Running Head: IT 659 aa aa aa aa aa a aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa 1
IT-659-Q1436 Cyberlaw and Ethics
SNHU
IT 659 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 2
IT business model of Maersk:
Digital transformation is considered as the most notable aspect for every
business in the recent years and in the year 2017, the shipping industry experienced
many drastic transformations. First of all, the world witnessed the first autonomous
ships traversing the sea and furthermore, the industry was also plagued by the threats
of digitalization such as hacks, malware attacks and cyber attacks. The primary
highlight in the case of new IT business model introduced by Maersk is the
consideration for transforming the customer experience and operational processes
implemented in the organization.
The new model clearly cascades each of the functional aspects in the business
model and the ways in which the functions work and network with each other
alongside addressing the expansion of the organization’s margin. The IT business
model of Maersk could be identified as prominently focused on transport and logistics
department. A clear evaluation of the way in which the business model has been
changed with reference to digital transformation could provide clear insights into the
definition and evaluation of the IT business model of Maersk.
The present maritime industry in which Maersk operates is considerably
associated with digital transformation strategy which is focused on operational
processes and safety oriented activities. Another noticeable factor that can be
identified in the case of IT business model of Maersk is its emphasis on human
resources as crucial components of the transformation process (Cyber Security: A
Legal Requirement, 2018). The following assessment would provide a risk analysis
report with references to the specific cyber security laws, state statutes, criminal and
civil laws and ethical guidelines in context of Maersk and the existing regulations
followed by the organization (Nkuna, 2017, p 25). The assessment would also include
IT 659 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 3
cyber-law crimes and the existing information system security approaches that have
been implemented by Maersk as well as the existing cyber laws that safeguard the
data of an organization from external intrusion (Nkuna, 2017,p aa 26).
Existing regulations and precedents:
The cybercrime laws which have been outlined in the US and can be
considered as valid in the case of Maersk could be explicitly identified in two
categories which include substantive cybercrime laws and procedural cybercrime laws.
In the case of Maersk, the procedural cybercrime laws can be taken into focus as
they are profoundly associated with preventing unauthorized access to electronic data
by third parties that also include internet service providers, authority for searching
electronic evidence and authority for interception of electronic communication.
The procedural cybercrime laws are identified in 18 USC §§ 2510-2522, 2701-
2712 and 3121-3127 (Rees, 2018). The substantive cybercrime laws could also be
considered as relevant regulations that could be applicable to the case of the NoPetya
attack on Maersk that crumpled its operations across many terminals. The substantive
cybercrime laws are profoundly associated with laws pertaining to prohibition of
online identity theft, hacking and intrusion into intellectual property and computer
systems of an individual or organization.
The specific substantive cybercrime laws that can be mentioned in context of
Maersk include 18 USC § 1028 which focuses on prevention of any fraud or similar
activity implemented in relation to authentication features, information and
identification documents. The similar implications could be found in 18 USC § 1029,
1030 and 1037 which deal with fraud and other related activity with respect to access
devices, electronic mail or computers (Rees, 2018). The substantive law of 47 USC
IT 659 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 4
605 could also be accounted in this case as it deals with unauthorized publication
and use of communication. aa aa
Current cyber laws, regulations and policies in Maersk:
The policy statement issued by Maersk in 2018 depicts the organization’s
formidable commitment to ensure security and implementation of necessary policies
for preventing security breaches. The security considerations are emphasized on equal
terms with operational and commercial factors in business management. The particular
example of Maersk’s recovery from the attack with its contingency plans could be
assumed as a validation for the same (Seacurus Bulletin, 2018, p 5).
The evaluation of the information systems security framework of Maersk also
suggests that the lack of frequent security updates was a notable cause for leading to
the detrimental impacts of the hacking attack. The attack was realized with an
employee clicking on an attachment with a virus which could have been prevented by
resolving the SMB vulnerability through the application of Microsoft security updates
and patches (Seacurus Bulletin, 2018,p 4). This setback in the company’s information
system security approach could have been resolved by observing and implementing
the patch which was issued after the ‘Wannacry’ ransomware attack on the National
Health Service in UK.
