Researchers from the University of Plymouth are working with the Bank of England to test how some of the world’s leading insurance firms would respond in the event of a maritime cyber attack.
The University’s Maritime Cyber Threats Research Group was asked to help develop a scenario through which companies can test their response and resilience in the face of a cyber incident.
The resulting work has now been featured in the General Insurance Stress Test 2022, published by the Bank of England’s Prudential Regulation Authority (PRA).
It presents a scenario through which an individual or organisation gains access to the bridge system of commercial seagoing vessels, causing physical damage to ships and ports and disrupting the maritime supply chain accounting for 90 per cent of world trade in goods.
Companies are then asked to detail how they would respond in the event of such an incident, and how it could impact their clients across a range of industries.
This will allow the Bank of England to mitigate the collective, systemic impacts of such actions, and support firms in understanding the potential market implications of their decisions.
The 2022 exercise represents the first time a maritime cyber incident has featured in the General Insurance Stress Test, and Plymouth is the only university credited in helping to pull it together.
The scenario was conceived in line with the University’s work as part of the EUR 7 million Cyber-MAR project, which aims to develop greater awareness of the cyber threats facing the global shipping fleet and the most effective ways of countering them.
Dr Kimberly Tam, lecturer in cyber security, said: “This collaboration is evidence of how far-reaching the impacts a maritime cyber attack could be. People are rightly worried about the physical damage to ports and vessels that could result from such an incident. However, the economic impacts on supply chains – as we witnessed when the Ever Given became stuck in the Suez Canal last year – or the costs incurred by shipping firms and insurers could have much deeper and protracted implications. We will be very interested to see how insurance companies respond to the Stress Test, and to gauge whether they are ready to respond in the event of such an incident in the near future.”