1. Security Industry Association Presents Keeping Cargo Moving: Maritime Cybersecurity Brett Rouzer, U.S. Coast Guard Cyber Command April Danos, Greater Lafourche (La.) Port Commission March 9, 2016

2. Homeland Security UNCLASSIFIED Cybersecurity and the Marine Transportation System Brett R. Rouzer U.S. Coast Guard Cyber Command Brett.R.Rouzer@uscg.mil Brett.R.Rouzer@hq.dhs.gov (703) 235-8850

3. UNCLASSIFIED Homeland Security Why the Maritime is Important __________________________________________________ 95% of all U.S. overseas trade through 360 ports $4.3 trillion in cargo annually 7,000 oceangoing vessels made 55,560 port calls annually Secure ports support Homeland Security and National Defense Ops

4. UNCLASSIFIED Homeland Security Intermodal Touch-points __________________________________________________

5. UNCLASSIFIED Homeland Security Cargo Operations Then

6. UNCLASSIFIED Homeland Security Cargo Operations Now

7. UNCLASSIFIED Homeland Security Ships Then

8. UNCLASSIFIED Homeland Security Ships Now

9. UNCLASSIFIED Homeland Security Hackers Used to Facilitate Drug Smuggling By breaking into the offices of a harbor company, the criminals could install key-loggers to take control of computers MODUS OPERANDI Computers of container terminal were hacked so the containers that contained drugs could be monitored By means of false papers and a hacked pin code, the drivers were able to pick up the container at a location and time of their choosing 1044 kilos cocaine/1099 kilos heroin

10. UNCLASSIFIED Homeland Security Cyber Attack – Cargo Data __________________________________________________ What happened? Targeted attack against Iranian Shipping Line (IRISL) Damaged all date related to shipping rates, loading, cargo number, date and location Loss of company’s internal communications network Significant disruptions in operations, severe financial losses Source: CyberKeel 15 October 2014

11. UNCLASSIFIED Homeland Security Insider Threat – Malware via USB Device __________________________________________________ What happened? Targeted attack against refinery Disgruntled employee loaded malware on company computers Impact to business systems Remediation required 3 rd party assistance

12. UNCLASSIFIED Homeland Security Oil Rig Stability __________________________________________________ What happened? Attacker managed to tilt floating oil rig off the coast of Africa Facility forced to shut down One week to identify cause and mitigate effects Source: Reuters 23 April 2014

13. UNCLASSIFIED Homeland Security Ground Container Tracking System Outage __________________________________________________ What happened? Outage to facility ground container tracking system Impacted facilities ability to load new containers onto awaiting tractor trailers for over 6 hours > 350 truck movements impacted Software update “gone bad”

14. UNCLASSIFIED Homeland Security Port Computer Systems Malware Infection Viknok Malware Ability to gain escalated privileges Typically used to carry out “Adclick” fraud Sophisticated – difficult to detect Primarily associated with criminal activity Majority of victims in the U.S. What happened? Malware infection Infection went undiscovered for over 7 months Malware associated with criminal activity

15. UNCLASSIFIED Homeland Security GPS Anomaly – Impact to facility operations __________________________________________________ What happened? GPS disruption lasting for over 7 hours Disruption caused two ship to shore cranes to cease operations due to lack of position data Operation of two additional cranes degraded

16. UNCLASSIFIED Homeland Security Voyage Data Recorders What happened? Shipboard “black box Susceptible to data deletion and/or manipulation Vulnerability discovered in 3 types of VDR systems

17. UNCLASSIFIED Homeland Security Industrial Control Systems (ICS)

18. UNCLASSIFIED Homeland Security FY-2014 ICS Incidents by Sector: Total 245

19. UNCLASSIFIED Homeland Security FY-2014 ICS Incident Threat Actors

20. UNCLASSIFIED Homeland Security Coast Guard Cyber Strategy __________________________________________________ 3 Strategic Priorities DEFEND CYBERSPACE – Ensure the full scope of the Coast Guard’s capabilities are effective and efficient by building and maintaining a secure and resilient CG information network ENABLE OPERATIONS – Detect, deter, disable and defeat adversaries by developing and leveraging a diverse set of cyber capabilities and authorities PROTECT INFRASTRUCTURE – Unity of effort to protect maritime infrastructure from attacks, disasters, and accidents

