You are on page 1of 6

An Overview Of Security Challenges Of Seaport

IoT Systems
M. Jović*, E. Tijan**, S. Aksentijević ***, and D. Čišić ****
*Faculty of Maritime Studies/Department of maritime logistics and management, Rijeka, Croatia
jovic@pfri.hr
** Faculty of Maritime Studies/Department of maritime logistics and management, Rijeka, Croatia

etijan@pfri.hr
*** Aksentijević Forensics and Consulting, Ltd., Viškovo, Croatia
sasa.aksentijevic@gmail.com
**** Faculty of Maritime Studies/Department of maritime logistics and management, Rijeka, Croatia
dragan@pfri.hr

Abstract - Introduction of Internet of Things (IoT) and solutions after attacks which occur more often as density
accelerated digitalization have globally improved of devices increases. If the focus is only on benefits of
productivity of seaports. The underlying problem of IoT is IoT, assuming that security is maximized, huge
data vulnerability, and the effects are very pronounced advantages can be noticed: effective monitoring of
within the complex business processes that take place in operations concerning the vessels, timely reactions and
seaports. The main consequences of the unprotected speeding up of overall business processes.
connected devices are unauthorized access, theft of
important information, and loss of information control. In
the future, new vectors of intrusions will be developed, and II. SECURITY AS A BASIS FOR SUCCESSFUL
it is important to anticipate possible weaknesses. DIGITALIZATION OF PROCESSES AT THE SEAPORTS
Furthermore, IoT data must be continuously backed up in The Internet of Things represents the digital, or
remote locations, which would facilitate the prevention of "smart" connection of objects using RFID sensors, Wi-Fi,
irrecoverable loss of data. Some seaports, where large
Bluetooth and other “smart” protocols in order to
volume of traffic is present, demonstrate that it is possible to
accelerate business processes. By 2020, there will be
utilize IoT advantages after the correct implementation and
monitoring of the entire system, while minimizing errors or
about 26 billion devices connected to the Internet [4]. The
consequences of security attacks. maritime industry, due to the digitalization process, comes
out of its traditional frameworks by creating solutions to
Keywords - Internet of Things, Seaports, Security systems improve the productivity and the sustainability of logistics
[5].
I. INTRODUCTION The goal of IoT is facilitating planning and
With the development of international trade and management of business processes by introducing modern
globalization, it is possible to notice the tendency of the information technologies. Preventive security mechanisms
traffic and cargo increase, so numerous seaports were are needed to ensure the entire network implemented by
compelled to accept changes in the transport sector and protocol such as: “managing identity devices, entering and
turn to more effective practices by introducing the Internet controlling a device access and monitoring” [6].
of Things (IoT) in their own seaports. The IoT can be Figure 1 [7] shows the global number of connected
considered as “the novel generation of Wireless Sensor Internet of Things devices (in billions) from 2016 to 2024
Networks (WSN) and it represents a network composed of (projected).
heterogeneous sensing devices, connected together over
the Internet, to acquire information and forward it to a
center of collect (base station)” [1]. The main goal of
digitalization is to speed up business processes but also to
reduce environmental pollution which is increasingly
being regulated by the “green laws”. “The most obvious
benefit of IoT connectivity lies in how it can transform
day-to-day operations at sea, at port and as part of a wider
logistics network: issues can be pinpointed, downtime can
be reduced, and processes can be streamlined, changing
the face of the maritime industry as we know it” [2].
Adequate security levels are required in ports, with
respect to the facilities and assets they utilize. Therefore,
the infrastructure and access to the restricted areas should
be monitored [3]. The main concern is directed towards
Figure 1: Connected devices in billions 2016 – 2024 [7]
consequences, security of the system and possible

MIPRO 2019/DE-DS 1571


Security and privacy are main issues because Basic IoT security problem is caused by the fact that
connecting various devices to the Internet opens the the connection runs in two directions: the device can send
possibility of unauthorized access and control as well as data to the cloud and take the information from the cloud.
theft of valuable information. If this basic connection is compromised, there will be
immense security issues.
From the figure, it is possible to see the growth of the
connected devices. In 2016 there were 17.68 billion There are several basic characteristics of the attacks
networked devices, while by 2018 the number grew by 2.6 related to IoT architectures [9].
billion [7]. An additional growth of connected devices is
forecasted, and by 2024, connection of about 62 billion • Perceptual layer consists of resource constrained
additional devices is expected, 39 billion more than in IoT devices i.e. Sensors, RFID tags, Bluetooth
2018. and Zigbee devices.

