Cybersecurity at Sea: Protecting the Global Supply Chain

Dan Johnson: You're listening to the Cyberwire Network powered by N2K. Welcome to Afternoon cybertea, where we explore the intersection of innovation and cybersecurity. I'm your host, Dan Johnson. From the front lines of digital defense to groundbreaking advancements shaping our digital future, we will bring you the latest insights, expert interviews and captivating stories to stay one step ahead. This week on Afternoon Cybertea, I am joined by Fabio Catassi. Fabio is the Chief Information Officer for Mediterranean Shipping Corp. In this role, Mr. Catassi has overall responsibility at the IT organization, including infrastructure development and security for both MSC headquarters in Geneva and the network of all of its agencies. He was formerly the President and CEO of MSC Technology, based in Warren, New Jersey. Welcome to Afternoon cybertea, Fabio.

Fabio Catassi: Thank you, Anne, for the introduction and it's a really pleasure to be here with you today.

Dan Johnson: So Fabio, you've been leading IT and security for a global organization with headquarters in Geneva. You have agencies around the world. You obviously have very critical logistics infrastructure. I would love to explore the leadership through that lens in the context of global shipping, supply chain, chain and of course what it means to run real world infrastructure. So let's get to a few questions. What does leading IT and security and maritime logistics differ from leading in a purely digital company?

Fabio Catassi: Well, in shipping technology failure isn't an extract. It stops ships, uh, block ports, uh, disrupt economies. So we are not just protecting data, we are protecting logistics, physical operation, crews, cargo, safety. So that means for example, uh, it ot satellites, vessel, uh, or all convergence. So security decision have real world consequences, uh, uh, not just digital ones. So that's fundamentally change, uh, how you lead. So MSC approach, uh, reflect this philosophy which uh, security must be embedded in the operational processes. Ah, it cannot be treated just as a separate IT concern.

Dan Johnson: Yeah, I would think that. In addition, I remember the um, and I don't remember the geographic name of the canal right now, but I remember the ship that was stuck for the period of time.

Fabio Catassi: Yes, that was in the Suez Canal. It was from one of our competitors, but of course it lost the power and that's brought to a blockage that had an immense, uh, impact, uh, on economies, uh, both the local ones of Egypt. Uh, the canal was not operational and of course, uh, with all the rerouting that we had anybody in the industry, for example, to do around Africa.

Dan Johnson: Yeah, and I think that's what I want our listeners to understand is that if global shipping were to have a security or an IT event, it doesn't just impact you as a company, it impacts your peer Companies. It also can impact global supply chains and of course the global economy and of course be a tremendous cost to you as you're trying to reroute ships in a different location and fuel and time and just wear and tear, right?

Fabio Catassi: Yeah, absolutely. And you know 90% of the goods that move worldwide, uh, they are moved through the oceans. So it's really. There is no aspect of our life as a modern civilization that is not tacked in a way or the other by ocean transportation. So if that gets disrupted, of course, uh, this means then there is a real life impact uh, on economies and of course uh, ultimately m the people.

Dan Johnson: Exactly. And because of that, and I don't think that folks, I think that number is going to really hit folks when they realize that over 90% or roughly 90% of global shipping is done on the water. That means that you're working across multiple jurisdictions, multiple governments, multiple regulatory environments. How do you manage all of that

Fabio Catassi: is a huge challenge. First of all, because shipping is global by nature, but regulations, uh, are deeply local. Uh, we have offices in 154 countries, uh, so we operate under a myriad of overlapping, uh, frameworks, uh, imo, gdpr, port authorities, national laws, uh, you name it, uh, and uh, often this is all simultaneous. So the challenge here uh, is to, when you look from the security perspective, for example, is to create in global consistency in security governance, uh, but while remaining compliant and practical at uh, the local level. Because effectively you cannot design anything for just one regulator. And it's what we do, we design for cost and variation also because very often there are uh, changes. Uh, certain jurisdictions uh, are better to plan things. Uh, other countries, uh, they make announcement at the last moment, et cetera. And you need to be able to react and be ready so that the flow of goods uh, continues, uh, interrupted.

Dan Johnson: That makes perfect sense. And like a lot of global organizations trying to find that baseline governance standard that then you can just not have to modify continually, but you have that high level baseline that will apply across a lot of regulatory environments is something that we certainly find useful. So your industry is obviously very physical. It's also digital. Where do you think that the biggest blind spots are emerging for an organization that really has to be dependent on both the physical and digital footprint?

