2 or 3 months.
S2: That was really one of the very first cases that
S2: that we really saw where there was interference directly within
S2: a navigation system of a vessel. And this was 2013. Um,
S2: there was a case, I believe, within the last month
S2: that our Intel teams were looking at as there was
S2: a vessel in the Persian Gulf that had navigation system interference. Um,
S2: and we're seeing along with that, not just the potential
S2: of interference with the nav system on board, but one
S2: of the things that Ishmael had mentioned was the GPS spoofing.
S2: It's very easy to spoof the Global Positioning System, maybe
S2: not necessarily to get into the satellite side, but local spoofing.
S2: You can spend about 30 minutes on the internet, get
S2: a few hundred dollars in equipment, and you can fairly
S2: easily locally spoof, uh, GPS. So it's interesting the also,
S2: some of the inherent insecurity in some of the way
S2: the maritime systems are designed is much different than, than
S2: other industries. The, the International Maritime Organization or we refer
S2: to the IMO. The standards are set by the IMO
S2: and then are pushed into all of the the signatory countries.
S2: So you have to imagine that you have to get
S2: basically 190 countries to agree on a particular standard when
S2: it comes to how something is going to work. And,
S2: and some of those countries are good guy countries and
S2: others are bad guy countries. So yeah, it's it's interesting
S2: to see how this standard works that that may not have, um,
S2: be similar to like the financial industry or health care
S2: where the US can set its own standard and the
S2: UK and the EU and there's all these standards where
S2: shipping it's a pretty similar standard. So this whole global
S2: industry is able to work together.
S1: You know, what I find interesting is, uh. There's a
S1: corollary with local crime. So there's a thing in the
S1: Bay area here with people stealing catalytic converters. Um, and
S1: it's what's interesting is it, um, wasn't really a big thing.
S1: And once it became a thing. Obviously within the criminal community.
S1: It just started happening and everybody it it became like
S1: a viral spread of a meme of like, this is
S1: a way to make money. And all of a sudden
S1: a bunch of criminals started doing it. So your, your
S1: car was literally at threat. And I wonder if there
S1: was a similarity here where if criminals realize, hey, wait
S1: a minute, there's actually lots of money there. Wow. Think
S1: about how much money they have available or how important
S1: it is for them to deliver their cargo. Therefore, they
S1: will pay this much ransom. It's the type of thing
S1: where the spotlight shines on something interesting for the whole
S1: criminal community. And they're very smart and they're very synchronized,
S1: and then they just start going there. Do you think
S1: this could become like. Similar to ransomware. In the past,
S1: it wasn't being done and all of a sudden it was.
S1: Could it really jump in incidents, do you think because
S1: of that?
S3: I was actually discussing this with Corey, you know, a
S3: few weeks ago as well. We were, um, discussing like,
S3: global trends in I think it's just a matter of,
S3: of time. And sometimes it may actually be happening today,
S3: but we don't have the visibility because of the reasons
S3: we mentioned before, because they don't have the solutions in place.
S3: And we may as we get more visibility into these,
S3: we may say, oh, so these systems have been maybe
S3: compromised for, for quite some time. And it's just that
S3: it doesn't have it doesn't have that impact yet. Uh,
S3: but for example, if you look at the availability of
S3: a lot of these tools, uh, many of the weapons
S3: that we see, uh, being used by attackers today are
S3: open source. Right? And X werm a sink rat. Um,
S3: I don't know you black matter. There's a lot of rats, right?
S3: Remote access tools out there that we see being used
S3: by cyber criminals worldwide, and they're just open source tools.
S3: We just didn't have that much availability of those tools before. So.
S3: So absolutely. I think it's a matter of time. It
S3: might be actually happening, but we may not just see it.
S2: I would I would agree and I, I think to
S2: that to Ishmael's point, I think it is happening. We're
S2: starting to see more and more of of things happening
S2: on vessels that you kind of scratch your head and
S2: say that's a cyber incident. And the other thing that
S2: the industry does a very bad job of is sharing information,
S2: unless it's required by some government organization like the SEC
S2: here in the United States, you're not going to have, um,
S2: companies sharing information on how they were attacked. It's just
S2: it's really interesting to see that where in other interesting
S2: industries you do have that information sharing, but we just
S2: don't have it in the maritime industry. Eventually, I think
S2: the industry is going to get there because that spotlight
S2: is moving slowly on to this industry. But we kind
S2: of feel from the interactions that that we're having in
S2: the industry that this is happening more and more than
S2: a number of companies are willing to admit.