According to the Internet Society, overall system • Many types of network attacks like eavesdropping
security is as good as its weakest connection because attack, DoS attack, Man in the Middle attack, and
various components can be controlled by different actors virus invasion are still affecting network layer.
in different jurisdictions (e.g. a server may be located in • Support Layer Security hosts IoT user’s data and
one country, while the device may be manufactured in applications so both should be protected from
another, and in use in yet another), making it more security breaches.
difficult to cooperate while solving security issues [8].
According to Statista, an investment in the endpoint • Data sharing is one of the characteristics of IoT
security amounted to US $ 302 million in 2017 [7]. It is application layer.
also predicted that $ 631 million will be invested in end- In a study commissioned by Inmarsat (the world leader
point security for affiliated devices in 2021, while $ 415 in global mobile satellite communications) and presented
million will be invested in the access points, which is 216 at the Press Briefing during the international shipping
million less than the 'end-point investment. From 2016 to exhibition “Posidonia” in 2018, the following question
2021, the trend of the security investment will be on the
was asked: ''How mature is the maritime sector’s approach
rise, given that security is the basis for the undisturbed
to the IoT security?'' The answers were [10]:
functioning of the system of interconnected devices.
• The cyber security fears focus on inward-facing
The classification of IoT architecture related to
matters such as data storage (55%)
security consists of 4 layers, as shown in Figure 2, and
each of them has its own security issues [9]. • 53% believe that more security skills would help
deliver IoT based solutions.
• 87% believe that data mishandling processes
could be improved

III. MEASURES FOR PREVENTION OF THE IOT


SECURITY THREATS
Michael Sentonas (VP and Global Chief Technology
Officer at Security Connected for McAfee) has outlined
the biggest threats to information and digital security that
threaten business security in seaports [11]:
• The attacks on devices (IoT): confidentiality of
information would be com
• promised in ports, i.e. business processes or
designs that are key for the competitiveness of the
port itself. The problem arises when governments
and companies cannot agree upon a definition
what is an authorized data access.
• Ransomware and Mobile Malware - this kind of
attack is on the rise, and in today's business,
seaports are trying to utilize faster ways of
exchanging information by introducing tablets or
mobile devices that speed up business processes
among stakeholders. Over time, threats to mobile
devices will quickly increase, as new mobile
technology spreads the attack surface.
In order to transfer data between nodes safely, it is
necessary to create “lightweight cryptographic
algorithms”. This will ensure the confidentiality of data
Figure 2: IoT security and attacks [9]

