Darktrace Blog

Perspectives on cyber defense

Troubled waters: Cyber-attacks on San Diego and Barcelona’s ports

Andrew Tsonchev, Director of Technology, Darktrace Industrial | Thursday October 4, 2018

Last summer’s wave of ransomware attacks compromised port terminals and disrupted global shipping. Since then, cyber security has quickly risen to the top of the agenda for the maritime sector. Earlier this year, another port was hit with ransomware, and then, last week, the ports of Barcelona and San Diego revealed that they had been the victims of further ransomware attacks.

Whilst the 2017 attacks were globally devastating, there was no evidence that they deliberately targeted particular sectors; port terminals were merely caught in the indiscriminate wave of attacks. However, the widespread disruption these attacks caused across industry – from shipping to manufacturing – drew attention to the risk of IT cyber-attacks propagating into the industrial sector’s critical control systems. Operational Technology within industrial environments had previously been kept relatively separate from IT systems, and, consequently, relatively immune from cyber-attack. These attacks showed that the recent trend in integrating and unifying IT and OT systems had now exposed these systems to such indiscriminate attacks. 

The increasing convergence of IT and OT systems shows no signs of slowing, however. Hyper-connected ‘smart’ ports are bringing efficiency and precision while cutting costs. Yet, the intertwining of the physical and digital across ports remains a significant challenge for the cyber security teams tasked with their defense. Without rushing to conclusions, it is perhaps no surprise that the Port of Barcelona is in the process of a “Digital Port project,” launched last year to promote the digitization of the port environment. 

Although specifics have not yet been revealed, the recent attacks in Barcelona and San Diego appear to be targeted. Perhaps the inadvertent success of last year’s ransomware campaign inspired attackers to pursue the maritime sector specifically. Disruptions to Operational Technology can be highly detrimental to the maritime sector – these systems oversee critical port and ship systems. Any compromise could inflict reputational harm, significant financial losses, and physical damage. That we would see ransomware attacks specifically targeting ports was foreseeable. Many in the industry have been expecting and preparing for such an eventuality over the last 12 months. Now that attackers are actively targeting them, the protection of OT systems has become critical.

Darktrace has deployed AI to a number of companies in the maritime sector to specifically mitigate and defend Operational Technology. These systems are highly customized and bespoke, and therefore unsuitable for the use of off-the-shelf IT solutions. Darktrace’s cyber AI is able to automatically tailor to OT environments and learn a unique sense of ‘self’, regardless of vendor or technology platform.

Our AI is actively defending ports across the world – such as Harwich Haven Authority and Belfast Harbour – and protecting them against both targeted and indiscriminate attacks on their OT and IT systems. Defending these environments requires the ability to protect all technology systems, from the oldest PLCs and SCADA systems, to the newest IoT devices. Whether in the cloud, on a vessel, or on the mainland, Darktrace is able to passively defend your systems and identify cyber-threats in real time, without any impact or disruption.

Blog Archive

Thursday October 4, 2018
Monday August 20, 2018
Monday July 16, 2018
Friday June 22, 2018
Wednesday May 9, 2018
Monday April 16, 2018
Wednesday March 7, 2018
Tuesday February 13, 2018
Friday February 2, 2018
Monday January 22, 2018
Friday December 8, 2017
Monday November 27, 2017
Monday October 30, 2017
Wednesday October 25, 2017
Thursday October 12, 2017
Monday October 2, 2017
Monday September 18, 2017
Monday July 31, 2017
Thursday June 29, 2017
Wednesday June 21, 2017
Wednesday May 17, 2017
Monday May 8, 2017
Wednesday April 5, 2017
Monday March 6, 2017
Monday February 13, 2017
Monday January 30, 2017
Monday January 9, 2017
Friday December 16, 2016
Monday December 5, 2016
Friday November 18, 2016
Friday November 4, 2016
Monday October 24, 2016

About the authors

Justin Fier

Justin Fier is the Director for Cyber Intelligence & Analytics at Darktrace, based in Washington D.C. Justin is one of the US’s leading cyber intelligence experts, and his insights have been widely reported in leading media outlets, including Wall Street Journal, CNN, the Washington Post, and VICELAND. With over 10 years of experience in cyber defense, Justin has supported various elements in the US intelligence community, holding mission-critical security roles with Lockheed Martin, Northrop Grumman Mission Systems and Abraxas. Justin is also a highly-skilled technical specialist, and works with Darktrace’s strategic global customers on threat analysis, defensive cyber operations, protecting IoT, and machine learning.

Dave Palmer

Dave Palmer is the Director of Technology at Darktrace, overseeing the mathematics and engineering teams and project strategies. With over ten years of experience at the forefront of government intelligence operations, Palmer has worked across UK intelligence agencies GCHQ & MI5, where he delivered mission-critical infrastructure services, including the replacement and security of entire global networks, the development of operational internet capabilities and the management of critical disaster recovery incidents. He holds a first-class degree in Computer Science and Software Engineering from the University of Birmingham.

Andrew Tsonchev

Andrew oversees Darktrace’s OT security offerings, providing cyber defense solutions for industrial environments. Andrew has worked extensively across all aspects of Darktrace's technical and commercial operations, and advises Darktrace’s strategic Fortune 500 customers on advanced threat detection, machine learning and autonomous response. Andrew has a technical background in threat analysis and research, and holds a first-class degree in physics from Oxford University and a first-class degree in philosophy from King’s College London.

Max Heinemeyer

Max is a cyber security expert with over eight years’ experience in the field specializing in network monitoring and offensive security. At Darktrace, Max works with strategic customers to help them investigate and respond to threats as well as overseeing the cyber security analyst team in the Cambridge UK headquarters. Prior to his current role, Max led the Threat and Vulnerability Management department for Hewlett-Packard in Central Europe. He was a member of the German Chaos Computer Club, working as a white hat hacker in penetration testing and red teaming engagements. Max holds a MSc from the University of Duisburg-Essen and a BSc from the Cooperative State University Stuttgart in International Business Information Systems.

EnglishFrançais日本語