Maritime sector: security and integration of Internet-of-Things (IoT) devices in company security services

With the growing diffusion of IoT devices and systems also in industry (Industrial Internet of Things - IIoT), there is the need to analyze and understand the resulting cyber risks and how to minimize them. To do this, it is necessary to learn more about these devices and their use, so that possible solutions can then be explored. In this thesis, the main focus was on how to monitor these devices using a Security Operation Centre (SOC). For this reason, the basic functioning of a SOC and its components was explained. It was also briefly mentioned how the increasing use of artificial intelligence and machine learning could affect it. The sector considered, maritime transport, is particularly complicated as it is made up of different entities that often do not interact smoothly. There are terminals, where containers change their transport mode, there are ships, containers themselves and ground transportation vehicles. Data sharing between all these entities is never trivial. The aim of this thesis is to explore the field, investigate what risks modern industries face when using technologies such as IoT, and apply this analysis to the targeted sector. To do so, the structure of a terminal was examined and studied at physical, process and network level, trying to understand as much as possible about the systems in use. I have carried out a general analysis of the operational technologies used in various industries. Technologies which today tend to be more and more directly or indirectly connected to the outside world. Such systems are similar to IoT, but unlike the latter have been used for decades in industry. I have analyzed and highlighted the risks of their increasing connection. Cases of real attacks and the respective countermeasures that are needed to minimize the risk were provided. Analyzing the terminal, I discovered that there are already some automated systems in place (such as the entrance gate for vehicles). However, conventional fully manual technologies are still in use. The assessment of the terminal risk level was based on two case studies. The first was generic and focused on attacks on terminal systems. Potential attacks against port technologies, potential monitoring methods and countermeasures were reported and analyzed. The second took into consideration a specific system, that is, the smartcard-based recognition and access control system. A system similar to the one used in the terminal for the recognition of drivers and workers based on RFID cards was therefore tested. This system is used in the corporate office in Turin. The analysis required a theoretical study of how such systems work and also how card and reader communicate. Next, the specific type and model of card was addressed in detail, identifying its weaknesses and outlining some possible threats. The emulation of a card via smartphone was successfully carried out. Although, to date, the involvement of IoT devices has only just begun, this will grow in the coming years, with the aim of more automation of processes. Many challenges remain. At current stage advantages of integration of monitoring of IoT devices with IT security operation center shows important benefits: Re-using of knowledge and use cases of standard IT in addition to capability of creating dedicated use cases with IoT and IT logs are higher than having a dedicated and segregated environment. Manufacturers of such devices should, therefore, take this need into account to develop logs capabilities.