by Anastasios Arampatzis
Modern ships carry onboard a plethora of IoT sensors to optimize performance and reduce fuel consumption. Besides those performance-driven sensors, ships are equipped with IoT sensors to monitor oil spills which communicate via satellite communications to send imagery and data back to the shore. Implementing weak cybersecurity measures to protect the integrity of these devices can create significant environmental risks and even severe ocean life damage.
Oil spills threaten oceanic ecosystems
Marine oil spill pollution poses a serious threat to the ecology of the world’s oceans. Thousands tons of oil are spilled into the oceans every year due to both human-centric causes, such as tanker accidents, rupture of rigs/pipelines or malfunctioning of oil extraction platforms, and natural events, such as natural seepage from seabed oil structures.
Oil spills constitute a serious environmental and socio-economic problem. Oil spill surveillance is an important part of oil spill contingency planning. Accurate detection and forecasting of oil spills and their trajectories is beneficial to fisheries, wildlife, resolving disputes related to liability, and resource management for monitoring and conservation of the marine environment. Oil spill monitoring is one of the most important applications for operational oceanography. The different means of detection and monitoring oil spills are vessels, aircrafts, and satellites.
The disaster at BP’s Deepwater Horizon rig in 2010 was the largest marine oil spill in history, spewing an estimated 4.9 million barrels of oil into the Gulf of Mexico. The oil leak was discovered two days after the initial explosion on the afternoon of April 22nd and flowed for a total of 87 days. Tracking the movement of the oil and identifying its concentration were two challenges immediately faced by the cleanup operation. In those scenarios, situational awareness is key to damage mitigation.
Which is where the IoT comes in handy today.
IoT oil spill sensors
IoT sensors are deployed in numerous vessels and oil extraction platforms, combining a variation of technologies to detect oil spills and minimize the damage to the oceans’ life. Two of the most common technologies employed rely on infrared detection and laser fluorosensors.
Infrared sensors detect multiple indicators simultaneously, only triggering alarms when the “right” combination is identified. These indicators relate to the nature of oil and include wave height and behavior, surface characteristics and drift, the reflectance, absorbance and the resulting contrast between oil and water.
On the other hand, laser fluorosensors can operate as well during full day-light conditions as it does at night. Laser fluorosensors are useful instruments because of their unique capability to identify oil on backgrounds that include water, soil, weeds, ice and snow. They are the only sensors that can positively discriminate oil on most backgrounds.
The capabilities of these IoT multispectral sensors give first responders all the information they need to identify the category, concentration, and type of oil in real time. That information can then be used to make informed decisions on the best way to handle the leak and disperse the oil.
Securing IoT oil spill sensors
However, integrated IoT oil spill detection sensors are vulnerable to many potential cyberattacks. A typical cyberattack tends to jam sensor signals and reports wrong detection results, which can adversely impact the source detection of petroleum leaks. With inaccurate information, the solution performance of the IoT service is severely influenced.
IoT oil spill detection sensors fall under the category of Cyber Physical Systems (CPS). CPS and IoT play an increasingly important role in critical infrastructure, government and everyday life, which makes them an attractive target for security attacks for various purposes including economical, criminal, military, espionage, political and terrorism as well.
The consequences of unintentional faults or malicious attacks could have severe impact on human lives and the environment. Proactive and coordinated efforts are needed to strengthen security and reliance for CPS and IoT.
CPS security threats can be classified as cyber or physical threats, as explained below, and if combined, these can result in cyber-physical threats. The main cyber threats are wireless communications exploitation and jamming, unauthorized access to sensors to intercept, manipulate or disclose information, and GPS jamming and exploitation. On the other hand, physical threats are damage or loss, intentional or unintentional.
These threats are realized by exploiting known network and platform vulnerabilities, such as weaknesses in protecting and encrypting communications and data in transit, resulting in man-in-the-middle attacks, spoofing and eavesdropping, and vulnerabilities in software and databases.
Mitigating these risks and threats starts with risk identification and management to identify, analyze, rank, evaluate, plan and monitor any possible risk through risk assessment. However, the foundation of any risk assessment is having visibility into the assets deployed.
Selecting the appropriate security measures to protect these IoT devices should comply with the security requirements of confidentiality, integrity, availability and reliability. In addition, those systems need to be resilient to withstand both cyber and physical accidents and malicious attacks. The adoption of security measures has many benefits when it comes to protecting CPS ecosystems. However, despite these advantages, IoT and CPS systems can be impacted by the application of these security measures. The following concerns and challenges should also be considered when selecting security controls:
- Reduced performance
- Higher power consumption
- Transmission delays
- Compatibility issues
- Operational security and safety delays
Maintaining a secure CPS environment is not an easy task due to the constant increase of challenges, integration issues and limitation of the existing solutions including the lack of security, privacy and accuracy. Nonetheless, this can be mitigated through different means including cryptographic and non-cryptographic solutions (i.e IDS, honeypots and deception techniques, and firewalls).
CPS and the convergence of Digital & Physical Security
The new age of connectivity and automation creates tremendous opportunity in many business sectors. Without considering adequate digital security controls, smart infrastructures & connected devices/systems, can be vulnerable to potential cyber incidents. The potential of a combined physical and cyber-attack represented possible threat scenarios that could impact industries and enterprises.
The new age of connectivity demands a holistic approach to Security Risk Management. The convergence of Digital & Physical Security, in terms of processes, technology & roles, needs to become the new era in Security Risk Management. The convergence is about how the entire process of handling any type of security incidents that are considered to be major is taken care of.
Risk, regardless of whether it results from physical or logical security weakness, needs to be expressed in terms that are meaningful to business, and at the same time to be managed holistically.
How ADACOM can help
CPS systems are key components of Industry v4.0, and they are already transforming how humans interact with the physical environment by integrating it with the cyber world. More specifically, IoT based oil spill detection solutions can greatly advance the preservation of oceanic ecosystems and help minimize the impact of such events. Securing these systems in the maritime environment requires careful consideration and planning.
ADACOM can help shipping organizations be resilient against cyber incidents and data breaches through a comprehensive risk management and cyber security technology adoption program, which includes the following:
- Identify, evaluate and propose treatment for the cyber security related risks
- Define and develop the information security management system in compliance with the international requirements
- Maximize the effectiveness and the adoption of the required Information Security controls in both Company premises and Vessels.
- Adoption of the required cyber security technology such as, endpoint protection, threat protection, privileged access management, identity management.
You may learn more by contacting our experts.
Further reading
If you wish to learn more about oil spill detection and how to secure cyber physical systems, the following resources can be useful:
Pilžis, Vaišis, Oil Spill Detection with Remote Sensors, 2016, available at https://www.researchgate.net/publication/310622651_OIL_SPILL_DETECTION_WITH_REMOTE_SENSORS
Fingas, Brown, A Review of Oil Spill Remote Sensing, 2018, available at https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5795530/
Yaacoub, Salman, Noura, Kaaniche, Chehab, Malli, Cyber-physical systems security: Limitations, issues and future trends. 2020, available at https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7340599/