1572 MIPRO 2019/DE-DS


between the nodes [9]. When the device/network is privacy problem because of the unauthorized access, the
compromised, cybersecurity teams must instantly take the theft of information and the control over them [16].
following measures [12]:
Gamundani [17] has classified the threats and
• Cybersecurity teams must be ready to react at any consequences of IoT into four categories:
time to minimize the damage and ultimately stop
spreading ransomware within the IoT network. • Application based: Each seaport should have
surveillance cameras as one of the security
• It is necessary to install current and secure measures which should be placed in the position
software that will monitor the security of the IoT with maximum coverage. But in the case of
network. burglary, the camera cannot provide the detailed
information about the method or mechanism of
• In order to prevent file recovery costs, data should information theft or misuse. Therefore, in order to
be stored in the secure data storage. facilitate data protection, additional studies and
Fortinet’s 2014 survey of Australian CIOs showed that methods are required. More advanced IoT
88% of CIOs and IT decision-makers (ITDMs) noticed the cameras that would prevent adverse consequences
increasing frequency and complexity of threats, as well as are required and they ought to be equipped with
the new demands of emerging technology like the Internet intelligent cloud-based sensors, such as heat
of Things (IoT) [11]. According to the survey, 53% of all sensitive sensors.
ITDMs surveyed have slowed down or cancelled a new • Connection based: Connecting things to the
application, service, or other initiative because of cyber- Internet is based on IP network and if its security
security fears. is not closely monitored, the entire IoT network
In a recent Check Point Study (2018), involving 850 can be compromised.
organizations, it has been found that each of these
• Platform based: “Wireless sensor network has
organizations have faced an attack (mobile malware); 94%
pending issues to be addressed which comprise of
of security experts expect the number of mobile malwares applications like communication platforms,
to continue to increase; most of these malwares comes security and management”. As with the
from third parties but are found and embedded in connectivity problems, there is a problem with the
applications that have been sold through the application communication platform as well - the more
store [13]. connected devices, the more possible attacks.
Complex supply chains make security assessments
• Other forms of attack: “Combining application
more challenging, requiring holistic approach, while
and platform-based threats, gives an intertwined
providing coordination among different sides and system
force of challenges that leaves the whole security
components. IoT systems are controlled and interactively
ground weakened, hence proper thriving of IoT
managed by "cloud" services rather than being controlled
applications is endangered”.
locally.
The consequences of unprotected IoT are shown by
California is an example of the US state introducing a
using examples at several seaports. One of the leading
law for regulating IoT, as a first concrete step in the fight
seaports in IoT adoption and implementation of security
against security threats caused by increased connectivity
measures is the port of Rotterdam. The port is increasingly
of the devices. Earlier, the use of IoT was largely self-
turning towards smart digitalization and cloud-based IBM
regulated, or regulated by the best practices of the
technology. Special efforts are invested in IoT
industry. Law on safety-related devices aims to equip the
development. “Sensors are being installed across 42-
devices with a security feature or features that are
kilometers of land and sea - spanning from the City of
appropriate for the nature and function of the device,
Rotterdam into the North Sea” [18]. Since Rotterdam is
appropriate to the information that they may collect,
the largest port in Europe, it has 140,000 vessel calls each
contain, or transmit [14]. It is also designed to protect the
year. Each ship call is a complex task, and with the help of
device and all information contained therein from
IoT it is possible to safely manage processes involving the
unauthorized access, destruction, use, and modification.
arrival and departure of the ship [19]. Namely, it is
possible to create digital twinning that covers all resources
IV. CONSEQUENCES OF CONNECTING THE in Rotterdam, allowing “tracking of ships' movements,
DEVICES (IOT) AT THE SEAPORTS WITH infrastructure, weather data, water depth, and geographic
EMPHASIS ON THE SECURITY data with 100% accuracy” [20]. The port of Rotterdam
According to TechRepublic, an online trade will be able to predict the best time based on water level,
publication and social community for IT professionals, the to have a ship arrive and depart Rotterdam, ensuring that
Internet of Things (IoT) continues to grow as a prime the maximum amount of cargo is loaded on board. With
target for cybercriminals to exploit, and according to a all the benefits provided by IoT to the port of Rotterdam,
new threat report from Symantec security company, the some concerns about the potential risk of the connected
number of IoT attacks has increased from about 6,000 in system exist.
2016 to 50,000 in 2017—a 600% rise in just one year In 2017 a cyber-attack occurred, with large impact on
[15]. According to SIA partners and their case study “The port operations, especially at the container terminal. “A
Internet of Things in Transportation” (2016), connecting few weeks of “repairing and improvement” were
things to the Internet presents a potential security and