S1: Um, so do you have a list of these, by
S1: any chance? Uh, if not, you should start a GitHub.
S1: I'm like, all into this, uh, starting a public repo
S1: right now for different things. So it would be nice.
S1: You don't have to mark it as like, definitely. But
S1: if it's unknown and it looks fishy to you, like
S1: you're going to have like the best knows in the
S1: industry for smelling this out. Uh, especially you two combined.
S1: So what if there was a GitHub repo and it was, like,
S1: possible cyber related maritime, and then you could have at
S1: the table, confirmed or not. That would be super useful.
S1: It would be like the best source anywhere.
S2: It. It would it would be interesting to do. We
S2: would just have to figure out from our all of
S2: our nondisclosure legal agreements and protect our clients of, of
S2: that type of information. But to to give you an
S2: example we thought was really interesting is we were working
S2: with a client and we were on board their vessel
S2: and they were they were doing some repair work. So
S2: so we were talking to them about some of our solutions,
S2: and they, they mentioned to us that they had to
S2: replace all of their bridge navigation hardware. That's really unusual
S2: because it was not that old. So we asked them
S2: and they said, well, we don't know what happened. There
S2: was some issue and the computer systems are corrupt and
S2: they're not working. And we just kind of walked away
S2: from that laughing, saying, yeah, you guys were the oh,
S2: you guys were the were the victims of a direct
S2: cyber attack. And now they're replacing hundreds of thousands, if
S2: not millions of dollars in navigation hardware because it's rendered completely,
S2: completely useless. And that's that's a story that we're seeing, um,
S2: more and more often, um, that there's issues and computer
S2: systems have to physically be replaced. It's I mean, that's
S2: if you look at Maersk, that's basically what happened is
S2: every system in Maersk, for the most part had to
S2: be replaced. That that's just an interesting. And that wasn't
S2: even an a direct attack on the company Maersk that
S2: came in through, I think it was a third party
S2: accounting software provider that they were using that the attack
S2: then launched into the entire Maersk system. But there was
S2: there was a huge replacement cost for them to replace
S2: systems that were were affected by that. And we're we're
S2: starting to see that some, some more often in, in maritime.
S3: Yeah. We have been talking about cargo ships right here.
S3: But but maritime security, it's also about cruises. It's also
S3: about oh.
S1: Yeah that's a good point.
S3: Think about right. So think about, uh, you know, uh, VIP, uh, folks,
S3: executives maybe, you know, um, being targeted by some of these, uh,
S3: threat actors or just large cruises, right.
S2: Uh, or if you look at that VIP side, Ishmael,
S2: the large yachts, I mean, that's your top. You take
S2: your top 50 wealthiest people in the world, and a
S2: lot of them have their own large yacht. And it's
S2: interesting that some of these yachts do very well on
S2: protecting the vessel from a cyber perspective. And other large
S2: yachts are just absolutely head in the sand, horrible when
S2: it comes to that. But you have some of these
S2: wealthiest people in the world that are on board their
S2: yacht actually conducting business with their companies and, and all
S2: of these things that are, that are happening. And then
S2: also to your point, you look at at cruise ships,
S2: there was a there was a cruise ship, and I
S2: won't say which one, but one of our, our tech
S2: people was on board doing something, and he found that
S2: he was very easily able to pivot from the guest
S2: network into the bridge operations network with without really doing
S2: anything at all. And I'm like, oh, there's a red flag.
S2: We let them know, hey, you may want to look
S2: at that, but even some of the stuff that you
S2: would think like some of the basic IT protections in place,
S2: sometimes people don't seem to think about that. Like we
S2: recommend to our clients, like, hey, your crew network on
S2: board your cargo ship or your large yacht that shouldn't
S2: be connected to any critical system. We call it the
S2: Wild West. Let them do whatever they want. If they
S2: give each other viruses and it shuts down their systems phones,
S2: who cares? But that keep that bifurcated and everything that
S2: operates on the critical networks, that needs endpoint protection, that
S2: needs to be behind the firewall, those need to be
S2: protected and bifurcated. Uh, pretty well. But a lot of
S2: times you just don't you don't see that. And, and
S2: the crews are the ones, unfortunately, are bringing the viruses on,
S2: whether it's through social media or other sites or, or
S2: other things that are happening, just like in a financial institution,
S2: it's the people who are on their computers and jump
S2: on to a social media site or download something that
S2: they think is benign. And all of a sudden you've launched,
S2: you've launched an attack.
