1. Introduction

As the maritime industry has developed from the conventional ship era to the smart ship era, the reliance on digitalization, integration, and networking has grown. As technologies for shore have been developed, all interested parties have started to merge the technology into the maritime industry as e-navigation. However, as ships have been opened for satellite communications, the risk of cyber-attacks has increased significantly. Facing new issues, IMO (International Maritime Organization) and other organizations established guidelines for cyber security (IMO, 2016;IMO, 2017;OCIMF, 2017;BIMCO, 2018).

In the 86th session of the IMO Maritime Safety Committee (MSC), the SOLAS amendment was adopted to use ECDIS as the main navigation system, and it was mandatory to mount ECDIS from 2012 to 2018 (IMO, 2009a;IMO, 2009b). ECDIS, which has been mounted as a navigation device, is now an important device along with changes in the digitalization environment (Kwon et al., 2021).

Jung et al. (2015) suggested improvements in ECDIS function in terms of navigation safety and efficiency through a survey of officers. Lee (2018) conducted a user evaluation of ECDIS, which has become essential equipment for ships; and found that the efficiency of work simplification and cost reduction declined immensely after usage. It was suggested that not only is user education necessary but also a change in the system level. Lee et al. (2019) analyzed ECDIS-related accident reports using textmining techniques; and found that accidents related to ECDIS problems are increasing. Kwon et al. (2021) evaluated the relative importance of the bridge navigation equipment through AHP analysis and found that RADAR, GPS, and ECDIS were relatively important and had a large impact on maritime accidents. Current ECDIS research focuses on user-oriented operation and navigational safety.

Regarding security in the maritime field, KMI (2019) analyzed the policies of major countries on cyber risk management in the maritime field and presented policies related to maritime cyber security through a survey. D’agostini and Jo (2019) concluded with the fact that security training for seafarers has a positive effect on seafarers' security awareness and ship security performance. Lee et al. (2020) suggested designating a ship's cyber security officer and opening a class for training courses. Svilicic et al. (2018) proposed a risk assessment framework based on an on-board survey, and conducted a risk assessment for ECDIS using a vulnerability-scanning tool according to the proposed framework. Until now, most studies have focused on the importance of ship cyber security and the importance and connectivity of ECDIS as a navigation device. However, Svilicic et al. (2018) conducted an ECDIS risk assessment related to ship cyber security, however, it focused on overall security. This study is significant in that policy priorities are proposed by quantitatively indicating the importance and performance level of ship cyber security risk factors of ECDIS based on user experience. In other words, the purpose of this study was to establish the ECDIS cyber security risk factors from the user's perspective and to present policy priorities through quantitative analysis. This study analyzed the cyber security risk factors of ECDIS, which is the key equipment for ship digitization. The trend of cyber security in the maritime sector was analyzed, and cyber security-related policies that should be prioritized through an importance-performance analysis of officers who are actual users of ECDIS.

2. Overview of ECDIS Cyber Security

2.1 Trend of Cyber Security

As IMO is responsible for the safety and security of shipping, they announced that cyber security technology will be the main subject and will focus on cyber security until 2023. In this regard, IMO also showed the urgent need to raise awareness of cyber risk threats in the maritime field and its vulnerabilities.

The IMO has established guidelines on maritime cyber risk management (MSC-FAL.1/circ.3). The document; states that their maritime cyber risk management goal is to support safe and secure shipping, which is operationally resilient to cyber risks. Therefore, the MSC at its 98th session in June 2017 adopted Resolution MSC.428 (98) – Maritime Cyber Risk Management in Safety Management Systems. The resolution encourages administrations to ensure that cyber risks are appropriately addressed in existing safety management systems (as defined in the ISM Code) no later than the first annual verification of the company's Document of Compliance after January 1 2021. Additionally, the IMO has also imposed high-level recommendations on maritime cyber risk management to safeguard shipping from current and emerging cyber threats and vulnerabilities.

The IMO's guidelines present the following functional elements that support effective cyber risk management.

2.2 BIMCO

BIMCO, the world's largest direct-membership organization of ship-owners, charterers, shipbrokers, and agents, has also published guidelines on cyber security onboard ships. The purpose of these guidelines is to improve the safety and security of seafarers, the environment, cargo, and ships.

Published guidelines aim to assist in the development of a proper cyber risk management strategy following relevant regulations and best practices on board a ship with a focus on work processes, equipment, training, incident response, and recovery management.

The 4th guidelines for ship cyber security were published in 2019 and provide ship-owners and operators with guidelines and procedures to secure the company's cyber systems.

