Submarine cables
SAFE CORE
Reference context
Submarine cables constitute a critical component of the global internet infrastructure, carrying more than 97% of the world's internet traffic and 99% of intercontinental communications across a network of more than 1,3 million kilometers. Protecting these cables from physical and cyber attacks is of strategic importance for the European Union.
Technological innovations in communications, robotics, automation and submarine cable technology are revolutionizing global telecommunications infrastructures. However, these innovations expose submarine cable networks to greater cyber risks. The use of advanced digital instruments and remote control systems makes it necessary to implement adequate cybersecurity measures to protect strategic and sensitive sectors such as global communications and data transmission.
To mitigate potential business consequences resulting from cyber incidents, specific guidelines have been developed. These security measures are critical to ensuring that operators in the underwater communications industry can resist cyber attacks, maintaining the security and efficiency of global communications networks.
In the coming years, operators' trust in these infrastructures will strongly depend on their ability to manage and prevent cyber threats, thus ensuring the continuity and stability of intercontinental communications.
Main issues
Although cybersecurity is a consolidated topic in sectors such as banking and finance, its management in the world of underwater communications encounters greater difficulties. This is due to the coexistence of two technologies – information technology (IT) and operation technology (OT) – which, using devices and networks with very similar requirements, increasingly converge towards the same technical solutions.
The need to use devices with similar characteristics has led the submarine telecommunications industry to integrate information technologies available on the market, remotely manageable, and often based on the Internet of Things (IoT) model. This integration poses a greater risk of unauthorized access or malicious attacks on undersea cable systems and networks, exposing infrastructure to new vulnerabilities and threats. Risks can occur both in on-board infrastructure and externally. Satellite communications systems and 4G and 5G networks allow access to submarine cable networks, exposing them to potential vulnerabilities.
Even systems that appear isolated, without direct connectivity, can be exposed to vulnerabilities typical of the cyber environment, such as introducing malware via removable media or data storage devices used to upload or download data from critical systems. Completely stand-alone systems are less vulnerable to external attacks than those connected to uncontrolled networks or directly to the Internet.
The vulnerabilities of the sector
Critical systems for undersea cables include potentially vulnerable devices that can provide a large amount of data of great interest to cyber attackers. Modern technologies, therefore, can introduce multiple vulnerabilities into underwater networks. Specifically, critical systems include:
- Data traffic management systems: These digital systems handle the routing and transmission of data across submarine cables. They are vulnerable to cyber attacks that can compromise communication between different global infrastructures.
- Monitoring and diagnostic systems: Used to evaluate the performance and integrity of cables, these systems are critical for maintenance and early problem detection. Their vulnerability may increase if data is monitored remotely or integrated with land-based network systems.
- Remote control systems: Used for cable maintenance and repair, they can be a target if not adequately protected against unauthorized access.
- Network interfaces: Connected to terrestrial and satellite infrastructure, these interfaces are essential for the integration of underwater networks with global networks, making them vulnerable to attacks that exploit external connections.
- Surveillance platforms: These systems monitor underwater activity and can be exposed to threats if data is collected and transmitted without adequate security.
- Administrative management systems: Computer networks used to manage cable operations and communicate between land and sea teams are particularly vulnerable when they offer Internet access and email services.
The vulnerability of such systems is often caused by the use of obsolete operating systems, the absence of antivirus software, and the inefficient management of control and access systems. It is clear, therefore, that adopting security measures to protect systems and information is also crucial for submarine cable networks.
Cyber security in submarine cables: Guidelines
International guidelines for the safety of submarine cables are mainly developed by the International Cable Protection Committee (ICPC) and the United Nations Convention on the Law of the Sea (UNCLOS). These directives cover various crucial aspects for the protection and maintenance of submarine cables.
- Protection and Resilience: ICPC works with governments, industry and the scientific community to mitigate the risks of natural and human damage to cables, develop recommendations and best practices throughout the lifecycle of cable designs, and promote scientific research into the interaction between cables and the marine environment (ISCPC) (ISCPC).
- Legislation and Standards: UNCLOS guarantees the freedom to lay submarine cables in areas outside territorial waters, but allows coastal states to adopt laws to protect cables in their territorial waters. States have the right to establish conditions for cables crossing their continental shelf and to take reasonable measures for the exploration and exploitation of natural resources (NOAA) (Digital Commons).
- Incident Prevention and Response: ICPC has developed practices to reduce the consequences of accidental or intentional damage to cables, such as guidelines for the rapid issuance of repair permits and the safety of vessels engaged in repairs. It also encourages collaboration between cable operators and governments to identify and mitigate the causes of damage (ISCPC).
- Innovation and Collaboration: Continuous technological evolution requires constant updates of the guidelines. ICPC regularly organizes meetings and workshops with representatives from industry, academics and governments to discuss challenges and emerging solutions related to the protection of submarine cables (ISCPC) (Brill)
These guidelines are critical to ensuring the security and resilience of underwater communications networks, which are vital to the daily functioning of global society and the economic and national security of states.
Cyber security in the submarine cable sector: Future challenges
The future of this industry will be driven by advances in monitoring and control technologies, underwater communications security and cyber protection solutions. Innovations in the fields of big data analytics, advanced telecommunications, artificial intelligence and machine learning, along with the use of sustainable energy, will be essential. These technologies will help reduce costs, optimize processes, improve the safety of cable networks and promote environmental sustainability.
However, the integration of these advanced technologies also introduces new risks, making the continuous updating of risk assessments is crucial. Among the emerging risks, cyber risk has represented an unexpected challenge, which requires an adequate response from all the actors involved, including regulatory and certification bodies.
Undersea cable networks, crucial for global communications, they must be incorporated into a robust cyber risk management program. This program must cover all key elements of cybersecurity: technologies, processes, and human factors. Technology providers must implement adequate protections in their products and networks, and provide ongoing training for operators.
In this context, maintaining a cyclical and constant cyber security plan is not only a necessity to protect submarine cable infrastructures, ma it also represents an opportunity for growth and innovation, enabling the sector to successfully meet future challenges.