S3: Segmentation, right. You talked about that before, like how, you know,
S3: we keep, uh, bumping into the same problem, the same, uh,
S3: back to the basics.
S1: Yeah. Every time. Relearn the fundamentals. Yeah. What happens with, uh,
S1: autonomous or aren't a lot of people talking about autonomous vessels?
S2: So that that that's very interesting is, is there are
S2: some autonomous vessels that are operating, um, in parts of
S2: the world. And I know, um, that there are a
S2: number of governments that are looking at the use of
S2: autonomous vessels to be able to move people and cargo
S2: from vessels at anchor into shore, potentially much quicker and
S2: more efficiently than trying to have berthing space for, for
S2: all of these vessels. So there's a lot of look
S2: at being able to use autonomous vessels. Now, the nice
S2: thing about that is, is there's some really good tools
S2: that are available to protect that communication link from the
S2: shore to the autonomous vessel, and then tools for on
S2: board and and realistically, for the most part, you don't
S2: need to have a crew network on board those vessels.
S2: It's all internal operation to that vessel because it's a
S2: quick trip from the Anchorage in and and so but
S2: that does add a very interesting mix. Um, when you
S2: look at the cyber protection piece, especially as you start
S2: to get what I'd call the over the horizon autonomous vessels,
S2: these are vessels that are, that are not going, you know,
S2: ten or 20 or 30 nautical miles, but hundreds of
S2: nautical miles. And now you're moving communication potentially from a
S2: point to point network into the satellite network. So that
S2: opens up other potential vulnerabilities as, as you start to
S2: get into this and and especially with, with vessels, I mean,
S2: there's there's a lot of things that you would need
S2: to do to, to protect a vessel, um, from the
S2: autonomous standpoint, because all the navigation control is controlled by
S2: a computer in some operations center somewhere on shore. So it's. Yeah,
S2: that's going to be very interesting as, as these autonomous
S2: vessels in the next 5 or 10 years start to
S2: become more prevalent, prevalent in the industry.
S1: Yeah. And how how are people actually going to get better?
S1: Like where where are they going to learn this stuff
S1: from like, and how is threat Intel actually going to
S1: help them do that. Like do you see more coverage
S1: of threat Intel stuff? Is smile moving to this area
S1: like more interest from the industry? Um, and for for
S1: the actual customers themselves or the operators themselves. Where are
S1: they going to go? Because it doesn't seem like there's
S1: many cyber maritime resources out there.
S3: Well, that's a very good question. And I have to
S3: say that, you know, I didn't um, I wasn't very
S3: knowledgeable on this on this field before. I don't think
S3: I'm not, you know, very knowledgeable or an expert right now.
S3: But obviously since, uh, we've been working, uh, closer with, uh,
S3: Quarry and Dryad security, uh, their team, we've been we've
S3: been learning more about this, this industry and how, um, like,
S3: every industry has something in particular. Right? I think we
S3: have talked about this before, how threat intelligence is so
S3: related to the geopolitics and what we see in each region,
S3: how it's a specific to that, what we see, for example,
S3: in the Suez Canal. Right. It's very specific to to that,
S3: to that geopolitical situation right there. Um, and that transfer
S3: to absolutely everything. So hopefully by doing sessions like this,
S3: like your podcast. Thanks for having us. Uh, Daniel. Right.
S3: We can we can create more awareness on these issues,
S3: but definitely, uh, you know, Dryad is, uh, a company
S3: that is doing a lot of, uh, work on, on
S3: these with, uh, Corey leading that. And we as a
S3: technology provider, we're very happy to, to empower them to
S3: be able to provide these, uh, security, uh, protection and
S3: security services, including the threat intelligence. Right. Because, you know,
S3: correct me if I'm if I'm wrong, Corey. But you
S3: you guys have a lot of experience sharing, uh, you know,
S3: not just cyber security intelligence, but traditional threat Intel to, uh,
S3: to these, uh, vessels and these cruises. And cyber security
S3: is just one more aspect, right, of that, um, of
S3: that type of communication that you provide to your customers.
S3: So hopefully organizations are getting a lot more, um, aware
S3: of this.
S1: That's good. So is there any reason for optimism, like
S1: is there any, uh, positive side to this? Corey looking forward.
