Several organizations have teamed up to create Blue Initiative, a public vulnerability database that indexes IT and OT vulnerabilities impacting the maritime industry.
Blue Initiative is the work of cybersecurity company Cydome, Japan’s ClassNK classification society, testing and certification giant Bureau Veritas, the Maritime Transportation System Information Sharing and Analysis Center (MTS-ISAC), and Rakuten Symphony’s maritime cybersecurity and digital solutions unit, Rakuten Maritime.
The new project aims to help maritime organizations identify and prioritize vulnerabilities that could threaten their systems.
“Identifying which vulnerabilities actually matter to the systems maritime companies operate is a major challenge,” said Cydome CEO Nir Ayalon, “and our vision with the Blue Initiative is to have a public and open single source of truth for maritime-related vulnerabilities.
“This will provide IT and cyber teams, vendors and research facilities a much more focused view of risks relevant to their specific vessels, making vulnerabilities and risk management much more effective and faster than before,” Ayalon added.
The Blue Initiative website is freely accessible and contributions from the community are welcome. Vulnerabilities listed in the index are reviewed by Cydome researchers and contributing partners.
Users can browse vulnerabilities, search for specific flaws, and filter results. Users can also receive updates and alerts for new security holes added to the index.
At the time of writing, the database contains nearly 30,000 entries, including more than 2,000 rated critical based on their CVSS score. More than 580 vulnerabilities are known to be exploited in attacks.
Of the total, 37 vulnerabilities, including many discovered this year, affect products specifically designed for ships and ports.
Most entries are pulled automatically from CISA’s ICS advisories and KEV catalog and mapped to maritime systems, while a smaller number include hand-written analyst notes.
Related: Cyberattacks on Two Oil Tankers Prompt Coast Guard, FBI to Board Vessels
Related: Coast Guard Establishes Office of Maritime Cybersecurity Policy
