Asset inventory management in cyber security process development in marine vessel projects

Abstract

Increased risk of cyber incidents in the maritime industry drives the standardization towards improved requirements in enhanced risk assessment and mitigation activities. Asset inventory management is one of the cyber security processes that should be applied to marine vessel projects to be compliant with prevalent standards. Firstly, this thesis focuses on reviewing standards and requirements that affect computer-based systems (CBSs) on-board marine vessels. After initial review, this information is taken into practise in a case study where cyber security process of a maritime company is developed in an agile project management application. In the study, focus sets on developing an enhanced process based on previous experience and related literature. Once the developed process is evaluated, it is piloted in a real marine vessel project. Results indicate that application of agile methodologies with a comprehensive but precise cyber security process is applicable for maritime companies. Most importantly, the developed process improved collaboration between different parties involved and shifted workload from the end of projects to the whole lifecycle of marine vessel projects. Nevertheless, a novel work environment has its challenges such as reluctance at the initial stages of implementation. With a supportive training material and general guidelines as well as continuous development, the process can be further polished to fit for most of the stakeholders involved. For further development, technologies such as radio frequency identification (RFID) could be utilized to automate data collection from CBSs for cyber security compliance. Together with an agile information security management system and a working cyber security process maritime companies will be prepared for safer shipping in the future.