Cydome, ClassNK, Bureau Veritas, MTS-ISAC and Rakuten Maritime have announced a collaboration called the Blue Initiative to provide the first public database of cyber vulnerabilities focused only on IT and OT devices that are relevant to the maritime industry, available for free at blue-initiative.org.
This new initiative is designed to help shipping companies more effectively address the cyber vulnerabilities affecting the specific systems and equipment they operate by highlighting maritime-related equipment, ability to focus on specific vendors, and proactively alerting users when relevant new vulnerabilities are announced.
“Identifying which vulnerabilities actually matter to the systems maritime companies operate is a major challenge”, said Cydome CEO Nir Ayalon, “and our vision with the Blue Initiative is to have a public and open single source of truth for maritime-related vulnerabilities. This will provide IT and cyber teams, vendors and research facilities a much more focused view of risks relevant to their specific vessels, making vulnerabilities and risk management much more effective and faster than before. “
The Blue Initiative is an open industry collaboration, freely accessible at blue-initiative.org. Relevant organisations in the maritime community are encouraged to join and help expand the database.
“Effective vulnerability management starts with knowing which issues matter to the systems you operate,” said Naoki Saito, General Manager, Ship Management Systems Department at ClassNK. “By focusing on maritime IT and OT equipment and bringing the community together to validate the data, the Blue Initiative gives shipping companies a practical, trusted resource.”
“Cyber resilience requirements for ships are not simply a checklist for audits, but a continuous process throughout a vessel’s operational life,” said Panagiotis Anastasiou, Cyber Technical & Market Leader, Bureau Veritas Marine & Offshore. “Owners are expected to maintain the security of onboard systems as new vulnerabilities emerge, making effective vulnerability management a critical element of maritime cyber resilience. In practice, this can be challenging, as relevant information is often scattered across general-purpose databases and vendor advisories. Bureau Veritas sees real value in a shared, maritime-specific reference that owners, equipment manufacturers and class societies can all rely on. We are pleased to join the Blue Initiative as a contributing partner.”
Entries in the new Maritime Vulnerabilities Repository (MVR) are reviewed by cyber researchers from Cydome and the contributing partners, who validate and refine them before going live. Select entries also receive more elaborate analyst notes, and users will be able to:
- Browse vulnerabilities and their details
- Filter vulnerability searches to the equipment or vendors relevant to them.
- Access expert insights on vulnerabilities and their impact (select vulnerabilities, with more insights constantly added every day).
- Subscribe for updates and alerts on new vulnerabilities.
“In most cases, vulnerabilities are only published once a patch is available, in line with standard responsible disclosure processes,” said Ayalon. “But the Blue Initiative links this intelligence to the specific vendors and systems that maritime users operate, allowing them to move quickly to patch and mitigate.