An Overview Of Security Challenges Of Seaport

IoT Systems
M. Jović*, E. Tijan**, S. Aksentijević ***, and D. Čišić ****
*Faculty of Maritime Studies/Department of maritime logistics and management, Rijeka, Croatia
jovic@pfri.hr
** Faculty of Maritime Studies/Department of maritime logistics and management, Rijeka, Croatia

etijan@pfri.hr
*** Aksentijević Forensics and Consulting, Ltd., Viškovo, Croatia
sasa.aksentijevic@gmail.com
**** Faculty of Maritime Studies/Department of maritime logistics and management, Rijeka, Croatia
dragan@pfri.hr

Abstract - Introduction of Internet of Things (IoT) and solutions after attacks which occur more often as density
accelerated digitalization have globally improved of devices increases. If the focus is only on benefits of
productivity of seaports. The underlying problem of IoT is IoT, assuming that security is maximized, huge
data vulnerability, and the effects are very pronounced advantages can be noticed: effective monitoring of
within the complex business processes that take place in operations concerning the vessels, timely reactions and
seaports. The main consequences of the unprotected speeding up of overall business processes.
connected devices are unauthorized access, theft of
important information, and loss of information control. In
the future, new vectors of intrusions will be developed, and II. SECURITY AS A BASIS FOR SUCCESSFUL
it is important to anticipate possible weaknesses. DIGITALIZATION OF PROCESSES AT THE SEAPORTS
Furthermore, IoT data must be continuously backed up in The Internet of Things represents the digital, or
remote locations, which would facilitate the prevention of "smart" connection of objects using RFID sensors, Wi-Fi,
irrecoverable loss of data. Some seaports, where large
Bluetooth and other “smart” protocols in order to
volume of traffic is present, demonstrate that it is possible to
accelerate business processes. By 2020, there will be
utilize IoT advantages after the correct implementation and
monitoring of the entire system, while minimizing errors or
about 26 billion devices connected to the Internet [4]. The
consequences of security attacks. maritime industry, due to the digitalization process, comes
out of its traditional frameworks by creating solutions to
Keywords - Internet of Things, Seaports, Security systems improve the productivity and the sustainability of logistics
[5].
I. INTRODUCTION The goal of IoT is facilitating planning and
With the development of international trade and management of business processes by introducing modern
globalization, it is possible to notice the tendency of the information technologies. Preventive security mechanisms
traffic and cargo increase, so numerous seaports were are needed to ensure the entire network implemented by
compelled to accept changes in the transport sector and protocol such as: “managing identity devices, entering and
turn to more effective practices by introducing the Internet controlling a device access and monitoring” [6].
of Things (IoT) in their own seaports. The IoT can be Figure 1 [7] shows the global number of connected
considered as “the novel generation of Wireless Sensor Internet of Things devices (in billions) from 2016 to 2024
Networks (WSN) and it represents a network composed of (projected).
heterogeneous sensing devices, connected together over
the Internet, to acquire information and forward it to a
center of collect (base station)” [1]. The main goal of
digitalization is to speed up business processes but also to
reduce environmental pollution which is increasingly
being regulated by the “green laws”. “The most obvious
benefit of IoT connectivity lies in how it can transform
day-to-day operations at sea, at port and as part of a wider
logistics network: issues can be pinpointed, downtime can
be reduced, and processes can be streamlined, changing
the face of the maritime industry as we know it” [2].
Adequate security levels are required in ports, with
respect to the facilities and assets they utilize. Therefore,
the infrastructure and access to the restricted areas should
be monitored [3]. The main concern is directed towards
Figure 1: Connected devices in billions 2016 – 2024 [7]
consequences, security of the system and possible

MIPRO 2019/DE-DS 1571

 Security and privacy are main issues because
connecting various devices to the Internet opens the
possibility of unauthorized access and control as well as
theft of valuable information.
From the figure, it is possible to see the growth of the
connected devices. In 2016 there were 17.68 billion
networked devices, while by 2018 the number grew by 2.6
billion [7]. An additional growth of connected devices is
forecasted, and by 2024, connection of about 62 billion
additional devices is expected, 39 billion more than in
2018.
