Enhancing Maritime Cyber Resilience: A Call for Comprehensive Training and Regulation

This article addresses the critical issues associated with maritime cyber-security and focusses on the training and education needed for maritime sector employees and professionals in the port sector. It provides essential context for understanding the increasing threat landscape, exemplified by a 900 per cent rise in cyber breaches targeting operational technology in ships and ports in 2023. It underscores the global impact of cyber threats, and highlights major incidents in ports worldwide. The escalating frequency of attacks on shipping lines, container terminals and national key points raises concerns about financial losses and potential risks to human life, alongside damage to infrastructure and the environment. We argue that the critical aspect of cyber resilience is the human factor, which is considered to be a potential weak link in cyber-security. We explore the importance of training the maritime workforce to enhance cyber resilience, analyse the scope of the training obligations imposed by the International Ship and Port Facility Security (ISPS) Code, and note gaps in the application of this framework in South Africa's Merchant Shipping (Maritime Security) Regulations, 2004. Furthermore, the non-mandatory guidelines to the ISPS Code lack both force of law and sufficient specificity. Against this background we emphasise the growing attention by regulators in the United States, European Union and United Kingdom to the vulnerabilities of cyber-physical systems in ports, and the need for specific regulations to address these risks. While acknowledging the existing regulations, we advocate the urgent development of a comprehensive port-sector cyber-security policy and guidelines in South Africa and the amendment of the existing regulations to include mandatory cyber-security provisions. In conclusion we emphasise the need for a coordinated effort in the South African port sector to promote cyber resiliency, understood as being the ability to identify, mitigate and respond to cyber threats effectively. We call for the integration of cyber-security into executive strategies, policies and procedures, and stress the importance of continuous learning and information sharing to create a resilient maritime industry.