S2: I think there is. And and as we, we work to,
S2: to really try to educate the industry and and it's
S2: not just Dryad and the people here. I mean, we're
S2: working with with Ishmael and his team at BlackBerry, but
S2: also just other companies is if we start to share
S2: information and intelligence across the industry, it helps the entire
S2: industry be protected. And I think we're going to start
S2: to slowly see that shift where people are going to
S2: be willing to share that information and intelligence back and
S2: forth with each other to get an idea. Hey, we
S2: saw this, and that confirms what you guys said over
S2: here or whatever that may be. As we're seeing, information
S2: sharing really is the key to how protection is done
S2: in the government and in the health care industry and
S2: financial and critical infrastructure. And I think we're going to
S2: see that here. The maritime industry is is kind of
S2: at just the dawn of waking up to we really
S2: need to start to look at this problem. And as
S2: this evolves, this is going to evolve in the maritime industry,
S2: much different, I think, than it has in other industries.
S2: Just because technology is evolving so rapidly and we're seeing
S2: in the next few years we're going to see really,
S2: I think AI integrated into some of these solutions that
S2: is going to help this industry really advance the level
S2: of of protection. So I'm pretty optimistic. This industry, um,
S2: is is built on a ton of very, very intelligent people, um,
S2: who are very concerned about this. So it's good to
S2: see the industry waking up. And, and I'm pretty optimistic
S2: that I think this is going to be an issue
S2: from an industry perspective that we're going to be able
S2: to solve. I've been it was funny, my first cybersecurity
S2: seminar that I ever did in the maritime industry, I
S2: think was back in 2013 or 2014, and ten people
S2: showed up, and it was exciting just to have ten
S2: people in the room in maritime who are like, hey,
S2: what's this cyber thing? So you think back to 2013,
S2: 2014 now when I, when I am part of these presentations,
S2: you get hundreds of people in the room and the
S2: webinars that that we do, and we have a number
S2: of them planned and not just us, but other cyber
S2: companies in the maritime industry. You're not getting 10 or
S2: 20 people. You're getting hundreds of people around the globe
S2: signing up. We've had people reach out to us after
S2: our last webinar we did just a couple of weeks
S2: ago with BlackBerry as, hey, could you do a webinar
S2: specifically on on the threat intelligence for this and what's
S2: happening in this sector of the industry? So we're already
S2: seeing a sea change, you know, pardon the pun, but
S2: a sea change of people in the industry kind of
S2: waking up to this fact of like, oh, okay. And
S2: it's just but I but I laugh as like those
S2: ten people, hey, they got 100% of me. And if
S2: 2 or 300 people show up, they get 100%. But
S2: it's just it's really cool to see that people are
S2: really waking up to that and now want the information. And,
S2: and so we're doing with BlackBerry to work on that,
S2: to be able to say, hey, we may see this
S2: potential threat in government or in the financial or health care,
S2: but that threat is going to very quickly, in some form,
S2: probably move into maritime. So we almost have the ability
S2: to look into the future, to say, okay, what's happening
S2: in some of these other sectors that we think has
S2: a really good potential to then migrate into the maritime space.
S1: Yeah. Well, that makes sense. And speaking of that information,
S1: you you mentioned a webinar. We're going to get all
S1: the links for the description in the video. But uh,
S1: you're talking about a webinar you did with a University
S1: of Plymouth, I think. Yeah, yeah. And then um, there's
S1: also a threat report that came out. Right. Ismail.
S3: Yep. The threat report with the global trends. And we
S3: were sharing, you know, these statistics with, uh, with Dryad
S3: Global as well. And it's very interesting because we kind
S3: of see like that correlation, right with what what's happening
S3: in maritime security as well.
S1: Yeah, it seems like I could help. Maybe be like
S1: a buffer to hopefully speed up adoption. Because the thing
S1: I like the most about AI is the fact that
S1: it never sleeps. So if you have an agent that
S1: could watch and just sort of help, maybe monitor or
S1: pay attention to the cybersecurity of the ship, that would
S1: be nice. Like like a crew member that doesn't sleep.
S1: That's one possible avenue. But, um, yeah, this is great.
S1: I definitely we don't.
S2: We don't sleep. Daniel. I mean, we're we're that's true
S2: all all the time. We're in we're in separate time
S2: zones now. So, you know, it's it's my turn to
S2: take the proverbial watch here.
S1: It's it's hard to scale, though. You got to be
S1: on a lot of boats. Got to be on a
S1: lot of boats. Well, this is, uh, great info. I'm
S1: going to put all the, uh, stuff in the video
S1: description as well. And it was, uh, great getting an
S1: education on this. Really appreciate the time.
S2: Thank you very much, Daniel. It's great to be on.
S2: Thank you.
S1: All right. Take care.