According to the Internet Society, overall system
security is as good as its weakest connection because
various components can be controlled by different actors
in different jurisdictions (e.g. a server may be located in
one country, while the device may be manufactured in
another, and in use in yet another), making it more
difficult to cooperate while solving security issues [8].
According to Statista, an investment in the endpoint
security amounted to US $ 302 million in 2017 [7]. It is
also predicted that $ 631 million will be invested in end-
point security for affiliated devices in 2021, while $ 415
million will be invested in the access points, which is 216
million less than the 'end-point investment. From 2016 to
2021, the trend of the security investment will be on the
rise, given that security is the basis for the undisturbed
functioning of the system of interconnected devices.
The classification of IoT architecture related to
security consists of 4 layers, as shown in Figure 2, and
each of them has its own security issues [9].
Figure 2: IoT security and attacks [9]
1572
Basic IoT security problem is caused by the fact that
the connection runs in two directions: the device can send
data to the cloud and take the information from the cloud.
If this basic connection is compromised, there will be
immense security issues.
There are several basic characteristics of the attacks
related to IoT architectures [9].
• Perceptual layer consists of resource constrained
IoT devices i.e. Sensors, RFID tags, Bluetooth
and Zigbee devices.
• Many types of network attacks like eavesdropping
attack, DoS attack, Man in the Middle attack, and
virus invasion are still affecting network layer.
• Support Layer Security hosts IoT user’s data and
applications so both should be protected from
security breaches.
• Data sharing is one of the characteristics of IoT
application layer.
In a study commissioned by Inmarsat (the world leader
in global mobile satellite communications) and presented
at the Press Briefing during the international shipping
exhibition “Posidonia” in 2018, the following question
was asked: ''How mature is the maritime sector’s approach
to the IoT security?'' The answers were [10]:
• The cyber security fears focus on inward-facing
matters such as data storage (55%)
• 53% believe that more security skills would help
deliver IoT based solutions.
• 87% believe that data mishandling processes
could be improved
III. MEASURES FOR PREVENTION OF THE IOT
SECURITY THREATS
Michael Sentonas (VP and Global Chief Technology
Officer at Security Connected for McAfee) has outlined
the biggest threats to information and digital security that
threaten business security in seaports [11]:
• The attacks on devices (IoT): confidentiality of
information would be com
• promised in ports, i.e. business processes or
designs that are key for the competitiveness of the
port itself. The problem arises when governments
and companies cannot agree upon a definition
what is an authorized data access.
• Ransomware and Mobile Malware - this kind of
attack is on the rise, and in today's business,
seaports are trying to utilize faster ways of
exchanging information by introducing tablets or
mobile devices that speed up business processes
among stakeholders. Over time, threats to mobile
devices will quickly increase, as new mobile
technology spreads the attack surface.
In order to transfer data between nodes safely, it is
necessary to create “lightweight cryptographic
algorithms”. This will ensure the confidentiality of data
MIPRO 2019/DE-DS
 between the nodes [9]. When the device/network is
compromised, cybersecurity teams must instantly take the
following measures [12]:
• Cybersecurity teams must be ready to react at any
time to minimize the damage and ultimately stop
spreading ransomware within the IoT network.
• It is necessary to install current and secure
software that will monitor the security of the IoT
network.
• In order to prevent file recovery costs, data should
be stored in the secure data storage.
Fortinet’s 2014 survey of Australian CIOs showed that
88% of CIOs and IT decision-makers (ITDMs) noticed the
increasing frequency and complexity of threats, as well as
the new demands of emerging technology like the Internet
of Things (IoT) [11]. According to the survey, 53% of all
ITDMs surveyed have slowed down or cancelled a new
application, service, or other initiative because of cyber-
security fears.
In a recent Check Point Study (2018), involving 850
organizations, it has been found that each of these
organizations have faced an attack (mobile malware); 94%
of security experts expect the number of mobile malwares
to continue to increase; most of these malwares comes
from third parties but are found and embedded in
applications that have been sold through the application
store [13].
Complex supply chains make security assessments
more challenging, requiring holistic approach, while
providing coordination among different sides and system
components. IoT systems are controlled and interactively
managed by "cloud" services rather than being controlled
locally.
