Blue Initiative Launches Public Maritime Vulnerability Database
Summary
The Blue Initiative launched a public database of vulnerabilities affecting maritime systems, with partner review, equipment and vendor filters, and alerts. It tracks 29,505 vulnerabilities, including 37 in maritime-only systems.
Key points
- The Blue Initiative's Maritime Vulnerabilities Repository catalogs vulnerabilities affecting products used on vessels, offshore facilities, ports, and supporting infrastructure.
- The database draws on vulnerability advisories, the CVE database, and CISA's Known Exploited Vulnerabilities catalog.
- Contributing partners review and refine entries; some receive additional analyst notes.
- Users can filter vulnerabilities by relevant equipment or vendors and sign up for updates and alerts.
- The database tracks 29,505 vulnerabilities, mostly in fleet IT; 37 affect systems built specifically for ships and ports.
- The initiative says vulnerabilities are generally published once a patch is available.
Article Details
- Event Type
- Launch of the Blue Initiative, an open industry collaboration and public database for maritime-related software vulnerabilities.
- Impact
- The database is intended to help maritime organizations identify vulnerabilities relevant to their systems, browse and filter entries by equipment or vendor, and receive updates and alerts. At the time of publication, it tracked 29,505 vulnerabilities, including 37 in maritime-only systems. The article also reports that known, unpatched vulnerabilities in onboard systems were involved in suspected cyberattacks investigated aboard two commercial oil tankers.
People
Christy CoffeyMTS-ISAC Vice-President for Operations; described the organization's support for and operational participation in the Blue Initiative.John StrandOwner of Black Hills Information Security; commented on the value of examining vulnerabilities across the maritime ecosystem.Nir AyalonCEO of Cydome; described the Blue Initiative's purpose and said vulnerabilities are in most cases published once a patch is available.
Vendors
Bureau Veritassolutions for smart ships and autonomous vessels, inspection and certification providers ClassNK and Bureau Veritas. The Maritime Transportation Sector Informational Sharing and Analysis Center is also participating.ClassNKselling cyber solutions for smart ships and autonomous vessels, inspection and certification providers ClassNK and Bureau Veritas. The Maritime Transportation Sector Informational Sharing and Analysis Center is alsoCydomea public and open single source of truth for maritime-related vulnerabilities," said Nir Ayalon, CEO of Cydome, a British vendor of cybersecurity products and services for the maritime sector. He said the databaseRakuten MaritimeApart from Cydome, the other founders of the Blue Initiative are Rakuten Maritime, a two year old start-up selling cyber solutions for smart ships and autonomous vessels, inspection and certification providers ClassNK