21. UNCLASSIFIED Homeland Security ACT Achieving Cybersecurity Together Achieving Cybersecurity Together “It’s Our Shared Responsibility” __________________________________________________ Questions?__________________________________________________

22. Maritime Cybersecurity The Port Perspective Presented by April Danos, Director Information Technology, Port Fourchon, LA

23. www.portfourchon.com A Bird’s Eye View of Port Fourchon

24. www.portfourchon.com Louisiana’s Southernmost Port Bayou Lafourche Port Fourchon is located on the Gulf Coast in Louisiana. Easy access from to the Gulf of Mexico. Approximately 60 miles Southeast of New Orleans.

25. www.portfourchon.com Deepwater oil and gas IS Port Fourchon’s business. Supporting Deep Water Oil & Gas Drilling

26. Louisiana Offshore Oil Port (LOOP), the nation’s ONLY deep water oil import facility, uses Port Fourchon as its land base. LOOP is Connected to 50% of the Nation ’ s Refineries In total, Port Fourchon plays a strategic role in furnishing this country with about 20% of its entire oil supply. Supporting an Offshore Oil Port

27. Information Technology Professionals Security Professionals Maritime Leaders Partners in Congress Executive Agencies End Users

28. How America’s Ports are Addressing Cybersecurity? AAPA IT Committee Created IT Cybersecurity Subcommittee –Meets Monthly –U. S. Coast Guard – LT. Josh Rose and LT Josephine Long Critical Infrastructure Protection Branch Port OPS DIV Office of Port & Facility Compliance –Develop Best Practices –Responds to Request for Information in reference to Cybersecurity to help map future priorities for policy and legislation development NIST Framework U.S. Coast Guard Docket Number USCG-2014-1020 AAPA Government Relations Priorities on Cybersecurity released January 2014 H.R. 3878 – Strengthening Cybersecurity Information Sharing TSS CWG – Common Cyber Language

29. What’s Next? 2016 Port Security and IT Seminar and Exposition – Arlington, VA Spring Conference - July 20-22, 2016 – - Breakout session on Cybersecurity Respond to: –NIST Cybersecurity Framework RFI –H.R. 3878 – Strengthening Cybersecurity Information –Coast Guard – Comments –NIST - Maritime Bulk Liquid Profile AAPA Security Committee is putting out a Survey to Port’s to determine where Port’s are in general with Cybersecurity.

30. Responsibility for Maintaining Cybersecurity PHYSICAL SECURITY CYBERSECURITY

31. Vulnerabilities –Limited cybersecurity training and preparedness –Errors in Software –Inadequately protected commercial off the shelf technologies and legacy systems –Network connectivity –Jamming-spoofing –Insider Threats Cyber attack on network at a port or aboard a ship –Result in lost cargo –Port disruptions- for days or weeks depending on the systems affected –Physical and environmental damage depending on the systems affected Impacts to Critical Infrastructure Sectors –Depends on the level and length of disruption –Capability to divert shipments to other ports Mitigation Measures increase the security and resiliency of ports –Setting up Maritime Cybersecurity Standards –Sharing information across the sector –Conducting routine vulnerability assessments –Using best practices –Mitigating insider threats –Developing contingency plans for cyber attacks. Consequences to Seaport Operations from Malicious Cyber Activity

32. Ports are encouraged to develop incident response plans and include cybersecurity as a portion of their plans. Ports are encouraged to work with federal agencies on breaches of cybersecurity, which may include Coast Guard, Local Law Enforcement, FBI, Secret Service and DHS. Educate your end users Best Practices

33. Protect your Work Place: Educate your End Users

34. 1. Presidential order on cybersecurity 2.U.S. Coast Guard 3.Port Security Grant Program TOP Three Priorities for AAPA Member Ports

36. www.portfourchon.com Contact Thank you! April Danos Director of Information Technology Greater Lafourche Port Commission Port Fourchon, LA and AAPA Information Technology Cybersecurity Chair aprild@portforchon.comaprild@portforchon.com or 985-632-1114

37. Q&A Ron Hawkins Director of Industry Relations Security Industry Association (301) 804-4713 rhawkins@securityindustry.org