California is an example of the US state introducing a
law for regulating IoT, as a first concrete step in the fight
against security threats caused by increased connectivity
of the devices. Earlier, the use of IoT was largely self-
regulated, or regulated by the best practices of the
industry. Law on safety-related devices aims to equip the
devices with a security feature or features that are
appropriate for the nature and function of the device,
appropriate to the information that they may collect,
contain, or transmit [14]. It is also designed to protect the
device and all information contained therein from
unauthorized access, destruction, use, and modification.
IV. CONSEQUENCES OF CONNECTING THE
DEVICES (IOT) AT THE SEAPORTS WITH
EMPHASIS ON THE SECURITY
According to TechRepublic, an online trade
publication and social community for IT professionals, the
Internet of Things (IoT) continues to grow as a prime
target for cybercriminals to exploit, and according to a
new threat report from Symantec security company, the
number of IoT attacks has increased from about 6,000 in
2016 to 50,000 in 2017—a 600% rise in just one year
[15]. According to SIA partners and their case study “The
Internet of Things in Transportation” (2016), connecting
things to the Internet presents a potential security and
MIPRO 2019/DE-DS
privacy problem because of the unauthorized access, the
theft of information and the control over them [16].
Gamundani [17] has classified the threats and
consequences of IoT into four categories:
• Application based: Each seaport should have
surveillance cameras as one of the security
measures which should be placed in the position
with maximum coverage. But in the case of
burglary, the camera cannot provide the detailed
information about the method or mechanism of
information theft or misuse. Therefore, in order to
facilitate data protection, additional studies and
methods are required. More advanced IoT
cameras that would prevent adverse consequences
are required and they ought to be equipped with
intelligent cloud-based sensors, such as heat
sensitive sensors.
• Connection based: Connecting things to the
Internet is based on IP network and if its security
is not closely monitored, the entire IoT network
can be compromised.
• Platform based: “Wireless sensor network has
pending issues to be addressed which comprise of
applications like communication platforms,
security and management”. As with the
connectivity problems, there is a problem with the
communication platform as well - the more
connected devices, the more possible attacks.
• Other forms of attack: “Combining application
and platform-based threats, gives an intertwined
force of challenges that leaves the whole security
ground weakened, hence proper thriving of IoT
applications is endangered”.
The consequences of unprotected IoT are shown by
using examples at several seaports. One of the leading
seaports in IoT adoption and implementation of security
measures is the port of Rotterdam. The port is increasingly
turning towards smart digitalization and cloud-based IBM
technology. Special efforts are invested in IoT
development. “Sensors are being installed across 42-
kilometers of land and sea - spanning from the City of
Rotterdam into the North Sea” [18]. Since Rotterdam is
the largest port in Europe, it has 140,000 vessel calls each
year. Each ship call is a complex task, and with the help of
IoT it is possible to safely manage processes involving the
arrival and departure of the ship [19]. Namely, it is
possible to create digital twinning that covers all resources
in Rotterdam, allowing “tracking of ships' movements,
infrastructure, weather data, water depth, and geographic
data with 100% accuracy” [20]. The port of Rotterdam
will be able to predict the best time based on water level,
to have a ship arrive and depart Rotterdam, ensuring that
the maximum amount of cargo is loaded on board. With
all the benefits provided by IoT to the port of Rotterdam,
some concerns about the potential risk of the connected
system exist.
In 2017 a cyber-attack occurred, with large impact on
port operations, especially at the container terminal. “A
few weeks of “repairing and improvement” were
1573
 necessary to get the ATM (Asynchronous Transfer Mode)
systems in the function-unemployed cranes and trucks
couldn’t do anything, and ships could not be unloaded and
loaded” [21]. According to Yaqoob et al. [12], “key
management is one of the crucial issues in cybersecurity
and is more complex in the IoT, wherein many devices are
resource constrained”. The main problem of IoT is the
data vulnerability within the cloud and the measures like
the encryption algorithms and strong key management
procedures are necessary. “Protection of the web facing
cloud instances must be ensured with IDS/IPS, host-based
firewalls” [12].
