French Port Cybersecurity Initiative PROTECT Group Rotterdam 23, March 2017 Jerome Besancenot

MPL Principles Military Program Law (MPL) Item 22 –December 18, 2013 : Measures to strengthen the security of Vital Operators’IS in the objective to protect vital national infrastructures from cyber attacks. article 22 : On behalf of the Prime Minister, Security on Information System Agency (ANSSI) may impose security measures and controls on VO information systems. In addition, Article 22 makes it obligatory to declare incidents detected by VOs on their information systems.

MPL WorkGroups During the year 2015, ANSSI organized by sectors working groups especially involving maritime ports and river organizations Specify the scope of ISVI (Information Systems of Vital Importance) Systems that could adversely affect the war or economic potential, security or survivability of the Nation Specify the timeframe and expected timeframe for strengthening SIIV measures Evaluate with ports the costs and difficulties of the project Orders specifying the law are issued in August with a date of application from October 1, 2016

Order of August 11, 2016 Chapter 1: Security rules Chapter 2: ISVIs Declaration (3 months) Chapter 3: Security Incident Reporting (1 year) Chapter 4: Final provisions -> contact details of the person mentioned in Article R.1332-41-20 of the Defense Code (3 months)

MPL Main rules Information Systems Security Policy Rule relating to security approval Rule on cartography Rule on safekeeping Logging rule Rule Relating to the Correlation and Analysis of logs Detection Rule Rule on the handling of security incidents Alert processing rule Crisis management rule Identification rule Authentication rule Access Rights Rule Administrative Account Rules Rule relating to administrative information systems Rule on network partitioning Filtering rule Rule for remote access Rule relating to the installation of services and equipment Rule on indicators

cybersecurity incidents Planning : main steps Governance of cybersecurity Protecting systems Managing cybersecurity incidents Homologation of our ISVI y1 y2 y3 Order enforcement Checking our ISVI Risk management

NIS Directive DIRECTIVE (EU) 2016/1148 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL concerning measures for a high common level of security of network and information systems across the Union adopted by the European Parliament and the Council on 6 July 2016 will apply in the Union Member States from 10 May 2018 Implementation evaluation will be done every 2 years

Operator of essential services Legal definition of the essential services operator (OSE). It is any "public or private entity" in one of the sectors or sub-sectors described below, which meets the three criteria for identifying Article 5 (2) of the Directive, namely: The entity provides a service that is essential to maintaining critical social and economic activities; The provision of this service depends on networks and information systems; An incident would have a significant disruptive effect on the provision of said service.

The sectors or sub-sectors concerned The sectors in which operators of essential services provide services dependent on networks and information systems number 7. These are the energy sectors, transport, banks, financial market infrastructures , Health, the supply and distribution of drinking water, and digital infrastructure. There are two sub-sectors, energy (sub-sectors of electricity, oil and gas) and transport (sub-sectors of air transport, rail transport, water transport, truck transport). France has identified 12 sectors, as well as several sub-sectors.

Water transport sector (10) In the water transport sector, security requirements for companies, ships, port facilities, ports and vessel traffic services under Union legal acts cover all operations, including radio and telecommunication systems, computer systems and networks. Part of the mandatory procedures to be followed includes the reporting of all incidents and should therefore be considered as lex specialis, in so far as those requirements are at least equivalent to the corresponding provisions of this Directive.   (11) When identifying operators in the water transport sector, Member States should take into account existing and future international codes and guidelines developed in particular by the International Maritime organisation, with a view to providing individual maritime operators with a coherent approach.

Minimum content of any national strategy of a MS : The objectives and priorities of the national strategy; The governance framework to achieve the objectives and priorities and the roles and responsibilities of public bodies and private actors; The inventory of preparedness, response and recovery measures including measures of cooperation between public and private actors; An overview of education programs and, above all, awareness and training in relation to the objectives of the national strategy; An overview of research and development plans; A risk assessment plan; A list of actors responsible for implementing the national strategy.

Group of strategy cooperation between MS Establishment of a group for strategic cooperation and exchange of information between Member States of the Establishment of computer security incident response centers (CSIRTs) and the CSIRT network National authorities and single point of contact The development of security and incident reporting requirements for operators of essential services Establishing security and incident reporting requirements for digital service providers The impact of the NIS Directive on our current legal framework

Conclusion & Proposal Conclusion PCS, CCS, MSW are mainly concerned by such European strategy IMO matters Increasing concerns related to ships and ports, MSC & FAL Committees probably should converge on a global issue Proposal for PROTECT Data sensitivity identification How to secure in an harmonized way EDI exchanges BtoG, GtoG SW interoperability To build a european Protect « Cyber circle » Recognized Think Tank Possibility to arrange a meeting with Cyber community The future begins immediatly After the end of this sentence