MAN to roll out cybersecurity initiative for ME engines

The cybersecurity solution will provide a fully hardened engine network to protect engines, machinery, instrumentation and control systems, from cybersecurity threats.

The cybersecurity measures will be fitted to all new ME engines as standard from April 2020, but can also be retrofitted to existing ME engines comparatively easily. The upgrade will help shipowners ensure that their operational technology (OT) meets the cybersecurity requirements that are being introduced by the IMO, SIRE and SOLAS from 1 January 2021.

The Motorship notes that MAN EngineVault will help shipowners meet the incoming cyber security requirements for operational technology (OT), and includes the flexibility to update the network as and when the rules governing remote access to engine management systems (EMS) expand.

The MAN EngineVault system will be compatible with its upcoming remote MAN Security Update service, which will ‘push’ patches (or updates) to participating ship operators. Class society cybersecurity experts have identified patching as an area where requirements are likely to tighten in future, following the offshore sector’s lead.

Michael Petersen – Vice President, Head of PrimeServ Copenhagen – said: “Data is shaping the future of shipping. Engine data in particular is essential to help our customers make smarter decisions and better predictions. We realise that the increase in digitisation and network-based systems also increases vulnerability for cyberattacks that can potentially paralyse entire businesses. Therefore, implementing defensive barriers – also for your vessels’ main engines – should be an essential element in proactive cybersecurity management.”

Petersen added that MAN EngineVault offered operational benefits: “One of MAN PrimeServ’s aims is to contribute to areas where we can provide unique benefits to our customers’ business. Ultimately, MAN EngineVault optimises the availability and efficiency of ship installations.”

Multi-layer protection

The MAN EngineVault solution applies a multi-layer framework to provide digital security at both a network level, at the engine management system level, and at a software level to limit engine networks’ exposure to cybersecurity risks.

The solution introduces segregation between network segments, and also introduces a firewall (mGuard) that ensures the secure flow of data between systems, and encrypts data transmitted and received from outside the network.

One of the specific features of the solution is the hardening of external ports: flash drives will no longer be compatible with the network unless they are MAN certified. Compromised USBs have been identified as one of the leading sources of cybersecurity risk.

Engine management system and ECS

The solution also includes the latest main operating panels (MOP) for the engine management and engine control systems. As the raw data processed by the EMS from the main engine and auxiliaries has become increasingly important for operational management and engine diagnostics systems, protecting the data has become an increasingly important OT security requirement.

Both the EMS and engine control functions will be protected by a whitelisting function that will only permit MAN-approved software to be installed. It will also introduce an automatic recovery function, permitting the OT to be restored to a previously safe state should the need arise.

Operational experience

Following in-house tests and a successful trial aboard the Adriatic Gas, a semi-refrigerated carrier owned by UltraShip, the international marine group, MAN EngineVault is being introduced as standard for new ME engines from April 2020.

Kaj Pilemand, Chief Technical Officer at UltraShip, said: “Being a trusted partner to our customers is key to our operations. Consequently, cybersecurity is high on our agenda to ensure that staff, vessel and cargo are shielded against online and physical cyberattacks, so we can continue to fulfil the responsibilities towards our stakeholders.”

Retrofit solution

Meanwhile, MAN Energy Solutions’ PrimeServ arm is offering an upgrade solution to owners of vessels with existing ME engines. Existing customers will need to meet the same standards of digital security as owners of new vessels after 1 January 2021. Over 6,500 ME engines are currently in service.

EngineVault’s sales head from MAN PrimeServ, Jacob Buur Traerup, was quick to reassure owners with MC engines that they were not exposed to a greater degree of risk. “As the engine management systems for MC engines are not digital, they face a lower order of cybersecurity risk,” Jacob Traerup said. One of the consequences of the day-long upgrade procedure is that older EMS-MOP systems will be updated to the latest version. “As a side benefit of the upgrade, these upgraded engine management systems will become compatible with some of our digital-led services, which offer improved fuel efficiency, as well as PrimeServ Assist,” Jacob Traerup concluded.