The partnership FERM has had a big role in stopping
or recognizing new attacks in order to minimize its impact
at port of Rotterdam. FERM is a part of the Port Cyber
Resilience Program. The aim of the program is to enhance
collaboration between companies in the port of Rotterdam
and raise awareness among companies about cyber risks
in order to become the best digitally protected port in the
world [22]. FERM still helps the port of Rotterdam with
security actions by monitoring the threats. as the big risk
exists in the smart digitalization processes.
According to Paul Smits, chief financial officer of the
Port of Rotterdam Authority, the entire digital ship
industry will encourage hackers to find new, more
complex attack methods, specially designed in this area.
The Harbor Master of Rotterdam established the Port
Cyber Notification Desk on 11 June 2018 [23].
“Companies in the Port of Rotterdam area are asked to
report large-scale IT disruptions within their company and
a reporting obligation applies to companies that fall under
the Port Security Act Regulation (EC) no. 725/2004 and
companies that are required to comply with ISPS” [23].
Port of San Diego uses IoT-shore-power system that
allows cargo ships to plug in at port rather than having to
run their diesel engines at the dock [24]. This port is the
example of the port where a “Ransomware” attack has
occurred, and the cyber-security has been disrupted. The
port first received reports of the disruption on Tuesday,
September 25, 2018 [25]. In order to overcome the
consequences of the attack and return to the functionality
and security of the system, the partners from all levels had
to be involved: local, regional, state and federal. The
Harbor Police Department has alternative systems and
procedures in place to minimize impact to public safety
[25]. In the previous example, the importance of new
alternative ways of the work is emphasized if the incidents
occur, in order to prevent completely stopping the
business processes (in the most cases, limited
functionality is available). Therefore, it is important to pay
attention to all the possible situations that might occur and
data from IoT networks must be continuously backed up
using the back-end servers. Yakoob et al. [12] have
proposed a novel framework that helps to detect sinkholes
and selective-forwarding attacks in IoT in order to
minimize such attacks. The framework is comprised of
two modules:
• Anomaly-based module: the anomaly-based agent
works in a distributed manner because it is based
on a MapReduce framework. The proposed
solution employs a voting method to analyze the
1574
suspicious behavior. Results of the proposed
solution show that it outperforms the existing
solutions. In the future, incorporation of the data
mining techniques and intelligence-based methods
may improve the performance of the proposed
framework.
• Specification-based intrusion detection module:
helps to analyze behavior of the host nodes and
send their data to the root nodes, whereas an
anomaly-based agent employs the unsupervised
optimum-path forest algorithm for projecting
clustering models.
Port of Antwerp has also recognized the importance of
IoT security by creating a platform for digital data
exchange called Nxtport. SIA partners stated that “the
platform was launched by Flemish sector organization
Alfaport VOKA, whose goal is to create a financially self-
sustaining data-commercialization company that will
collect, centralize, store, analyze and exchange data from
a wide range of logistics actors in the port (carriers, freight
agents, etc.), and generate profits by inspecting the
information pertaining to each stakeholder” [16]. The
project is currently running with four applications
designed to test and prove the importance of Nxtport.
According to Opstaele, “all these applications are tested or
need to be experimented in Antwerp port and are aimed at
improving efficiency and security” [26]. Like every port,
Antwerp is the site of illegal smuggling and accidents, and
security is a key priority [26]. Therefore, although the
possibility of unauthorized device management and theft
of information exists, intensive work on safety
improvement will ultimately enable the ports to
experience additional growth.
V. CONCLUSION
In parallel with the increasing number of connected
devices, there is a proportional rise of the number of
attacks which target IoT devices. The problem of
connecting the device to the cloud comes from a two-way
connection: the device can send data to the cloud, but it
can also retrieve it from the cloud. If the basic connection
is compromised, major security issues will arise.
Therefore, a need for wider regulation arises, which
should involve all levels of government: from local to
transnational.
When governments and companies cannot agree upon
a definition of "what is an authorized data access", then a
problem arises. Initial steps in understanding of the
seriousness of the problem were taken by California,
USA, which has undertaken concrete measures in the fight
against security threats, representing the first example of
introducing the law on IoT regulation. Therefore, if other
countries follow the example of USA, it could present a
significant boost in IoT security, driving forward the
digitalization of business processes. In addition,
technological innovations will be boosted, and new
opportunities will be created, resulting in increased
productivity, competitiveness and sustainability of
seaports.
