Cyber Incidents – USCG Reporting Requirements

Cyber Security – USCG Reporting Requirements

Vessels or ports that have an approved Vessel Security Plan (VSP) or Facility Security Plan (FSP) are required to report suspicious activity (SA) and/or breaches of security (BoS). There are potentially a large number of malicious but low level cyber incidents not all of which need to reported.

The USCG has issued a policy letter to clarify for ports and ships the types of cyber incidents that should be reported to the National Response Centre (NRC):-

Suspicious Activity

• “Targeted” incidents, including large, sustained attacks on important cyber systems;
• Spear phishing campaigns, a marked increase in network scanning, or other attacks may be considered SA if the volume, persistence, or sophistication of the attacks is out of the ordinary.

Breach of Security

• Intrusion into telecommunications equipment, computer, and networked systems linked to security plan functions (e.g., access control, cargo control, monitoring);
• Unauthorized root or administrator access to security and industrial control systems;
• Successful phishing attempts or malicious insider activity that could allow outside entities access to internal IT systems that are linked to the Marine Transportation System;
• Instances of viruses, Trojan Horses, worms, zombies or other malicious software that have a widespread impact or adversely affect one or more on-site mission critical servers that are linked to security plan functions;
• Any denial of service attacks that adversely affect or degrade access to critical services that are linked to security plan functions;
• Physical events such as unfamiliar persons in restricted areas, individuals displaying unusual behavioural patterns, or discovery of potentially dangerous devices on or near the facility/vessel.

The following activities do not meet the reporting requirements as SA or a BoS:

• Routine and “untargeted” cyber incidents such as spam, phishing attempts, persistent scanning of networks, and other nuisance events that do not breach a system’s defenses;
• Breaches of telecommunications equipment, computer, and networked systems that clearly target business or administrative systems unrelated to safe and secure maritime operations.

Thanks to Keesal, Young and Logan for their advice in this matter.

Keesal, Young & Logan Cyber Risk Group