2.3 Case Studies

As the era of autonomous ships has arrived, the maritime industry is constantly evolving. One of the biggest changes in ships is that the system has changed into an interconnection of networks between the navigation equipment. Kesseler et al. (2019) mentioned that the interconnectedness of networks within a system allows one network to provide a path to other networks. As various equipment are interconnected, it is now much easier for hackers to access the data. Below are examples of cyber-attack cases in the maritime field, which demonstrate the damage that can be caused.

(1) A.P. Moller Maersk

In 2017, Maersk was infected by the Ukrainian tax return vendor MeDoc. The virus was spread across the entire company's IT network within seven minutes, including all core business units. Consequently, the company's booking website and 49,000 laptops were destroyed, 1,200 apps were instantly inaccessible and 1,000 applications were disrupted. Since the virus spread rapidly, the company had to disconnect immediately from the global network and revert to manual systems.

After reverting to a manual system, trading volumes reduced by 20%, and online bookings were only resumed after eight days. After four weeks, the full IT network was restored and the Maersk line had to re-install 45,000 PCs and recover 4,000 server applications. Consequently, the NotPetya attack caused a $300M financial loss.

The NotPetya ransom ware which was used in this attack, had a history of inflicting widespread damage not only against the FedEx system of an air logistics company but also throughout companies in Ukraine. NotPetya is a malicious code, which runs on the Windows operating system, as a variant of the ransom ware Petya, which exploits Windows Server Message (SMB) vulnerability to encrypt the entire Master Boot Record file and requires bit coin for the decryption cost. NotPetya was more lethal than Petya as it was impossible to recover encrypted data.

(2) Iranian Shipping Line

In 2011, the Islamic Republic of Iran Shipping Line (IRISL)'s server was subjected to cyber-attacks. In 2011, IRISL had the largest fleet in the Middle East consisting of 170 ships. Due to the attack, the company lost all data for their fleets, including rates, loading information, cargo tracking numbers, and customer information. This meant that nobody knew which container should be delivered to where or whom, whether the cargo had been loaded or not, and which containers were left on board.

Furthermore, the attack continued to eliminate the company's internal communication network. This caused significant disruptions in operations and resulted in sending cargo to wrong destinations causing severe financial losses.

(3) Mediterranean Shipping Company (MSC) shipping

The Mediterranean Shipping Company, which has over 480 offices across 155 countries worldwide, was cyber-attacked on April 9, 2020. The attack disrupted the company’s global services by file-encrypting malware, causing a data center outage and leading to main customer's websites being down for days.

MSC shipping confirmed that it was confined to a limited number of physical computer systems in Geneva only and determined that it was a malware attack based on an engineered targeted vulnerability.

(4) ECDIS Cyber-attack

Most vessels receive their updated electronic navigational chart (ENC) or update ECDIS software through USB or CD/DVD. Officers are predominantly unaware of the fact that a USB/CD/DVD could be infected with a virus and plugged it without scanning for any viruses. For example, during an inspection onboard a tanker, the inspector noticed that a USB drive was plugged into the ECDIS to install updates for ENCs. The officer of the watch complained that the system was too slow and some false alerts popped up on the ECDIS computer, creating an abnormal system. Fortunately, with the assistance of the inspector and the managing company's IT department, it was found that ECDIS sensor data were manipulated with unreliable information displayed to the officer of the watch.

Kesseler et al. (2019) introduced a case of an ECDIS attacked by malware that was inserted into the vessel's ECDIS through a satellite link. As many vessels are open to satellite communication and have internet access, the malware was inserted into the vessel's electronic chart display information system via a satellite link to the master computer. The malware altered the ship's position during the night without changing the ECDIS display. The second piece of malware was uploaded to the radar system via a network switch that connected radar, ECDIS, bridge, and other ship communication systems. This malware altered the radar display by deleting targets on the display, essentially blinding the ship. The final malware was inserted into the machinery control systems network via an infected thumb drive.

As ECDIS is receives many data signals through various equipment, it has been proven that the ECDIS is highly vulnerable to attacks such as malware via computer viruses, worms, Trojan horses, or ransom ware. To protect the ECDIS from cyber-attacks, access should be restricted to only trained and authorized personnel including computer operation system (OS) and password protection.

2.4 ECDIS

(1) Entry into the ECDIS

Since 2002, vessels have had the option to be fitted with an ECDIS along with a backup arrangement as a means of fulfilling the requirement under the International Convention for the Safety of Life at Sea (SOLAS, 1974) regulation V/19-2.1.4 for the vessel to carry nautical charts for the intended voyage.

