PREVIEW:

Improvements to transportation have always been the key for building greater wealth
for transportation providers, their customers, and nation states. Consequently, attacks
on transportation originate from criminals as well as state-sponsored threat actors and
terrorist groups.

Today’s advances derive from the digital transformation. The Covid-19 pandemic has
accelerated migration to digital technology by several years. However, transportation’s
growing use of connected compute power has also made transportation subject to
increasingly sophisticated cyber attacks from criminals and government-sponsored
advanced persistent threat (ATP) groups. This paper examines how adding digital technology
calls for a reevaluation of cyber security.

Introduction

How Transportation is Digitally Transforming ICS and OT are merging with the Internet Industrial Control Systems (ICS) manage, direct, and regulate industrial devices and systems. Highway, surface transportation, aviation, maritime, and especially pipeline providers are increasingly dependent on ICS for operations and safety. Previously, standalone ICS and operating technologies (OT) have been hard to attack as bad actors had to introduce malware manually via a disc or an infected USB device. The integration of ICS and OT with the Internet has made ICS and OT vulnerable to multi-vector cyberattacks launched from the Internet. Making matters worse, legacy ICS and OT software often contains software vulnerabilities for which manufacturers don’t now or never did provide patches. It is important for transportation providers to have purpose-engineered security controls for their ICS and OT systems including those using SCADA protocol.

AI and autonomous cargo vehicles on land, sea, and air

The pandemic is stranding maritime crews and cargo truck drivers as well as grounding air fleets due to quarantines and travel restrictions. In addition to the problem of human availability, human error is a major caused of accidents and safety issues. According to an Allianz study, human error is responsible for between 75% and 96% of marine casualties. Likewise, exhaustion is a factor in about 14% of fatal truck accidents. To solve this, the race is on to replace human-operated vehicles with autonomous vehicles guided by artificial intelligence (AI). AI never gets tired, doesn’t get distracted, and isn’t subject to human illness. Maritime Autonomous Surface Ships (MASS), autonomous cargo trucks, and autonomous commercial aircraft6 are rapidly becoming the solution for safety and human
availability issues.

However, autonomous and connected vehicles are tempting targets for cyber attacks due to the growing variety of software and communication interfaces which increases complexity and connectivity, both enemies of cyber security. As autonomous vehicles come online, they must be
protected from cyber attacks to prevent thefts, data breaches, sabotage, and other damage.

GPS systems

On July 23, 2020, a Russian cyber crime group called EvilCorp attacked GPS maker Garmin. The attack disrupted many critical aviation systems responsible for navigation, autopilots, active traffic systems, flight instruments, engine information systems, displays, sensors, interfaces, and others. The attack also impacted maritime systems including autopilots, radars, chart plotters, Automatic Identification Systems (AIS) sensors, sonar black boxes among others. GPS systems must be protected end-to-end by GPS providers and by those who consume GPS products and services.

IIoT

The Industrial Internet of things (IIoT) uses smart actuators and sensors to improve industrial processes. Transportation is growing IIoT faster than most other industries due to safety concerns. IIoT sensors create and track data such as train speeds, roadway temperatures, aircraft part conditions, and other critical information. However, these devices are located outside centralized cyber security perimeters making them vulnerable to several types of cyber attacks that can proliferate and cause damage throughout transportation environments.

Business and supply chain software

Transportation providers are tightly woven into today’s integrated supply chains. As such, third-party software used for supply-chain integration and electronic payment systems used with 3rd-party partners is commonly used in transportation. These business applications are major source of vulnerability to transportation providers. The attack that cost Copenhagen-based A.P. Moller-Maersk A/S $300 million in 2017 came through financial software used by partners.

Download the full text here.