Cyber security concerns for autonomous and remotely controlled systems

Cyber security is highly relevant to a raft of autonomous and remotely controlled systems in the offshore energy sector, writes IMCA’s Technical Adviser, competence and training, remote systems and ROV Andre Rose.

Among these systems are marine autonomous surface systems (MASS), unmanned surface vessels (USVs), remotely operated vessels (ROVs) and autonomous underwater vessels (AUVs) able to operate from remote control centres often referred to as unmanned underwater systems (UUVs); and to unmanned aerial vehicles (UAVs) commonly known as drones.

As information technology (IT) has advanced, the opportunity for cyber crime has also increased. Technological advances now make USVs commonplace with many of these small craft (< 5 m) already in use for survey operations. Future larger systems will have varying levels of autonomy ranging from remotely controlled vessels operated from a shoreside RCC to, eventually, fully autonomous vessels.

These will use situational awareness sensors to assess and decide appropriate courses of action (albeit monitored from shore with a human override/final decision mode). These systems rely on data from sensors on various parameters communicated to the RCC for control and monitoring purposes. Robust and secure communications systems are central to their operation and performance.

IT cyber security remains of prime importance for any USV, UUV or AUV operation but operational technology (OT) must also be incorporated into the cyber security system.

Traditional IT cyber security protects the IT system and data held in it, whereas OT cyber security protects the complete system (vessel, people and environment).

The traditional IT-based definition of cyber security is:

• Technologies, processes and practices designed to prevent malware from doing damage or harm to networks, computers, programs, or data.

But modern, distributed, interconnected remote systems demand a more comprehensive and robust OT-based cyber security system defined as:

• Technologies, processes and practices designed to prevent the intended or unintended use of a cyber technology system to do damage to the cyber technology (networks, computers, programs, data), and vessel, or harm to people and environment.

To achieve this level of protection we need to be able to verify the satisfactory performance of the OT cyber security system by ensuring correct, safe, efficient and reliable operation through software quality engineering; and also preventing malicious and non-malicious threats through the cyber security system.

Functional testing will help assess a system against known errors or threats but, as yet, makes no allowance for unknown events. Using a maturity model provides ongoing monitoring, assessment and improvement to a cyber security system and will help defend against these unknown events.

To be comprehensive, an evaluation of any system must include the processes used by the technology system owners, designers, users and suppliers, and should consist of active audit and testing of known threats, access points and protection from potential threats such as spoofing and phishing using penetration and scanning tests.

One final consideration is the stage in the lifecycle where these security measures are applied. Ideally, they should be integrated as part of the initial design. Robust security systems are much harder to ensure when viewed as an afterthought and their safety is harder, maybe impossible, to guarantee. Each component of a system, where threat access could occur, should have adequate threat protection designed and built in by the equipment manufacturer.

The London-based Willis Towers Watson consultancy estimates that human errors led to 90% of cyber security claims it has assessed. As shown in the illustration above, high levels of training and competence are both essential for following the Athens Group’s sensible ‘Identify, Detect, Protect, Respond, Recover’ strategy.