This option is now transforming into a mandatory requirement as at a meeting of the IMO MSC in May and June 2009, further amendments to SOLAS regulation V/19 were made to make the carriage of an ECDIS mandatory on vessels engaged in international voyages with an expected date of entry into force as of January 1, 2011.

According to on-board fulfillment requirements, Svilicic et al. (2019) stated that the ECDIS must be type-approved, with up-to-date ENCs implemented, ECDIS software maintained, and an adequate backup arrangement installed (IMO, 2017;IMO, 2006;IHO, 2017;IHO, 2018). Svilicic et al. (2019) explained that an ECDIS is considered a critical operational technology for voyage planning which complies with the updated paper charts (complies with IMO regulations and mandatory carriage) and plays a central role in safe ship navigation and transport (IMO, 2017).

(2) ECDIS function

The primary function of an ECDIS is to not only replace paper charts but also to contribute to safe navigation by receiving and displaying information from other navigational equipment. The main functions supported by an ECDIS are as follows:

According to the IMO performance standards, the system should be directly connected to three sensors mandatorily: position, heading, and speed. However, as time has come for an era of integrated bridge system (IBS), an ECDIS was developed to receive more sensor information from a variety of navigational equipment.

3. Methodology

3.1 Survey Design

BIMCO divides cyber security into administrative and technical securities to protect information from cyber risks and includes the physical security as a part of the administrative security. In addition, 12 survey items were derived by referring to the results of KMI (2019), which presented four priorities for each item among the security risks presented in ISO/IEC 27001 (Table 3).

3.2 Importance-Performance Analysis (IPA)

IPA analysis compares and evaluates the association between the importance and performance of key attributes for analysis targets. (Martilla and James, 1977). Therefore, after the main attributes and factors of the analysis were determined, the data were collected through a survey, and a quadrant matrix was generated by using the collected data. The x-axis of the matrix represented the importance of the attribute, the y-axis represented the achievement of the attribute, and the average value of each attribute was plotted on the matrix. IPA analysis can also present policy priorities and implementation methods by raising the importance and performance of the matrix (Lim et al., 2017). The matrix is comprised of four quadrants with their own characteristics. The first quadrant reflected good work maintenance, which requires continuous management to maintain the current state. The second quadrant was the possible overkill, and good results were obtained if the over-invested resources were applied to the first or fourth quadrants. The third quadrant was a low priority section and did not require more investment than the current situation, and could be provided much later in the future. The fourth quadrant required the most concentrated effort and intensive investment because users were not satisfied with the current service.

However, traditional IPA assumes that importance and performance are independent; however, they are not. To compensate for this, Deng (2007) proposed converting the performance item for each attribute into a natural logarithm and by using the partial correlation coefficient derived through the partial correlation analysis with the overall performance as a relative importance value. The properties that belong to each domain of the modified IPA matrix were interpreted the same as the traditional IPA.

For IPA analysis, a survey was conducted using a 5-point Likert scale for importance and performance of the items in Table 3 to ship operators who have used an ECDIS.

3.3 Reliability Analysis

The responses to the survey are presented on a 5-point Likert scale for importance and performance, and the Cronbach’s alpha value was calculated using Equation (1) to verify the reliability of the survey response.

4. Result & Discussion

4.1 Frequency Analysis

To evaluate ECDIS cyber security risk factors, a survey was conducted on officers who had experience using the ECDIS onboard. Frequency analysis was conducted using 89 data points from a total of 100 (Table 5). The 2^nd officers answered the most and questions followed by the 3^rd officers. Most respondents had less than three years of onboard experience. As the ECDIS is navigation equipment that is mainly used by junior officers for voyage planning, the survey consisted of many answers from junior officers. The most used model was JRC. More than half (52.8%) of the respondents participated in cyber security-related training, and 22.5% of respondents had experience in ECDIS cyber-attacks.

4.2 Reliability Analysis

The reliability assessment of survey items showed that both importance and performance have a Cronbach’s alpha value of >0.9 and survey data are consistent (Cronbach, 1951).

4.3 Independent Two Sample t-test

(1) Analysis results by the rank

An independent two-sample t-test was conducted to determine whether the importance and performance of ECDIS cyber security risk factors differed according to the officer's rank. The test results showed that, the importance of the senior group (M = 4.6) to the portable media control policy was significantly higher than that of the junior group (M = 4.041). In addition, for remote access control and wireless access (Wi-Fi, etc.) control using encryption keys, the junior group (M = 3.612) showed significantly higher achievement than the senior group (M = 3.154). In some items, there were significant differences between groups, however, there was no statistically significant difference between groups in terms of importance and achievement.

