Running Head: IT 659 aaa aaa aaa aaa aa aaa aaa aaa aaa aaa aa aaa aaa aaa aa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aa a aaa aaa aa aaa aaa aaa aaa aaa
aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aa aaa aaa aaa aaa aaa aaa a aaa aaa aaa a aaa aaa aaa aaa aaa aaa aa aaa aa aaa aaa aaa aaa aaa aaa a aaa aaa
aaa aaa aaa aaa aaa a aaa aaa aaa aaa 1
IT-659-Q1436 Cyberlaw and Ethics
IT 659 aaa aaa aaa aaa aaa aaa aaa aaa aa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aa aaa a aaa aaa aaa aaa aaa aaa aa aaa aaa aaa a aaa aaa aa aaa aaa aaa aaa
aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aa aaa aaa aaa aaa aaa aaa a aaa aaa aaa a aaa aaa aaa aaa aaa aaa aa aaa aa aaa aaa aaa aaa aaa aaa a aaa aaa
aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aaa aaa aaa aaa 2
IT business model of Maersk:
Digital transformation is considered as the most notable aspect for every
business in the recent years and in the year 2017, the shipping industry
experienced many drastic transformations. First of all, the world witnessed the
first autonomous ships traversing the sea and furthermore, the industry was also
plagued by the threats of digitalization such as hacks, malware attacks and
cyber attacks. The primary highlight in the case of new IT business model
introduced by Maersk is the consideration for transforming the customer
experience and operational processes implemented in the organization.
The new model clearly cascades each of the functional aspects in the
business model and the ways in which the functions work and network with
each other alongside addressing the expansion of the organization’s margin. The
IT business model of Maersk could be identified as prominently focused on
transport and logistics department. A clear evaluation of the way in which the
business model has been changed with reference to digital transformation could
provide clear insights into the definition and evaluation of the IT business
model of Maersk.
The present maritime industry in which Maersk operates is considerably
associated with digital transformation strategy which is focused on operational
processes and safety oriented activities. Another noticeable factor that can be
identified in the case of IT business model of Maersk is its emphasis on
human resources as crucial components of the transformation process (Cyber
Security: A Legal Requirement, 2018). The following assessment would provide
a risk analysis report with references to the specific cyber security laws, state
statutes, criminal and civil laws and ethical guidelines in context of Maersk and
IT 659 aaa aaa aaa aaa aaa aaa aaa aaa aa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aa aaa a aaa aaa aaa aaa aaa aaa aa aaa aaa aaa a aaa aaa aa aaa aaa aaa aaa
aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aa aaa aaa aaa aaa aaa aaa a aaa aaa aaa a aaa aaa aaa aaa aaa aaa aa aaa aa aaa aaa aaa aaa aaa aaa a aaa aaa
aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aaa aaa aaa aaa 3
the existing regulations followed by the organization (Nkuna, 2017, p 25). The
assessment would also include cyber-law crimes and the existing information
system security approaches that have been implemented by Maersk as well as
the existing cyber laws that safeguard the data of an organization from external
intrusion (Nkuna, 2017,p aaa 26).
Existing regulations and precedents:
The cybercrime laws which have been outlined in the US and can be
considered as valid in the case of Maersk could be explicitly identified in two
categories which include substantive cybercrime laws and procedural cybercrime
laws. In the case of Maersk, the procedural cybercrime laws can be taken into
focus as they are profoundly associated with preventing unauthorized access to
electronic data by third parties that also include internet service providers,
authority for searching electronic evidence and authority for interception of
electronic communication.
The procedural cybercrime laws are identified in 18 USC §§ 2510-2522,
2701-2712 and 3121-3127 (Rees, 2018). The substantive cybercrime laws could
also be considered as relevant regulations that could be applicable to the case
of the NoPetya attack on Maersk that crumpled its operations across many
terminals. The substantive cybercrime laws are profoundly associated with laws
pertaining to prohibition of online identity theft, hacking and intrusion into
intellectual property and computer systems of an individual or organization.
The specific substantive cybercrime laws that can be mentioned in context
of Maersk include 18 USC § 1028 which focuses on prevention of any fraud
or similar activity implemented in relation to authentication features, information
and identification documents. The similar implications could be found in 18
IT 659 aaa aaa aaa aaa aaa aaa aaa aaa aa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aa aaa a aaa aaa aaa aaa aaa aaa aa aaa aaa aaa a aaa aaa aa aaa aaa aaa aaa
aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aa aaa aaa aaa aaa aaa aaa a aaa aaa aaa a aaa aaa aaa aaa aaa aaa aa aaa aa aaa aaa aaa aaa aaa aaa a aaa aaa
aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aaa aaa aaa aaa 4
USC § 1029, 1030 and 1037 which deal with fraud and other related activity
with respect to access devices, electronic mail or computers (Rees, 2018). The
substantive law of 47 USC 605 could also be accounted in this case as it
deals with unauthorized publication and use of communication. aaa
Current cyber laws, regulations and policies in Maersk:
The policy statement issued by Maersk in 2018 depicts the organization’s
formidable commitment to ensure security and implementation of necessary
policies for preventing security breaches. The security considerations are
emphasized on equal terms with operational and commercial factors in business
management. The particular example of Maersk’s recovery from the attack with
its contingency plans could be assumed as a validation for the same (Seacurus
Bulletin, 2018, p 5).
