Critical Infrastructure Security
White House Mandates Cyber Incident Response Plans Amid Growing Chinese Threat
Federal regulations unveiled Tuesday will require the U.S. maritime industry to implement baseline cybersecurity measures amid concerns over exposure to attacks from adversaries such as China.
See Also: Live Webinar | 10 Strategies to Tackle Alert Fatigue with Smarter SOC
The Coast Guard released a final rule for cybersecurity in the marine transportation system expected to be published Friday in the Federal Register. It tasks organizations in the sector with developing a cybersecurity plan, designating a cybersecurity officer and implementing additional measures to bolster cyber defenses. The regulations follow an executive order President Joe Biden signed in February pledging over $20 billion to support improvements to U.S. port infrastructure over the next five years and tasking the commandant of the Coast Guard with developing measures to prevent and remediate cyber incidents (see: Biden to Sign Executive Order Raising Maritime Cybersecurity).
The Coast Guard said the maritime industry “faces increasing cybersecurity threats” as cyber-connected systems have become integral across the sector. Congress has warned that Chinese ship-to-shore port cranes pose significant national security and cybersecurity vulnerabilities. The Chinese state-owned company known as ZPMC supplies 80% of all ship-to-shore cranes in the U.S. market and has significant involvement in militarizing the South China Sea (see: Coast Guard Warns of Continued Risks in Chinese Port Cranes).
Maritime sector cybersecurity plans must outline key device security measures, including maintaining approved hardware and software lists, disabling default executable applications on critical systems and developing inventories for network-connected assets while documenting network maps and configurations. They must also include data security measures like securing logs and using encryption to protect sensitive data.
Owners and operators of U.S. vessels, facilities and outer continental shelf facilities – typically oil and exploration and drilling facilities – must prepare outline response procedures including key roles, responsibilities and decision-makers in their incident response plans, according to the final rule. They are also tasked with designating a cybersecurity officer responsible for ensuring personnel implement both the broader cybersecurity plan and the incident response plan required under the rule.
Biden’s maritime executive order released earlier this year provided U.S. Coast Guard port captains with expanded authorities to control vessels that present known or suspected cyberthreats, while requiring facilities to correct sub-par cyber conditions that pose threats to port safety. The Coast Guard said in a November notice that additional measures were necessary “to prevent a transportation security incident.
The notice said the Coast Guard required additional cybersecurity measures due to the “prevalence of STS cranes manufactured by PRC companies in the U.S.” and “threat intelligence related to the PRC’s interest in disrupting U.S. critical infrastructure.” The notice also warned of “built-in vulnerabilities for remote access and control” of Chinese-made port cranes.
The rule is set to become effective six months after its publication, though the administration is seeking public input on a potential two-to-five year delay for the implementation periods for certain U.S. flagged vessels. The Coast Guard did not immediately respond to a request for comment.