The security needs to be controlled from the very start,
in the stage of making a "device connection", but it is also
MIPRO 2019/DE-DS
 essential to include the “monitoring” phase coming after [7]
the implementation because of new and emerging forms
of threats. If one device is compromised, it can lead to
security threats imposed on the entire system. Threats and [8]
consequences of IoT security attacks can be classified into
four categories. The first are application-based
consequences when the issue represents, for example, the [9]
inability to find a culprit for the information theft by a
security camera which are needed in seaports, because the
cameras are not sufficiently developed to prevent a theft
[10]
within the network; the next are the connection-based
consequences which refer to the connecting things by IP
network. If its security is not closely monitored, the entire
IoT network can be compromised; furthermore, platform- [11]
based issues are related to wireless sensor network that
has a pending issue which comprises the applications of
communication platforms, security and management. The
last category are other forms of attack linked with the [12]
combining application and platform-based threats that
give an intertwined force of challenges that leave the
whole security ground weakened. [13]
The security assessments of complex supply chains are
more challenging, therefore holistic approach and
coordination among different sides and system [14]
components are needed. Control and interactive
management of IoT systems are performed in the “cloud”
rather than locally. In order to minimize the damage and
stop spreading ransomware within the IoT network, [15]
cybersecurity teams have to be ready to react at any time.
A current and secure software that will monitor the
security of the IoT network should be installed and the
prevention of file recovery costs is possible by storing [16]
data in the secure data storage.
The benefits of IoT in seaports are evident in advanced
“digital” seaports, such as the ports of Rotterdam and
Antwerp. They are the proof of the profitability of IoT [17]
applications and the successful monitoring of digitalized
business processes.
REFERENCES [18]
[1] Duvallet, C., Sadeg, B. and Belfkih, A. (2017) ‘the Internet of
Things for Smart Ports Application To the Port of Le Havre’,
(May). Available at:
https://www.researchgate.net/publication/316668793_THE_INTE
RNET_OF_THINGS_FOR_SMART_PORTS_APPLICATION_T [19]
O_THE_PORT_OF_LE_HAVRE (Accessed: 14 January 2019)
[2] The maritime IoT landscape in the next decade (2018). Available
at: https://www.marinemec.com/news/view,the-maritime-iot- [20]
landscape-in-the-next-decade_53814.htm (Accessed: 14 January
2019)
[3] To Get Smart, Ports Go Digital (2018). Available at:
https://www.bcg.com/publications/2018/to-get-smart-ports-go- [21]
digital.aspx (Accessed: 14 January 2019).
[4] Internet of Things and the Container Port - Port Technology
International (2015). Available at:
https://www.porttechnology.org/news/internet_of_things_and_the [22]
_container_port (Accessed: 14 January 2019).
[5] Heilig, L., Lalla-Ruiz, E. and Voß, S. (2017) ‘Digital [23]
transformation in maritime ports: analysis and a game theoretic
framework’, Networking. NETNOMICS: Economic Research and [24]
Electronic Networking, 18(2–3), pp. 227–254. doi:
10.1007/s11066-017-9122-x.
[6] Madakam, S. and Date, H. (2016) ‘Connectivity Frameworks for
Smart Devices’. doi: 10.1007/978-3-319-33124-9.
MIPRO 2019/DE-DS
IoT: number of connected devices worldwide 2012-2025 | Statista
(2016). Available at:
https://www.statista.com/statistics/471264/iot-number-of-
connected-devices-worldwide/ (Accessed: 18 January 2019)
IoT Security for Policymakers | Internet Society. Available at:
https://www.internetsociety.org/resources/2018/iot-security-for-
policymakers/ (Accessed: 14 January 2019).
Ali, I., Sabir, S. and Ullah, Z. (2016) ‘Internet of Things security,
device authentication and access control: A review’, International
Journal of Computer Science and Information Security, 14(8), pp.