(2) Analysis results for cyber-attacks

An independent two-sample t-test was conducted to determine whether the importance and performance of the ECDIS cyber security risk factors differ according to the cyber-attack experience. The results showed that the attacked group (M = 4.05) had significantly higher achievement for establishing emergency plans for cyber-attacks than the group with no attack experience (M = 3.464). When experiencing a zero-cyber-attack, the plan that was established in advance during the course of action was helpful. There were significant differences between groups in some items; however, there was no statistically significant difference between the groups in terms of importance and performance.

(3) Analysis results by completion of cyber security training

An independent two-sample t-test was conducted to determine whether the importance and performance of the ECDIS cyber security risk factors differ according to the completion of cyber security education. The results showed that test, there was no statistically significant difference between the groups in terms of importance and performance in all items.

4.4 IPA Analysis

Since there was little significance in the average between groups based on the rank, cyber security training completion, and cyberattack experience, IPA analysis was conducted on cyber security risk factors from the perspective of an officer who mainly uses the ECDIS. Fig. 2 shows the analysis results using traditional IPA. The first quadrant represents ‘keep up good work’ which indicates that officers believe that the properties of ‘data backup and recovery’, ‘secure zone control’, ‘portable media control’, ‘H/W and S/W upgrade’, ‘emergency plan establishment’, and ‘network access control’ are important and are being performed well. The third quadrant shows that ‘data and license disposal’, ‘guaranteed availability or integrity of equipment’, ‘ban on carrying out any information and software outside’, and ‘remote and wireless access control’ had the lowest priority. The fourth quadrant reflects ‘concentrate here’ and ‘raise awareness and train employees’ and ‘detect and block cyber-attacks’ were classified as the most urgently needed attributes.

A modified IPA analysis was performed to supplement attributes that are skewed towards the first and third quadrants, which was highlighted as a persistent problem of traditional IPA by Deng (2007) (Fig. 3). Consequently, ‘portable media control’, ‘security zone control’ and ‘establish emergency plan’ were classified as performing well compared to their importance which was ‘possible overkill’. Furthermore, ‘guaranteed availability or integrity of equipment’, ‘detect and block cyber-attacks’, and ‘remote or wireless access control’ were classified as areas to be focused on.

4.5 Discussion

The first hypothesis, “the level of performance or importance of current cyber security risk factors will differ depending on the officer’s rank, completion of cyber security training, and cyber-attack experience,” was rejected, except for some items. In other words, there was no difference in the average value of the survey according to the officer’s rank, cyber security training completion, and cyber-attack experience. Therefore, IPA analysis was conducted with officers who had actual ECDIS usage experience. IPA is a methodology mainly used to determine policy, however, since traditional methods have limitations, a modified IPA methodology was also used, and Table 9 shows the comparison of each result.

Policies that show the same results in both traditional and revised methodologies must be implemented first. 'H/W and S/W upgrade', 'network access control', and 'data backup and recovery' policies performed well in preventing cyber-attacks from an officer's perspective. Therefore, these policies should continue to be promoted in the future. However, it is necessary to postpone priorities and invest in other areas to address the items, namely, ‘ban on carrying out any information and software' and 'discard data and license'. Since the ECDIS is equipped with software and hardware on the bridge and operates continuously for 24h, it was found that there were limited opportunities for officers to remove the license during the voyage, which resulted in a low priority. 'detect and block cyber-attacks' was analyzed as the most urgent factor, which should be implemented.

This policy must be technically supported, and it was determined that technology development will be necessary to meet the needs of users and officers. According to a previous study, ‘detect and block cyber-attacks’ and ‘network access control’ had relatively high importance, and ‘removal of data and S/W license’ had the lowest importance (KMI, 2019). These findings were similar to the results obtained in this study based on the experience of ECDIS users. However, training was identified as an important item in previous studies, and it was not of high importance from the perspective of ECDIS users. This is so believed because the current official ECDIS training does not have any cyber security information; therefore, users do not perceive it to be significant (IMO, 2012).

5. Conclusion

The danger of cyber-attacks is increasing because of the rapid progress of digitalization. In particular, several cyber-attack that occurred in the maritime field proves that ships are targets for cyber-attacks. In particular, the ECDIS, which plays a key role in the transition from analog to digital navigation equipment, requires thorough preventive measures to prevent accidents. This study attempted to derive cyber security risk factors and examined the priorities of policies that must be implemented for officers using the ECDIS, which is the connection center for navigation devices. The conclusions drawn from this study are as follows :

This study derived cyber security risk factors and analyzed its priorities based on ECDIS users. However, the limitation of the study was that the analysis of maritime employees, and cyber security management policies was done on a small scale. In the future, such analysis should be conducted on a wide scale by expanding the scope to other industries.