MIPRO 2019/DE-DS 1573


necessary to get the ATM (Asynchronous Transfer Mode) suspicious behavior. Results of the proposed
systems in the function-unemployed cranes and trucks solution show that it outperforms the existing
couldn’t do anything, and ships could not be unloaded and solutions. In the future, incorporation of the data
loaded” [21]. According to Yaqoob et al. [12], “key mining techniques and intelligence-based methods
management is one of the crucial issues in cybersecurity may improve the performance of the proposed
and is more complex in the IoT, wherein many devices are framework.
resource constrained”. The main problem of IoT is the
data vulnerability within the cloud and the measures like • Specification-based intrusion detection module:
the encryption algorithms and strong key management helps to analyze behavior of the host nodes and
procedures are necessary. “Protection of the web facing send their data to the root nodes, whereas an
cloud instances must be ensured with IDS/IPS, host-based anomaly-based agent employs the unsupervised
firewalls” [12]. optimum-path forest algorithm for projecting
clustering models.
The partnership FERM has had a big role in stopping
or recognizing new attacks in order to minimize its impact Port of Antwerp has also recognized the importance of
at port of Rotterdam. FERM is a part of the Port Cyber IoT security by creating a platform for digital data
Resilience Program. The aim of the program is to enhance exchange called Nxtport. SIA partners stated that “the
collaboration between companies in the port of Rotterdam platform was launched by Flemish sector organization
and raise awareness among companies about cyber risks Alfaport VOKA, whose goal is to create a financially self-
in order to become the best digitally protected port in the sustaining data-commercialization company that will
world [22]. FERM still helps the port of Rotterdam with collect, centralize, store, analyze and exchange data from
security actions by monitoring the threats. as the big risk a wide range of logistics actors in the port (carriers, freight
exists in the smart digitalization processes. agents, etc.), and generate profits by inspecting the
information pertaining to each stakeholder” [16]. The
According to Paul Smits, chief financial officer of the project is currently running with four applications
Port of Rotterdam Authority, the entire digital ship designed to test and prove the importance of Nxtport.
industry will encourage hackers to find new, more According to Opstaele, “all these applications are tested or
complex attack methods, specially designed in this area. need to be experimented in Antwerp port and are aimed at
The Harbor Master of Rotterdam established the Port improving efficiency and security” [26]. Like every port,
Cyber Notification Desk on 11 June 2018 [23]. Antwerp is the site of illegal smuggling and accidents, and
“Companies in the Port of Rotterdam area are asked to security is a key priority [26]. Therefore, although the
report large-scale IT disruptions within their company and possibility of unauthorized device management and theft
a reporting obligation applies to companies that fall under of information exists, intensive work on safety
the Port Security Act Regulation (EC) no. 725/2004 and improvement will ultimately enable the ports to
companies that are required to comply with ISPS” [23]. experience additional growth.
Port of San Diego uses IoT-shore-power system that
allows cargo ships to plug in at port rather than having to V. CONCLUSION
run their diesel engines at the dock [24]. This port is the In parallel with the increasing number of connected
example of the port where a “Ransomware” attack has devices, there is a proportional rise of the number of
occurred, and the cyber-security has been disrupted. The attacks which target IoT devices. The problem of
port first received reports of the disruption on Tuesday, connecting the device to the cloud comes from a two-way
September 25, 2018 [25]. In order to overcome the connection: the device can send data to the cloud, but it
consequences of the attack and return to the functionality can also retrieve it from the cloud. If the basic connection
and security of the system, the partners from all levels had is compromised, major security issues will arise.
to be involved: local, regional, state and federal. The Therefore, a need for wider regulation arises, which
Harbor Police Department has alternative systems and should involve all levels of government: from local to
procedures in place to minimize impact to public safety transnational.
[25]. In the previous example, the importance of new
alternative ways of the work is emphasized if the incidents When governments and companies cannot agree upon
occur, in order to prevent completely stopping the a definition of "what is an authorized data access", then a
business processes (in the most cases, limited problem arises. Initial steps in understanding of the
functionality is available). Therefore, it is important to pay seriousness of the problem were taken by California,
attention to all the possible situations that might occur and USA, which has undertaken concrete measures in the fight
data from IoT networks must be continuously backed up against security threats, representing the first example of
using the back-end servers. Yakoob et al. [12] have introducing the law on IoT regulation. Therefore, if other
proposed a novel framework that helps to detect sinkholes countries follow the example of USA, it could present a
and selective-forwarding attacks in IoT in order to significant boost in IoT security, driving forward the
minimize such attacks. The framework is comprised of digitalization of business processes. In addition,
two modules: technological innovations will be boosted, and new
opportunities will be created, resulting in increased
• Anomaly-based module: the anomaly-based agent productivity, competitiveness and sustainability of
works in a distributed manner because it is based seaports.
on a MapReduce framework. The proposed
solution employs a voting method to analyze the The security needs to be controlled from the very start,
in the stage of making a "device connection", but it is also