1–11. doi: 10.1501/Vetfak_0000002648
Shipping expects to spend more on IoT than on other next
generation tech - SAFETY4SEA (2018). Available at:
https://safety4sea.com/shipping-expects-to-spend-more-on-iot-
than-any-other-next-generation-tech/ (Accessed: 14 January 2019)
IT: The Biggest Threats to Digital Security for Business
According to the Experts | Kiandra IT (2018). Available at:
https://kiandra.com.au/blog/it-the-biggest-threats-to-digital-
security-for-bus/ (Accessed: 14 January 2019)
Yaqoob, I. et al. (2017) ‘The rise of ransomware and emerging
security challenges in the Internet of Things’, Computer
Networks, 129(September), pp. 444–458. doi:
10.1016/j.comnet.2017.09.003
Internet Security Threats to Watch For in 2018 (2018). Available
at: https://www.cmswire.com/information-management/internet-
security-threats-to-watch-for-in-2018/ (Accessed: 14 January
2019)
Key Developments in Internet of Things Law | The WSGR Data
Advisor (2018). Available at:
https://www.wsgrdataadvisor.com/2018/10/key-developments-in-
internet-of-things-law/ (Accessed: 14 January 2019)
As IoT attacks increase 600% in one year, businesses need to up
their security - TechRepublic (2018). Available at:
https://www.techrepublic.com/article/as-iot-attacks-increase-600-
in-one-year-businesses-need-to-up-their-security/ (Accessed: 14
January 2019)
THE INTERNET OF THINGS IN TRANSPORTATION PORT
OF HAMBURG CASE STUDY INSIGHT (2016). Available at:
http://transport.sia-
partners.com/sites/default/files/5._insight_internet_of_things_in_tr
ansportation.pdf (Accessed: 14 January 2019).
Gamundani, A. M. (2015) ‘An impact review on internet of things
attacks’, Proceedings of 2015 International Conference on
Emerging Trends in Networks and Computer Communications,
ETNCC 2015, (May), pp. 114–118. doi:
10.1109/ETNCC.2015.7184819
Port of Rotterdam teams with IBM Internet of Things to digitize
operations. Available at:
https://www.portofrotterdam.com/en/news-and-press-
releases/port-of-rotterdam-teams-with-ibm-internet-of-things-to-
digitize-operations
How can 5G and IoT can enhance port operations? (2018).
Available at: https://enterpriseiotinsights.com/20180202/5g/5g-iot-
port-operations-tag17-tag99 (Accessed: 14 January 2019)
Turning Rotterdam into the "World’s Smartest Port"
with IBM Cloud & IoT - THINK Blog (2018). Available at:
https://www.ibm.com/blogs/think/2018/01/smart-port-rotterdam/
(Accessed: 14 January 2019)
Rotterdam port arms itself against a new cyber attack -
Klevenberg Shipping Center. Available at:
https://www.klevenberg.com/rotterdam-port-arms-itself-against-a-
new-cyber-attack/ (Accessed: 14 January 2019)
FERM, Rotterdam Port Cyber Resilience (2019). Available at:
https://ferm-rotterdam.nl/nl/waarom-ferm-staan.
Port Security. Available at:
https://www.portofrotterdam.com/en/shipping/port-security
How 3,000 streetlights turned San Diego into America’s smartest
city | Digital Trends (2018). Available at:
https://www.digitaltrends.com/cool-tech/how-3000-streetlights-
turned-san-diego-into-americas-smartest-city/ (Accessed: 14
January 2019)
1575
 [25] Port of San Diego hit by a cyber attack a few days after the attack
on the Port of Barcelona - IoT Security News (2018). Available at:
http://iotsecuritynews.com/port-of-san-diego-hit-by-a-cyber-
attack-a-few-days-after-the-attack-on-the-port-of-barcelona/
(Accessed: 14 January 2019)
[26] Antwerp’s historic port looks to future with smart ships, IoT and
‘i-noses’. Available at:
https://sk.ru/news/b/articles/archive/2018/07/17/antwerp_1920_s-
historic-port-looks-to-future-with-smart-ships-iot-and-
_1820_inoses_1920_.aspx (Accessed: 18 January 2019)

1576 MIPRO 2019/DE-DS