Cyber law crimes:
The most common approach to follow in the identification and investigation of
cybercrimes within an organization is the conventional one in which the business
impact of the crime is evaluated first and check for severity of the incident such as
compromise of confidential information. The security personnel should be able to
identify the systems or servers which have been affected alongside recognizing the
possibilities of data loss upon abruptly shutting down system or a computer. The use
IT 659 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 5
of forensic imaging is the next course of action to investigate cybercrime in which
the recording of affected system and related components could be observed (Fcw.com,
2018). The investigation of different information sources such as external devices, log
files and virtual machines as well as cryptographic security of evidence are also
significant security investigation measures.
The formidable impact of cybercrimes like the NoPetya attack on Maersk is
observed in the form of downtime that is far worse than any other loss to the
organization. The information system structure of an organization could be
substantially compromised with notable concerns being vested in duplication and
redundancy of information as well as loss of vital information regarding the
organization’s business operations.
The appropriate information security measures that should be followed to deal
with cybercrime are to emphasize prominently on translation of information security
policies into action. The specific human resources in responsibility of information
security should frequently update with the changing laws and regulations in the
domain of cybercrimes.
Cybercrime and ecommerce:
According to claims made by Maersk, it has been able to recover from the
attack within ten days by the reinstallation of almost 4000 servers, 2500 applications
and 45000 PCs. This clearly reflects on the installation of a new infrastructure to
deal with the consequences of the NoPetya attack. In order to improve its cyber
resilience the organization also implemented many long term and immediate initiatives
with the aim for strengthening the IT infrastructure platforms as well improve the IT
service continuity and reinforcement of business continuity plans (Safety4sea, 2018).
IT 659 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 6
The company has also opted for cyber insurance in order to refrain from negative
fiscal impacts of any future cyber-attacks.
As discussed in the earlier sections, the substantive and procedural cybercrime
laws are at the disposal of Maersk to deal with unauthorized intrusion into its
information systems by hackers (Cimpanu, 2018). Furthermore, the USCG has issued
a cybersecurity strategy which outlines the best practices and voluntary measures
which can be employed by organizations like Maersk in the shipping industry. The
introduction of HR 3101 Strengthening Cybersecurity Information Sharing and
Coordination in Our Ports Act 2017 could also be considered as a promising respite
for Maersk in terms of regulations.
References
Cyber Security: A Legal Requirement. (2018). Retrieved from
https://knect365.com/shipping/article/8a7a100b-542c-45c2-8b0f-b22bb579fca8/cyber-
security-a-legal-requirement
Cimpanu, C. (2018). Maersk Reinstalled 45,000 PCs and 4,000 Servers to Recover
From NotPetya Attack. Retrieved from
https://www.bleepingcomputer.com/news/security/maersk-reinstalled-45-000-pcs-and-
4-000-servers-to-recover-from-notpetya-attack/
Fcw.com (2018). Managing a cyber crime scene -- FCW. Retrieved from
https://fcw.com/articles/2014/12/18/managing-a-cyber-crime-scene.aspx
Nkuna, N. (2017). Understanding the motives for digital transformation in the
container shipping sector.
Rees, A. (2018). CYBERCRIME LAWS OF THE UNITED STATES. Retrieved from
https://www.oas.org/juridico/spanish/us_cyb_laws.pdf
IT 659 aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa
aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa a aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 7
Seacurus Bulletin. (2018). Retrieved from
http://www.seacurus.com/newsletter/Seacurus_Issue_73.pdf
Safety4sea. (2018). Maersk Line: Surviving from a cyber-attack. Retrieved from
https://safety4sea.com/cm-maersk-line-surviving-from-a-cyber-attack/