1574 MIPRO 2019/DE-DS


essential to include the “monitoring” phase coming after [7] IoT: number of connected devices worldwide 2012-2025 | Statista
the implementation because of new and emerging forms (2016). Available at:
https://www.statista.com/statistics/471264/iot-number-of-
of threats. If one device is compromised, it can lead to connected-devices-worldwide/ (Accessed: 18 January 2019)
security threats imposed on the entire system. Threats and [8] IoT Security for Policymakers | Internet Society. Available at:
consequences of IoT security attacks can be classified into https://www.internetsociety.org/resources/2018/iot-security-for-
four categories. The first are application-based policymakers/ (Accessed: 14 January 2019).
consequences when the issue represents, for example, the [9] Ali, I., Sabir, S. and Ullah, Z. (2016) ‘Internet of Things security,
inability to find a culprit for the information theft by a device authentication and access control: A review’, International
security camera which are needed in seaports, because the Journal of Computer Science and Information Security, 14(8), pp.
1–11. doi: 10.1501/Vetfak_0000002648
cameras are not sufficiently developed to prevent a theft
[10] Shipping expects to spend more on IoT than on other next
within the network; the next are the connection-based generation tech - SAFETY4SEA (2018). Available at:
consequences which refer to the connecting things by IP https://safety4sea.com/shipping-expects-to-spend-more-on-iot-
network. If its security is not closely monitored, the entire than-any-other-next-generation-tech/ (Accessed: 14 January 2019)
IoT network can be compromised; furthermore, platform- [11] IT: The Biggest Threats to Digital Security for Business
based issues are related to wireless sensor network that According to the Experts | Kiandra IT (2018). Available at:
has a pending issue which comprises the applications of https://kiandra.com.au/blog/it-the-biggest-threats-to-digital-
security-for-bus/ (Accessed: 14 January 2019)
communication platforms, security and management. The
last category are other forms of attack linked with the [12] Yaqoob, I. et al. (2017) ‘The rise of ransomware and emerging
security challenges in the Internet of Things’, Computer
combining application and platform-based threats that Networks, 129(September), pp. 444–458. doi:
give an intertwined force of challenges that leave the 10.1016/j.comnet.2017.09.003
whole security ground weakened. [13] Internet Security Threats to Watch For in 2018 (2018). Available
at: https://www.cmswire.com/information-management/internet-
The security assessments of complex supply chains are security-threats-to-watch-for-in-2018/ (Accessed: 14 January
more challenging, therefore holistic approach and 2019)
coordination among different sides and system [14] Key Developments in Internet of Things Law | The WSGR Data
components are needed. Control and interactive Advisor (2018). Available at:
management of IoT systems are performed in the “cloud” https://www.wsgrdataadvisor.com/2018/10/key-developments-in-
internet-of-things-law/ (Accessed: 14 January 2019)
rather than locally. In order to minimize the damage and
stop spreading ransomware within the IoT network, [15] As IoT attacks increase 600% in one year, businesses need to up
their security - TechRepublic (2018). Available at:
cybersecurity teams have to be ready to react at any time. https://www.techrepublic.com/article/as-iot-attacks-increase-600-
A current and secure software that will monitor the in-one-year-businesses-need-to-up-their-security/ (Accessed: 14
security of the IoT network should be installed and the January 2019)
prevention of file recovery costs is possible by storing [16] THE INTERNET OF THINGS IN TRANSPORTATION PORT
