Interview with Mr Howard Fireman

Mr Fireman: Classification is changing, like all other industries because of data, digital and cyber. The way I like to start off with this question is by addressing two views – one of the owner and manager of the asset, and the other of the classification society. If you are the owner, you are concerned with asset management and performance, safety compliance, vessel uptime as well as the financial bottom line. For the classification society, we will be evolving into a data-driven world. We want to insert new advanced technologies for inspection, such as drones. We want to also be less intrusive because when the classification society shows up, it brings the ship to a stop because the surveyor is onboard. Today, we are regulated on a calendar based model. In the future, we want to be transit to a condition-based model. There is a bridge between the asset owner & manager and the classification society – a data, digital and technological connection where there will be a lot of sharing and transparency between the two parties. This will be important.

We view this opportunity by supporting four key elements. First, how do you get connected? Second, how do you achieve simplification? Third, how do you make things more efficient? Fourth, how do you unlock the data? How do you get the power and value of data – and what does this mean? All of these are underpinned by a digital platform, and what does this platform look like?

If we go back to the four key elements: Getting connected by building new platforms to help asset owners and managers understand the classification process. Better understanding of how mobile technologies will help users get connected – for instance through mobile applications to help users get connected to classification services. This will help enable more efficient decisions where technologies such as wearable technologies and smart glasses will be useful where surveyors onboard can get connected in real-time to a technical engineer in the shore office for troubleshooting and validation. We talked about simplification where we have regulations such as air emissions where monitoring, verification and reporting of carbon dioxide are performed in the EU and IMO. How do you automate the data by collecting, verifying, calculating and reporting the data to reduce the administrative burden on seafarers onboard vessels who are busy. Lastly, the power of data. There is a lot of intelligence in data. We have several data systems and marine enterprise resource planning that manage a lot of data – how do we bring out the business intelligence to help decision makers get to their original objectives (asset management and performance, safety compliance, vessel uptime and financial bottom line).

In the long run, we need to go beyond condition-based models to predictive analytics by leveraging the opportunities with advanced computer science and technologies such as machine learning and artificial intelligence.

What do you think are the key challenges faced by the shipping companies in cybersecurity for both shipboard and onshore systems?

Mr Fireman: Thank you for the question. I will answer based on what we have seen first before addressing what we should be doing. We have been capturing data on what we have observed and areas for improvement over the past two years. The first area for improvement is this management of change and in my opinion a great thing to start with. Most people have been focusing on IT and not as much on OT (operational technology). The second area is the practice of good cyber hygiene onboard vessels. The third area is the monitoring of OT networks. The fourth and last area is the incident response. These are based on what we have seen.

At the higher corporate level, there is a need to identify and establish the key performance indicators (KPIs) for onshore and at sea. Be it security architecture, configuration management or training and awareness, users must pick as it is all about risk management at the end of the day. They have to establish and understand their framework, which starts at the top and works it way down in the form of building programmes to support it.

From our perspective, we emphasise on cyber safety instead of cybersecurity. Classification societies have been focusing on classic aspects for decades such as structures, machinery and mechanical systems. We now have a safety dimension that is growing everyday – these are the things that we cannot see, smell or hear. It is the software naval systems that we call cyber safety. This dimension is composed of four elements. The first is of course cybersecurity, which everyone is familiar with. Secondly, data integrity – we know that GPS can be spoofed and people are making decisions based on what they see. The question is whether the data is secure from the source to the user. Thirdly, the software integrity – where the software that is being developed these days are getting more intense in the control systems of assets. Fourth, the safety of automated systems. While cybersecurity is a critical component of the cyber equation, what we also focus on heavily is OT. At the end of the day, when people talk about critical infrastructure – people, processes and procedures are vital components of a very good cyber system.

Mr Fireman: Cyber awareness and training is very important at every level. It starts with the boss – the C Suite. We all know that boards of companies have their due shares of responsibilities. I talked about the corporate KPIs earlier on. Training is one of them – training awareness, acceptance and acumen by running training exercises to benchmark the company and improve incident response. All of these come with practice. Cyber cuts across all levels of the company – all of the departments have to be horizontally integrated in my view and all the way up to the boss.

Mr Fireman: Again, it starts from the top. The CEO and President will have to bring the awareness and prioritisation across all elements of the company. The awareness and knowledge that the problem is more than IT and also OT. My observation is that OT has not received the same amount of attention. The acumen of an organisation is not as strong in OT as it is in IT. We talked about awareness training, which I cannot emphasise enough. What is the risk framework that companies want to abide by. How are they going to build up their programme and framework. You’re never going to be 100% safe but balancing the risk and budget and determine if everything will work efficiently and meet business objectives. Referencing Mr David Koh, Chief Executive of the Cyber Security Agency of Singapore, in his keynote presentation at the Maritime Cyber Security Seminar on 24 April 2018 where 80 – 90% of the issues are contributed by human factors. I endorse that – yes there is a technical aspect to the problem, but we have work on the human first.