Fabio Catassi: The biggest blind spot is the assumption that uh, operational systems are isolated because they are not. So especially now modern vessels, terminals are all connected environment, but they are built often on legacy technology that was frankly not designed for cyber threats. When you add then uh, third party, the human factor that of course in the security area is ah, probably still the biggest unknown and uncertainty. This of course creates issues and again people are not really, they think that vessels are air gap or whatever. But today with satellite or whatever else, this is not a reality anymore. LEO satellite for example, has brought uh, high bandwidth, low latency to vessels. Uh, and that is great. It's great for crew welfare, it's great for constant monitoring for environmental, uh, controls so that we can control in real time emissions or whatever else within the ships. Uh, but at the same time now the vessel uh, is wired and connected through the LEO satellite constellations like any other digital assets that we have around the world.

Dan Johnson: That makes perfect sense to me. But thinking about, I was in Singapore last year, um, I spent a little bit of time there and they were touring me through the port there. And you're prob familiar that the report has gone almost completely robotic and digital. They're certainly moving that direction. And they were talking about how shipping has been a very targeted piece of infrastructure for a lot of nefarious actors. Right. And how they think about cyber and resilience, um, because of that, because of the volume that goes through that port and the volume of goods that go through that port. Can you talk also a little about how you're thinking about resilience versus security versus just prevention of having any type of attack or any type of system outage.

Fabio Catassi: So incident like the Napa attack were really an eye opening for the industry in its effects and consequences, uh, et cetera. And then there were other incidents over the year that really showed uh, how this is ah, an area in which you cannot just rely on prevention. That is not enough when you are in a globally connected ecosystem. Resilience is essential, critical. First of all you need to really be geared to have ah, fast detection, containment and recovery. So make no assumptions, you're doing modernization

Dan Johnson: right now at scale. So can you talk a little? You are well known for your leadership. So I want to talk a little bit about leadership and how you get the company on board when you're modernizing systems. There's of course risk in that and you're also defending against modern threats to.

Fabio Catassi: Well, first of all, let's say that because we are standardizing data, uh, and process globally, while our operation runs at 24,7 there is never a holiday, never a night or a period where there is not something that is operating around the world. So from my perspective as a leader of this uh, endeavor, it means that I need always to set uh, clear architecture principles. So that's what the thing that we did when we started this process. And of course while the technology evolved, we keep uh, reevaluating what we, the technology we are using, how the architecture, et cetera. But then everything that is related to security is embedded from day one. Because if you arrive at the end of the process or in the middle of the process to start to think about security, you are already too late. And then you have a massive technical depth you needed to readdress, uh, and you waste time, money and uh, velocity in providing solution to the business. So the biggest one thing that I often uh, do is to be the urgent to sometimes resisting shortcuts when maybe the business is really pressuring for something be done. Super. And I have to see the fact that uh, maybe we solve today problem, uh, but we create tomorrow risks. And uh, because the culture that now we have established inside the organization and we have a great partnership with the business, they understand. And so that is how we keep progressing. But we do it in a way that is sustainable and safe for our organization.

Dan Johnson: That makes a lot of sense. And then you have to think about, and I know you think about this a lot because you're involved deeply in the planning, but the sequence, right. How do you think about sequencing innovation when you're dealing with a global organization that's operating? I like to say we're building the plane as we're flying it. So you have a global organization that's operating. How do you sequence innovation so you minimize any new risk exposures?

Fabio Catassi: First of all, my analogy that I used countless times that we are running a marathon while we're doing staple chase, jumping around. And once in a while we have to do the 100 meter uh, speed dash. So that is how I feel how our operation as it uh, transformation uh, runs. And uh, going to your question, uh, we start with foundations so identity, data governance, visibility. Before you start to scale, if you have this approach, then you can move incrementally based off on the risks that you want to take. So you don't let enthusiasm, especially when the new technology breaks in. Like uh, the little revolution that we are having or big revolution we are having with AI. Of course, uh, there was immediately when we started a lot of enthusiasm and I was one of the people that was uh, enthusiastic about it. But we look at it with the clear eye saying okay, this is what all we want to do. And then this doesn't mean that this innovation is blocked. But uh, we create our own gates of readiness so that when we move to the next phase, uh, we have built the governance and the building blocks so that, that allow uh, us then ultimately to move faster but without having uh, insurance and especially without breaking trust. Because there is nothing worse than uh, implementing something rushed and then you have a problem, security incident, et cetera. And then you expect the possibility to keep investing in that area just because you rushed things through and you didn't do all what necessarily be done to lay solid foundations.