data in the secure data storage. OF HAMBURG CASE STUDY INSIGHT (2016). Available at:
http://transport.sia-
The benefits of IoT in seaports are evident in advanced partners.com/sites/default/files/5._insight_internet_of_things_in_tr
“digital” seaports, such as the ports of Rotterdam and ansportation.pdf (Accessed: 14 January 2019).
Antwerp. They are the proof of the profitability of IoT [17] Gamundani, A. M. (2015) ‘An impact review on internet of things
applications and the successful monitoring of digitalized attacks’, Proceedings of 2015 International Conference on
Emerging Trends in Networks and Computer Communications,
business processes. ETNCC 2015, (May), pp. 114–118. doi:
10.1109/ETNCC.2015.7184819
REFERENCES [18] Port of Rotterdam teams with IBM Internet of Things to digitize
operations. Available at:
[1] Duvallet, C., Sadeg, B. and Belfkih, A. (2017) ‘the Internet of https://www.portofrotterdam.com/en/news-and-press-
Things for Smart Ports Application To the Port of Le Havre’, releases/port-of-rotterdam-teams-with-ibm-internet-of-things-to-
(May). Available at: digitize-operations
https://www.researchgate.net/publication/316668793_THE_INTE
RNET_OF_THINGS_FOR_SMART_PORTS_APPLICATION_T [19] How can 5G and IoT can enhance port operations? (2018).
O_THE_PORT_OF_LE_HAVRE (Accessed: 14 January 2019) Available at: https://enterpriseiotinsights.com/20180202/5g/5g-iot-
port-operations-tag17-tag99 (Accessed: 14 January 2019)
[2] The maritime IoT landscape in the next decade (2018). Available
at: https://www.marinemec.com/news/view,the-maritime-iot- [20] Turning Rotterdam into the "World’s Smartest Port"
landscape-in-the-next-decade_53814.htm (Accessed: 14 January with IBM Cloud & IoT - THINK Blog (2018). Available at:
2019) https://www.ibm.com/blogs/think/2018/01/smart-port-rotterdam/
(Accessed: 14 January 2019)
[3] To Get Smart, Ports Go Digital (2018). Available at:
https://www.bcg.com/publications/2018/to-get-smart-ports-go- [21] Rotterdam port arms itself against a new cyber attack -
digital.aspx (Accessed: 14 January 2019). Klevenberg Shipping Center. Available at:
https://www.klevenberg.com/rotterdam-port-arms-itself-against-a-
[4] Internet of Things and the Container Port - Port Technology new-cyber-attack/ (Accessed: 14 January 2019)
International (2015). Available at:
https://www.porttechnology.org/news/internet_of_things_and_the [22] FERM, Rotterdam Port Cyber Resilience (2019). Available at:
_container_port (Accessed: 14 January 2019). https://ferm-rotterdam.nl/nl/waarom-ferm-staan.
[5] Heilig, L., Lalla-Ruiz, E. and Voß, S. (2017) ‘Digital [23] Port Security. Available at:
transformation in maritime ports: analysis and a game theoretic https://www.portofrotterdam.com/en/shipping/port-security
framework’, Networking. NETNOMICS: Economic Research and [24] How 3,000 streetlights turned San Diego into America’s smartest
Electronic Networking, 18(2–3), pp. 227–254. doi: city | Digital Trends (2018). Available at:
10.1007/s11066-017-9122-x. https://www.digitaltrends.com/cool-tech/how-3000-streetlights-
[6] Madakam, S. and Date, H. (2016) ‘Connectivity Frameworks for turned-san-diego-into-americas-smartest-city/ (Accessed: 14
Smart Devices’. doi: 10.1007/978-3-319-33124-9. January 2019)

MIPRO 2019/DE-DS 1575


[25] Port of San Diego hit by a cyber attack a few days after the attack [26] Antwerp’s historic port looks to future with smart ships, IoT and
on the Port of Barcelona - IoT Security News (2018). Available at: ‘i-noses’. Available at:
http://iotsecuritynews.com/port-of-san-diego-hit-by-a-cyber- https://sk.ru/news/b/articles/archive/2018/07/17/antwerp_1920_s-
attack-a-few-days-after-the-attack-on-the-port-of-barcelona/ historic-port-looks-to-future-with-smart-ships-iot-and-
(Accessed: 14 January 2019) _1820_inoses_1920_.aspx (Accessed: 18 January 2019)

1576 MIPRO 2019/DE-DS