EU aims to reduce supply chains’ vulnerabilities to cyber attacks
EU sees supply chains as likely targets, but critical to security, so is looking to improve reporting and resilience
European transport and logistics companies will be forced to improve their cybersecurity under new EU laws in 2024.
Airports, airlines, traffic control authorities, ports and port equipment operators and shipping lines are designated “sectors of high criticality” under the new directive and every member state will be required to create a computer incident response team to address cybersecurity issues.
Furthermore, the EU is widening the number of companies that must comply with cybersecurity measures, which requires basic cyber security measures to be taken by any companies that now fall in these sectors of high importance.
Aviation was identified as the segment most likely to be attacked in the report Threat Landscape: Transport Sector, with 27 incidents recorded between January 2021 and October 2022. Road attacks were the second highest, followed by rail and then shipping.
In 55% of cases, financial gain was the key motivator, while attacks on trains have been mainly linked to the Russia/Ukraine war, but state-sponsored bodies were more likely to attack shipping. Former Russian military leader Andrey Gurulyov has publicly named Rotterdam as a strategic target.
Often, it is difficult to ascertain the main motivation for an attack. The NotPetya ransomware incident, involving the Port of Rotterdam in 2017, was initially thought to be a financially motivated attack. However, a widespread Russian cyber campaign against companies linked to Ukraine was later blamed.
Knut Orbeck-Nilssen, CEO of maritime company DNV which was subjected to a ransomware attack on its ShipManager software at the beginning of 2023, said it was hugely important for companies to share their experiences of cyberattacks. “If we are not sharing, we are making the dark forces more powerful… we will all be cyber victims,” he said.
Already it is part of EU law to report all cyberattacks.