News / More US moves to tighten up transport security in war against cyber attacks

© Rafael Henrique Dreamstime.com.

Washington is moving to ramp up security against cybercrime in the US transport arena.

The US Department of Homeland Security’s latest initiatives are pushing railroads to beef up their security, following a similar drive targeting airports and airlines.

From the start of next year, major railways must also conduct a vulnerability assessment and develop formal plans on how to respond to cybersecurity incidents. In addition, they have to designate a cybersecurity co-ordinator and report cybersecurity breaches to the Cybersecurity and Infrastructure Security Agency within 24 hours.

These measures are meant to add a new layer of security against cybercrime, which has been one of the priorities of the US administration after several high-profile incidents, such as the ransomware attack on Colonial Pipeline in the spring, which led to fuel shortages in the south-east.

The government has been implementing sweeping cybersecurity measures since last month, requiring federal agencies to address flaws in all software and hardware of their information systems, regardless of whether they are managed by a government entity or  third parties. The Transportation Security Agency has already updated its aviation security programmes.

“These new cybersecurity requirements and recommendations will help keep the travelling public safe and protect our critical infrastructure from evolving threats,” said Dept of Homeland Security secretary Alejandro Mayorkas.

According to the US Airforwarders Association (AfA), the new requirements do not extend to indirect air carriers, so forwarders do not have to comply, but executive director Brandon Fried said he would not be surprised if the rules were extended to the forwarding community in the coming months.

“The forwarding community has been a victim of cybersecurity breaches,” he added. “We are extremely concerned about the issue.”

Cybercriminals have targeted the logistics sector in high-profile incidents like the NotPetya attack on Maersk in 2017, which cost the shipping giant about $300m, and the ransomware attack on Forward Air last December.

In the wake of NotPetya, the AfA was sufficiently alarmed to work on an insurance programme for cybersecurity, teaming up with Roanoke Insurance Group. The programme, which included a threat analysis test, was met with lively interest at its launch about a year ago, Mr Fried said, but during the pandemic it had been difficult to keep track of its progress, he added.

He suspects that quite a few operators are not enforcing cybersecurity protocols, possibly owing to lack of resources or belief that cyber attacks would hit others but not them. And in all likelihood, many member companies would not disclose that they had been hit by a cyber attack, he reckons.

“They don’t want to appear compromised. It’s a business strategy that dealing with these matters is proprietary,” he explained.

From an industry perspective, of course, this is counterproductive. The Transported Asset Protection Agency, which monitors and combats cargo crime, has been crusading for greater transparency on incidents in order to spread awareness and help companies protect themselves better.

Overall, efforts to combat cybercrime in the logistics sector are on the rise. As The Loadstar reported on Tuesday, cybersecurity provider IASME Consortium has introduced a certification programme for maritime vessels, meant to provide a base level of cyber-resilience on ships.