The evaluation of the information systems security framework of Maersk
also suggests that the lack of frequent security updates was a notable cause for
leading to the detrimental impacts of the hacking attack. The attack was realized
with an employee clicking on an attachment with a virus which could have
been prevented by resolving the SMB vulnerability through the application of
Microsoft security updates and patches (Seacurus Bulletin, 2018,p 4). This
setback in the company’s information system security approach could have been
resolved by observing and implementing the patch which was issued after the
‘Wannacry’ ransomware attack on the National Health Service in UK.
Cyber law crimes:
The most common approach to follow in the identification and
investigation of cybercrimes within an organization is the conventional one in
which the business impact of the crime is evaluated first and check for severity
IT 659 aaa aaa aaa aaa aaa aaa aaa aaa aa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aa aaa a aaa aaa aaa aaa aaa aaa aa aaa aaa aaa a aaa aaa aa aaa aaa aaa aaa
aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aa aaa aaa aaa aaa aaa aaa a aaa aaa aaa a aaa aaa aaa aaa aaa aaa aa aaa aa aaa aaa aaa aaa aaa aaa a aaa aaa
aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aaa aaa aaa aaa 5
of the incident such as compromise of confidential information. The security
personnel should be able to identify the systems or servers which have been
affected alongside recognizing the possibilities of data loss upon abruptly shutting
down system or a computer. The use of forensic imaging is the next course of
action to investigate cybercrime in which the recording of affected system and
related components could be observed (Fcw.com, 2018). The investigation of
different information sources such as external devices, log files and virtual
machines as well as cryptographic security of evidence are also significant
security investigation measures.
The formidable impact of cybercrimes like the NoPetya attack on Maersk
is observed in the form of downtime that is far worse than any other loss to
the organization. The information system structure of an organization could be
substantially compromised with notable concerns being vested in duplication and
redundancy of information as well as loss of vital information regarding the
organization’s business operations.
The appropriate information security measures that should be followed to
deal with cybercrime are to emphasize prominently on translation of information
security policies into action. The specific human resources in responsibility of
information security should frequently update with the changing laws and
regulations in the domain of cybercrimes.
Cybercrime and ecommerce:
According to claims made by Maersk, it has been able to recover from
the attack within ten days by the reinstallation of almost 4000 servers, 2500
applications and 45000 PCs. This clearly reflects on the installation of a new
infrastructure to deal with the consequences of the NoPetya attack. In order to
IT 659 aaa aaa aaa aaa aaa aaa aaa aaa aa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aa aaa a aaa aaa aaa aaa aaa aaa aa aaa aaa aaa a aaa aaa aa aaa aaa aaa aaa
aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aa aaa aaa aaa aaa aaa aaa a aaa aaa aaa a aaa aaa aaa aaa aaa aaa aa aaa aa aaa aaa aaa aaa aaa aaa a aaa aaa
aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aaa aaa aaa aaa 6
improve its cyber resilience the organization also implemented many long term
and immediate initiatives with the aim for strengthening the IT infrastructure
platforms as well improve the IT service continuity and reinforcement of
business continuity plans (Safety4sea, 2018). The company has also opted for
cyber insurance in order to refrain from negative fiscal impacts of any future
cyber-attacks.
As discussed in the earlier sections, the substantive and procedural
cybercrime laws are at the disposal of Maersk to deal with unauthorized
intrusion into its information systems by hackers (Cimpanu, 2018). Furthermore,
the USCG has issued a cybersecurity strategy which outlines the best practices
and voluntary measures which can be employed by organizations like Maersk in
the shipping industry. The introduction of HR 3101 Strengthening Cybersecurity
Information Sharing and Coordination in Our Ports Act 2017 could also be
considered as a promising respite for Maersk in terms of regulations.
References
Cyber Security: A Legal Requirement. (2018). Retrieved from
https://knect365.com/shipping/article/8a7a100b-542c-45c2-8b0f-b22bb579fca8/cyber-
security-a-legal-requirement
Cimpanu, C. (2018). Maersk Reinstalled 45,000 PCs and 4,000 Servers to
Recover From NotPetya Attack. Retrieved from
https://www.bleepingcomputer.com/news/security/maersk-reinstalled-45-000-pcs-and-
4-000-servers-to-recover-from-notpetya-attack/
Fcw.com (2018). Managing a cyber crime scene -- FCW. Retrieved from
https://fcw.com/articles/2014/12/18/managing-a-cyber-crime-scene.aspx
IT 659 aaa aaa aaa aaa aaa aaa aaa aaa aa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aaa aa aaa a aaa aaa aaa aaa aaa aaa aa aaa aaa aaa a aaa aaa aa aaa aaa aaa aaa
aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aa aaa aaa aaa aaa aaa aaa a aaa aaa aaa a aaa aaa aaa aaa aaa aaa aa aaa aa aaa aaa aaa aaa aaa aaa a aaa aaa
aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aaa a aaa aaa aaa aaa aaa aaa aaa aaa aaa 7
Nkuna, N. (2017). Understanding the motives for digital transformation in the
container shipping sector.
Rees, A. (2018). CYBERCRIME LAWS OF THE UNITED STATES. Retrieved
from https://www.oas.org/juridico/spanish/us_cyb_laws.pdf
Seacurus Bulletin. (2018). Retrieved from
http://www.seacurus.com/newsletter/Seacurus_Issue_73.pdf
Safety4sea. (2018). Maersk Line: Surviving from a cyber-attack. Retrieved from
https://safety4sea.com/cm-maersk-line-surviving-from-a-cyber-attack/
