Cyberattack Models for Ship Equipment Based on the MITRE ATT&CK Framework.

Area of Science:

• Maritime Cybersecurity
• Information and Communication Technology (ICT) Systems
• Cyber-Physical Systems Security

Background:

• Modern ships increasingly rely on interconnected ICT systems for critical operations like navigation and cargo management.
• Cyberattacks on these systems pose significant physical risks, including vessel sinking and operational failure.
• Existing research on maritime cybersecurity and dedicated cyberattack models is limited, highlighting a critical knowledge gap.

Purpose of the Study:

• To establish a comprehensive cyberattack model specifically for maritime environments.
• To analyze the tactics, techniques, and procedures (TTPs) employed in ship system cyberattacks.
• To identify essential defensive measures against identified threats and vulnerabilities.

Main Methods:

• Adaptation of the MITRE ATT&CK framework for a maritime context.
• Analysis of historical hacking cases and vulnerability research related to ship systems.
• Development of a ship cyberattack model to characterize system vulnerabilities and threats.

Main Results:

• Identification of key characteristics across different attack phases within maritime cyber incidents.
• Characterization of systems crucial for ship navigation, communication, and control.
• A foundational understanding of prevalent threats and vulnerabilities in shipboard ICT infrastructure.

Conclusions:

• The proposed cyberattack model provides a structured approach to understanding and mitigating maritime cyber risks.
• The study offers essential insights into defense strategies for critical ship systems.
• Results are expected to guide future research and development in naval cybersecurity.