The CyberBoat Challenge: Cybersecurity Education for the MTS

 

The information security industry has lamented the lack of available skilled and talented workers for the last three decades. A common estimate today is that there are a million unfilled cybersecurity-related positions in the U.S. alone. The absence of skilled cybersecurity workers has a particular impact on the maritime transportation system (MTS) because "traditional" cyberdefense skills do not directly translate to the maritime information ecosystem, so we are even further behind.

The maritime domain is a highly intertwined system of systems, composed of a complex and interconnected collection of information technology (IT) and operational technology (OT). Maritime's information ecosystem is a mix of data centers, networks, sensors, communication systems, and end-user devices that are subject to the same cyberdefense requirements as the rest of the information universe. That said, the MTS has unique cybersecurity requirements, including the combination of many moving and stationary parts; smart ships, ports, and cargo; cyber-physical systems and operational technology; maritime-specific navigation and situational awareness systems; and human-machine interfaces.

The CyberBoat Challenge started in 2022 and has become an annual educational event, bringing together cybersecurity students learning about maritime systems, industry partners and government. It is a cooperative learning opportunity where students examine the maritime environment and maritime information systems in order to understand the protocols, operations and interfaces - and how they all relate to the real world.

Traditional methods of cybersecurity education, training, and workforce development benefit from new and innovative ideas in order to teach students about the many niche technical specialties that have emerged in last couple of decades and, in particular, to develop the next generation of cyberdefense professionals in the maritime industry. Maritime product vendors, ports, shipping lines, merchant mariners, and others in the maritime domain need to be creative in where we find people for cyber roles, which might include professionals from the engine room or the bridge.

The maritime industry must also engage more fully with academic institutions to channel students in understanding the unique needs within the maritime domain. A handful of colleges and universities in the U.S. and globally are already focusing on maritime in their computer science, computer engineering, cybersecurity, or other related programs. The CyberBoat Challenge provides one way in which faculty and students from these — and other — academic institutions can meet and network. The CyberBoat events specifically seek industry and government involvement to help create a miniature ecosystem which not only helps students understand the context of the material and problems, but also helps them form ties with potential mentors and potential employers regardless if their goals are industry, government, academia, or the security community.

There is an adage that engineers don't understand security. This is somewhat borne out by the fact that the most common software flaws reported today are the same as the most common software flaws reported 25 years ago. All too often, engineers work in solution space and not problem space; i.e., they work on solving known problems but they're not necessarily trained to go out and seek new problems hidden in our increasingly complex technology systems. Indeed, most undergraduate courses teach technical topics by assigning problem sets rather than assigning students to find problems.

By bringing together people with diverse academic and experiential backgrounds, students new to this information environment can exercise the critical thinking necessary to identify problems that we may not yet have recognized before they appeared in tragic ways. Every time an accidental event occurs in an IT or OT system on a ship or at a port, cyber processionals — and adversaries — look to see if there's a cyberattack vector that might deliberately cause the same outcome. Consider the failure of a microswitch in the steering control system on BBC Africa, causing her to collide with Common Faith in Houston in August 2023, or the tripped breaker resulting in a power failure on Dali, causing an allision with — and catastrophic failure of — the Francis Scott Key Bridge in March 2024.

CyberBoat is not a cyber competition. The event is pro-industry, and its raison d'être is to help industry understand and address cybersecurity challenges. It is a resource for participants to draw on in terms of augmenting education; making industry connections; understanding the needs, priorities, and remedies of sister organizations; understanding the perspective and role of governmental agencies; and as a recruitment resource for companies looking for interns and employees. It also helps to build a cohort of students learning a new way to think critically about problem identification and solution.

While this is a new approach within the maritime domain to address a long-existent problem, the CyberBoat Challenge is using a well-known engagement and education model which was pioneered by its "elder siblings" — CyberAuto Challenge since 2012 and CyberTruck Challenge since 2017 — which have served as a training and mentoring asset for industry, academia, government, and students, and has seen many hundreds of past participants enter the transportation cybersecurity field. This training system works and has had positive effects in the community of interest.

The next CyberBoat Challenge is in December and will be held at the University of North Carolina Wilmington. Faculty, students, academic institutions, vendors of maritime products, shipping companies, ports, and other interested parties can find more information at https://cyberboatchallenge.net/.

Dr. Gary C. Kessler is co-author of "Maritime Cybersecurity," 2/e and is a lecturer and advisory board member of the CyberBoat Challenge.

Dr. Jeremy Daily is a professor at Colorado State University and program organizer of the CyberBoat Challenge.

Karl Heimer is the founder and board chair of the CyberAuto, CyberBoat, and CyberTruck Challenges.