Dan Johnson: I think that makes a lot of sense and it does lead me to ask you a little bit about AI. The modern world at some point in time is going to move towards AI. I think there are some industries that are moving more quickly, some industries are moving more slowly. But we're seeing a lot of global interest in how AI can improve productivity, how it can improve efficacy. Uh, there's different things in cybersecurity, but also in just standard it. But I want to talk about logistics for a moment because you are the world leaders in that. Where do you see AI can actually add real operational value with regard to maritime logistics?

Fabio Catassi: Well there are a few areas like uh, Predator maintenance, anomaly detections, uh, cargo visibility, operational optimization, efficiency reduction of greenhouses, uh, emissions documentation, uh, security operation, et cetera. Where AI has tremendous potential, in some cases is already making a difference. Our approach is that AI is ah, at least where it is today as technology is most powerful. Where AI means humans, we truly believe that still uh, the human factor is essential uh, to the success of uh, our business. Uh, but through AI we have tools that help us see patterns earlier, uh, or act faster. And ultimately even when we stay in a setup in which humans still take the decisions, uh, they are able to do that uh, in a way that is uh, qualitative and timely. Much faster than in the past.

Dan Johnson: I love that. I was reading. You're going to laugh. I was reading a fiction novel over the weekend and one of the things that happens, it was a thriller, a global thriller. And one of the things that happens is they're looking for some missing cargo on a ship and they realized that a different ship had too much weight and somehow that was, you know, they could sense that automatically from some ports. And I'm like, well that's fascinating. It was, you know, they described this high tech technology where they could do the exact weight and knew it had three extra uh, containers on it.

Fabio Catassi: Well, it's fascinating, probably is also a bit fiction because when you look at, to some of today of the largest container ship vessel that we and some of our competitors operate, they are able to carry 24,000 TEUs. So they are like three shipment fields, uh, combined, uh, photo field combined. And uh, so to be able to detect three containers out of that size and wait, uh, it's really next level of AI, let's put it this way.

Dan Johnson: Well that's. Yeah, I knew I was talking to you, so I was like, I wonder if AI could solve that. Right. Anyway, what risks? So you thinking about AI, how it can help you innovate? I'm sure your security team is thinking about AI, but what risks do you think about from AI adoption in your global infrastructure?

Fabio Catassi: First of all, uh, over automation without oversight, the concept of agent controlling agents, et cetera. That is an area that uh, I think that we are a little far from a moment where I would feel more comfortable in having uh, stuck layer of AI agent independently operating. Then of course there is the evergreen problems that they are then potentially compounded by AI or poor data quality or regulatory misalignments, uh, et cetera. Ultimately, as we were saying earlier, in infrastructure, mistakes aren't just theoretical. So they can affect also safety, continuity, et cetera. So that's why I stress all the time that the governance, human verification, uh, transparency matter to us much more than just the speed of execution.

Dan Johnson: I think that makes perfect sense. I mean you have to maintain all of your, I'm using security loosely, not necessarily cybersecurity, but you have to maintain all of your security, your resilience, your systems and slowly figure out where AI is going to add the most value with creating the least risk. Let's pivot just a second away from cyber for a moment. You have some globally distributed organizations. You have headquarters in Geneva. You have ah, facilities, large facilities in Warren, New Jersey. In this globally distributed organization, how much consistency do you drive or how much local autonomy do you allow?

Fabio Catassi: Well you have to have uh, global guardrails, gold gun rays and global governance so that uh, you have a consistent baseline of operation. But then this means that then you can have the local uh, teams with their own responsibilities and time, connectivity, innovation that they want to bring up, uh, whatever initiative they want, uh, in a way that we feel it's safer and even outside of the global IT organization in which uh, we are quite structured also and consistent across the various technology sites, uh, that we have also in India, in Italy, et cetera. But this is also very much true for our agency, uh, network we have created, for example in our ah, cloud infrastructure, the security baseline, the way in which uh, systems deployment, monitoring, patching, uh, et cetera is globally managed and governed, more importantly. But then they have the freedom to innovate and to add elements to their IT needs system, et cetera, in freedom from uh, a central headquarter. And that is a perfect situation because we have a very sustainable model, uh, where uh, we don't uh, create fragmentation that as you know much better than me is the worst enemy that you can have from a side where perspective. But at the same time we are not steaming local initiative and innovation.

