Cyber security is an operational and business risk, not simply an IT problem. Captain VS Parani argues that shipowners need a response built around four things: people, processes, technology and insurance.

In 1997, Captain VS Parani was sailing in the Mediterranean as a Second Mate when something was suddenly wrong: the ship’s digital position was not where the vessel actually was.

“That experience of GPS spoofing was when I first realised there is a vulnerability in the digital space. We were vigilant, so we spotted the error – but it is very easy for things to go wrong and definitely that is one of the ways that a serious collision or grounding could take place.” Parani says.

Nearly three decades later, after 14 years at sea and a career that has taken him into senior marine management, Parani sees cyber risk in much the same operational terms. It is not an abstract technology issue. It can affect navigation, safety, cargo, the environment and ultimately the ability of a ship to operate safely.

Now Vice President-Marine at Tufton Asset Management, he says cyber security has to be treated as a business and operational risk requiring a holistic response. The pace of change makes that harder: one mistake can be enough to trigger a loss-inducing event, while the people generating the threat may be highly sophisticated and, in some cases, hostile state actors.

The owner cannot look away

For Parani, responsibility starts with the shipowner. The safety of life, the environment and cargo is paramount, he says, and owners must be able to demonstrate that they have carried out due diligence and taken the necessary steps to protect their assets.

“The owner needs to do their part, including due diligence as part of best practice and taking whatever actions are necessary to secure the assets against these risks. Therefore, the owner has indeed the responsibility for ensuring a ship is cyber safe.”

That means cyber cannot sit in a technical silo. Senior management needs to recognise it as an evolving threat and respond through business, operational and technical measures, supported by gap analysis, risk management, regulation and best practice.

Parani reduces that response to four elements: people, processes, technology and insurance.

People are the frontline

The first of those is people. Whether they are at sea, in the office or working as external partners, Parani sees them as the frontline of cyber security.

“We must train our seafarers. For example, they need to understand why they should not use a random memory stick. And we need to equip them so that they don’t have to resort to a bypass of set procedures. The frontline is very important.” he says.

The challenge is that seafarers already carry a heavy operational workload. They are trained in navigation and engineering; cyber training exists within STCW and the ISM Code, he says, but it will inevitably be more basic than the capabilities of some of those launching attacks.

And even good training cannot remove human fallibility. Fatigue, distraction and the cognitive demands of navigation all create the possibility of mistakes. The answer, Parani argues, is not simply to expect people to be perfect, but to build systems that are resilient enough to allow for human error.

Processes and technology must keep moving

The second and third elements – processes and technology – have to evolve with the threat. Tufton Asset Management, based in Cyprus, supervises the technical and commercial managers for Tufton Investment Management’s controlled vessel fleet. It holds the ISO 27001 information security standard and its cyber strategy includes IT infrastructure, antivirus software, back-up, firewalls and device management.

The company also works with CyberOwl for live threat monitoring and guidance. Parani says tools that can monitor, neutralise and segregate threats are an important part of keeping the response dynamic and helping seafarers respond appropriately.

“We need these tools to help us with cyber security – and that is something we have done on our ships. That way, we assure ourselves that our cyber security response is dynamic and that we are equipping our seafarers to respond appropriately.” he says.

Insurance fills the gaps you cannot see

The fourth element is insurance – and Parani is clear about why it belongs in the same risk-management framework. However much an owner invests in people, processes and technology, no system will close every gap.

“I have a lucky charm, but I know it’s not enough. You don’t know what you don’t know. As with any risk, you cannot close all the gaps. There is always going to be something you didn’t think of.” Parani says.

For him, cyber insurance is therefore not a substitute for prevention. It sits alongside it. The underwriting process itself can force useful questions: what is the owner doing to protect the asset, what controls are in place, and where do vulnerabilities remain?

If an attack does happen, he says, the cyber response team can help an owner navigate ransomware issues or loss of data and support work to restore systems. That response capability, as well as the financial protection of cover, is part of the value.

Do what you can – then keep moving

Parani does not suggest that shipowners can eliminate cyber risk. Some malicious actors may have access to technology and resources beyond what a commercial shipowner can reasonably deploy. The important thing, he says, is to understand those limits without allowing them to become an excuse for inaction.

“There is a lot that a ship owner can do, but one must also be aware of our limitations.”

Asked whether he is optimistic or pessimistic about the threat, Parani chooses neither.

“We just need to be realistic. If we have the four parts of the risk management strategy in place, and we have done our due diligence, then we should go ahead. We can’t be paralysed; we have to keep moving.”