2023 GMTSC Symposium

Table-Top Exercise - Maritime Cyber Response

Table-Top Exercise Maritime Cyber Response

National level and multinational examination of cyber events, like those provided in a TTX deliver a unique platform to examine responses and gaps in authorities, response capabilities, investigative considerations, and the approach to notification. Annual exercises support improved collaboration and build trust. Exercises further support the development of a consistent, documented, and repeatable process to integrate national, international (and, as appropriate, private sector) partners to positively shape the security/response environment. Awareness of existing source documents, involved agencies, and coordinating mechanisms to maritime cyber threats helps to create alignment and awareness for the varied frameworks.

Cybersecurity threats in the maritime industry induce additional challenges by crossing the interlocking priorities, practices, and domains. Increasingly, these transboundary threats demand transboundary cooperation and coordination. Tabletop exercises are a powerful tool for aligning expectations, building common ground, and exploring potentially thorny obstacles to effective cooperation.

This TTX features scenario-based discussions that examine navigational software disruptions; malware targeting critical port infrastructure; and national-level information sharing, public-private cooperation, and multilateral information sharing considerations. Additional discussion will further examine the intersection of an array of government offices (e.g., operational, regulatory, investigative, diplomatic, and legal), the private sector (e.g.,port and terminal operators, shipping industry associations, maritime insurance companies); and partner nations. The discussion will provide participants with an opportunity to analyse challenges to improve awareness, capacity building, and ensure that stakeholders are not confronted with a cyber-threat for the first time when it needs to be addressed.

Substantive focus areas that will be raised in this discussion include highlighting the importance of timely notification or reporting of cyber incidents; dilemmas between recovering the affected systems as quickly as possible versus leaving the evidences for digital forensics investigations; process for information acquisition and exchange; determining an end-state; identifying the government agencies potentially involved in the response to malicious cyber activities; facilitating the timely exchange of information within a government and among nations; determining what can be shared and with whom; how government can share higher classification information with private organizations in order
to help them to protect their systems better when encountering imminent threats; protecting information; building trust; and public statements/warnings.

The overarching objectives are to demonstrate the value of exercises as an element of the cyber incident response process, to build up the bedrock of cooperation that will be called upon in times of crisis, to explore varied perspectives on exercises, and to share best practices in managing competing response interests.