Dan Johnson: I like that approach because it's all about balance and there are local nuances as you know. But you also can drive, we drive local innovation that sometimes becomes global innovation because the compelling solution was so great that they built in some remote part of the world that you'd never expect. Right?

Fabio Catassi: Yeah. And uh, for example, if I may give you an example, we created in the I area AI Champion community and we created by, in every region we named AI Champion that comes from the business. They are not necessarily people, uh, with an IT background. Some of them do, some other are of course technically savvy. But they are, let's say more from really uh, the shipping business of the house in their specific areas. Uh, of course they disseminate and they make the evangelization of the organization on the various AI tools we have what they can do or not do. But then also they created their own uh, initiatives and uh, we've started to build the regional agentic AI farms in which the various region create their own uh, agents. Then we created the repository where they can describe what the agents does, uh, the business objective, et cetera. And then the other regions uh, can start to take advantage. Uh, and that is how we, we scale up for example in that area. So it's a model that we have used also another area of our IT transformation in the past. It works uh, very, very well.

Dan Johnson: That's fantastic and I'm glad you're so open to it. Uh, it's great to hear from a leader who isn't rigid that they must control or drive all innovation. So you and I have a couple things in common. One, I'm originally from the great state of New Jersey and um, my mother's family was very Italian. Um, but um, that I also completed a dual major in political science and communication and started law school and chose to go into technology instead. I see that you completed a degree in uh, classical languages and philosophy, attempted law school and then also ended up in technology, so.

Fabio Catassi: Exactly.

Dan Johnson: But I think that background of not having. I don't have a technology degree. I think that background has really helped me think about problems a little bit. Differently. I'd love to understand how your philosophy training has influenced how you approach technology.

Fabio Catassi: First of all, it's beside it. I love the subject, but when it comes to where I end up as a career, I think that philosophy train you to in systems ethics, long uh, term consequences, uh, make you able to extract problems in a uh, very different way. When you look to a solution you are able to correlate many independent concepts much easier. So and also technology means is never neutral. So it shapes uh, behavior, shape, responsibilities. Uh, so I think that the classical background, uh, philosophy background, etcetera has been very helpful to me in my career. Ah, when I am faced with the problems, et cetera, to look not only to the practical uh solution but also to look the impact uh, and the consequence uh, of uh, the choices that we were making through technology.

Dan Johnson: I think that's great. Do you think that studying philosophy also changes how you think about AI, responsible AI in particular?

Fabio Catassi: Well, yes, very much. Uh, so because uh, this has been one of the biggest debates also at the beginning of uh, this AI revolution with generative AI, et cetera. Normally AI really raises questions of responsibility, agency, trust. Uh, so because I truly believe that humans, they must remain accountable then you have to look to AI in that context. So you cannot really, you need to be very, very careful in this area never to break trust because if you do then you would have a permanent stain ah on the technology. And you see some of the things that are happening uh, in the market, et cetera, uh, they are giving a bad name sometime to AI. But the problem there is not AI is uh, maybe a non, uh really responsible uh approach to how to implement and present this technology makes perfect sense.

Dan Johnson: I really appreciate you joining me. And as we conclude afternoon cybertea, we always like to end on a note of optimism. So when you think about global critical infrastructure over the next decade, shipping, ports, logistics, what gives you optimism?

Fabio Catassi: Definitely that uh, is an industry. We have learned hard lessons, we have adapted. Collaboration across all actors in the industry is improving. We are working uh, with our competitors, with the authority, with the customers, uh, et cetera on the standardizations, governance, uh overall is maturing, uh, and technology, especially AI, uh can uh, uh make uh, shipping uh safer and uh, more resilient. So I think that the combination of all these things when is put then in the hands of the people really becomes an amazing opportunity to keep improving and make our planet uh, better.

Dan Johnson: That's fantastic. Fabio, thank you so much for joining me on afternoon CyberTea.

Fabio Catassi: Thank you Anne. It's really been truly a pleasure to have, uh, this opportunity. Thank you again for having me and

Dan Johnson: many cyber thanks to our listeners. Join us next time on afternoon cybertea.

Speaker C: This week on the Microsoft Threat Intelligence Podcast, I'm joined by Aurora Johnson from Spy Cloud and Amitai Cohen from Wiz for a special sluicecon episode. We're going to talk about the hot cybercrime summer and the threat trends both of them are watching most closely heading into the second half of this year. Be sure to listen in and follow us@msthreatintelpodcast.com or wherever you get your favorite podcasts.