ASTM F3286-17

Standard Guide for Cybersecurity and Cyberattack Mitigation

SIGNIFICANCE AND USE
5.1 To maintain the integrity of potentially vulnerable information systems while the vessel is at sea or in port, strategies and procedures can be used by every company, organization, and ship. Mitigating potential cyberattack events will allow for a better economic environment through secure consumer, employee, and corporate data. Informational infrastructure between ships, platforms, and onshore facilities are more interconnected today than a decade ago. The long-term health and economic viability of ship owners and operators depend on establishing and maintaining security that can measured and monitored.  
5.2 With the increase in cyberattacks in recent decades, maritime-based companies and governments have cited a need to update and train their workforce to mitigate the loss of data or intellectual theft from onboard systems.  
5.2.1 Vulnerable onboard systems can include, but are not limited to:
5.2.1.1 Cargo management systems;
5.2.1.2 Bridge systems;
5.2.1.3 Propulsion and machinery management and power control systems;
5.2.1.4 Access control systems;
5.2.1.5 Passenger servicing and management systems;
5.2.1.6 Passenger facing public networks;
5.2.1.7 Administrative and crew welfare systems;
5.2.1.8 Communications systems;
5.2.1.9 Distributed computing devices that support an internet of things (IoT)-enabled ship; and
5.2.1.10 Onboard sensors that facilitate wheelhouse automation, alerting, and IoT transmission.  
5.2.2 Many of these systems are critical to mariners while at sea. If any of said systems failed or were compromised while at sea because of a cyberattack, then the ship and its security could be compromised.  
5.3 By adopting these practices, mariners and shoreside employees at all levels of the organization should be able to identify potential threats or risk factors, as well as the abnormal indications that show a cyberattack underway.  
5.4 Cyberattacks can occur in multiple forms including, but not limited to, the foll...
SCOPE
1.1 This guide addresses the company or government organizational need to mitigate the likelihood of cyberattacks and reduce the extent of potential cyberattacks, which can leave sensitive personal data, corporate information, and critical infrastructure vulnerable to attackers.  
1.2 These recommendations are meant to serve as a guideline for corporate and government organizations to adopt for the protection of sensitive personal information and corporate data against hackers.  
1.3 Cybersecurity and cyberattacks are not limited to the maritime industry. With greater advancement in computer and information technology (IT), cyberattacks have increased in frequency and intensity over the past decade. These advancements provide hackers with more significant tools to attack vulnerable data and communication infrastructures. Cyberattacks have become an international issue to all governments and companies that interact with each other.  
1.4 Cybersecurity and the safety of cyber-enabled systems are among the most prevailing issues concerning the maritime industry as well as the global economy. Cyberattacks could affect the flow of trade or goods, but operator errors in complex, automated systems may also cause disruptions that may be mitigated with proper policies and personnel training.  
1.5 This guide is meant to provide strategies for protecting sensitive data onboard vessels and offshore operations.  
1.6 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.7 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides ...

General Information

• Status: Published
• Publication Date: 30-Nov-2017
• ICS: 35.030 - IT Security
• Technical Committee: F25 - Ships and Marine Technology
• Drafting Committee: F25.05 - Computer Applications

Relations

• Referred By: ASTM D8320-21 - Standard Practice for Implementing an Information Security Program in a Cannabis Operation
• Effective Date: 01-Dec-2017

Standards Content (Sample)

This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the
Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.
Designation: F3286 − 17 An American National Standard
Standard Guide for
1
Cybersecurity and Cyberattack Mitigation
This standard is issued under the fixed designation F3286; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope 2. Referenced Documents
2
1.1 This guide addresses the company or government orga-
2.1 Federal Standards:
nizational need to mitigate the likelihood of cyberattacks and
46 CFR 140.910 Equipment
reduce the extent of potential cyberattacks, which can leave
sensitive personal data, corporate information, and critical
3. Terminology
infrastructure vulnerable to attackers.
3.1 Definitions:
1.2 These recommendations are meant to serve as a guide-
3.1.1 access control, n—practice of selective limiting of the
line for corporate and government organizations to adopt for
ability and means to communicate with or otherwise interact
the protection of sensitive personal information and corporate
with a system, use system resources to handle information,
data against hackers.
gain knowledge of the information the system contains, or
1.3 Cybersecurity and cyberattacks are not limited to the
control system components and functions.
maritime industry. With greater advancement in computer and
3.1.2 application programming interface, API, n—set of
information technology (IT), cyberattacks have increased in
routines, protocols, and tools for building software and appli-
frequency and intensity over the past decade. These advance-
cations.
ments provide hackers with more significant tools to attack
3.1.3 botnet, n—number of internet-connected computers
vulnerable data and communication infrastructures. Cyberat-
communicating with other similar machines in which compo-
tacks have become an international issue to all governments
nents located on networked computers communicate and
and companies that interact with each other.
coordinate their actions by command and control or by passing
1.4 Cybersecurity and the safety of cyber-enabled systems
messages to one another.
are among the most prevailing issues concerning the maritime
3.1.4 capability, n—ability to execute a specified course of
industry as well as the global economy. Cyberattacks could
action.
affect the flow of trade or goods, but operator errors in
complex, automated systems may also cause disruptions that
3.1.5 communications, n—means for a vessel to communi-
may be mitigated with proper policies and personnel training.
cate with another ship or an onshore facility.
1.5 This guide is meant to provide strategies for protecting
3.1.6 compression, n—reduction in the number of bits
sensitive data onboard vessels and offshore operations.
needed to store or transmit data.
1.6 This standard does not purport to address all of the
3.1.7 cybersafety, n—guidelines and standards for
safety concerns, if any, associated with its use. It is the
computerized, automated, and autonomous systems that ensure
responsibility of the user of this standard to establish appro-
those systems are designed, built, operated, and maintained so
priate safety, health, and environmental practices and deter-
as to allow only predictable, repeatable behaviors, especially in
mine the applicability of regulatory limitations prior to use.
those areas of operation or maintenance that can affect human,
1.7 This international standard was developed in accor-
system, enterprise, or environmental safety.
dance with internationally recognized principles on standard-
3.1.8 cybersecurity, n—activity or process, ability or
ization established in the Decision on Principles for the
capability, or state whereby information and communication
Development of International Standards, Guides and Recom-
systems and the information contained therein are protected
mendations issued by the World Trade Organization Technical
from and defended against damage, unauthorized use or
Barriers to Trade (TBT) Committee.
modification, or exploitation.
1
This guide is under the jurisdiction of ASTM Committee F25 on Ships and
Marine Technology and is the direct responsibility of Subcommittee F25.05 on
2
Computer Applications. Available from U.S. Government Printing Office, Superintendent of
Current edition approved Dec. 1, 2017. Published January 2018. DOI: 10.1520/ Documents, 732 N. Capitol St., NW, Washington, DC 20401-0001, http://
F3286-17. www.access.gpo.gov.
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 1
...