Maritime and port cybersecurity.

This article is also available in French.

The - relative - misunderstanding between traditional cybersecurity vendors and users of maritime information systems generally stems from a lack of familiarity with the maritime environment and from the difficulty of adapting or integrating conventional systems with the constraints of this sector. In this article, I describe some of the characteristics of the maritime environment that explain why a specific approach is necessary when deploying off-the-shelf systems and software in this domain.

In this article, I explain in more detail what a maritime information system is, attempting to classify them as clearly as possible.

Maritime information systems can refer to different types of infrastructure:

• ships:
  • merchant vessels
  • warships
  • recreational vessels
  • fishing vessels
  • scientific / hydro-oceanographic / fisheries research vessels
  • barges
• ports and naval infrastructures:
  • container loading/unloading systems, smartports, logistics systems
  • Port and Cargo Community Systems
  • cranes and gantries
  • dock and basin management systems
  • locks
  • pipelines
• other onshore facilities:
  • maritime informatics of signal stations, MRCC (Maritime Rescue Coordination Centers), ship command and management centers
• offshore installations:
  • drilling platforms
  • Marine Renewable Energies (MRE): wind turbines, tidal turbines…

Next, to make things easier to understand, I tend to divide systems into two major families: “IT” systems (Information Technology), which are fairly similar to what can be found in other sectors, and “OT” systems (Operational Technology), which, to simplify, could be described as “operational systems”, more specific to the maritime information domain.

This article is also available in French.

Worth reading today: a study published by Jones Walker LLP on maritime cybersecurity in the United States.

The survey, conducted among 126 U.S. executives, indicates that 38% of them confirmed having experienced either successful intrusions (10%) or attempted intrusions (28%). The remainder may simply not have detected them, you might say - which is not an unreasonable assumption.

While 69% of respondents expressed confidence in the overall preparedness of the maritime sector, only 36% believe that their own company is adequately prepared. The most concerning results come from small and medium-sized enterprises in the sector, 94% of which consider themselves poorly prepared.

Presentation delivered during the Derbycon 2018 conference.

A selection of reference websites and documents on maritime and port cybersecurity. This is a long-term effort, so the list is certainly still incomplete. A French version of this page is also available, with the addition of the French national framework.

• IMO: the International Maritime Organization page on maritime cyber risk
• IMO: Resolution MSC.428(98) on maritime cyber risk management in safety management systems
• IMO: MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management, 28 May 2026
• IMO: SOLAS chapter XI-2 and the ISPS Code, the ship and port facility security framework that the cyber requirements sit alongside
• The Guidelines on Cyber Security Onboard Ships (v5), produced by BIMCO, CLIA, ICS, INTERCARGO, INTERTANKO and others, also presented on the BIMCO website
• DCSA: implementation guides and templates for cybersecurity on board ships
• IACS: Recommendation on cyber resilience, Rec 166
• ISO/IEC: ISO/IEC 27001, information security management systems
• NIST: the Cybersecurity Framework, referenced by the IMO guidelines
• ENISA: Good practices for cybersecurity in the maritime sector, port security
• EMSA: MARSEC 9209 publication
• IAPH: Cybersecurity Guidelines for Ports and Port Facilities (v2.0)
• IAPH: Cyber Resilience Guidelines for Emerging Technologies in the Maritime Supply Chain, added as a reference by MSC-FAL.1/Circ.3/Rev.4
• EU: Directive (EU) 2022/2555 (NIS2)
• EU: Directive (EU) 2022/2557 (CER) on the resilience of critical entities, the physical counterpart to NIS2
• EU: Regulation (EU) 2024/2847, the Cyber Resilience Act, setting cybersecurity requirements for products with digital elements, onboard equipment and sensors included
• EU: Regulation (EC) No 725/2004 on enhancing ship and port facility security
• UK Department for Transport: Code of Practice, Cyber Security for Ships
• UK Department for Transport: Good Practice Guide, Cyber Security for Ports and Port Systems
• United States: Cybersecurity in the Marine Transportation System, the US Coast Guard final rule published in the Federal Register
• United States: USCG Office of Commercial Vessel Compliance, Vessel Cyber Risk Management Work Instruction

• NORMA Cyber, the Norwegian Maritime Cyber Resilience Centre
• MTS-ISAC, the Maritime Transportation System Information Sharing and Analysis Center
• IAPH, the International Association of Ports and Harbors

• IACS: Unified Requirements E26 and E27 on the cyber resilience of ships and of onboard systems and equipment
• Bureau Veritas: NR 659, Rules on Cybersecurity for the Classification of Marine Units
• Bureau Veritas: NR 642, Cybersecurity Requirements for Products to be Installed On-Board Naval Ships
• ClassNK: cyber security services and guidelines
• DNV: RP-0496, Cyber security resilience management for ships and mobile offshore units in operation, and the DNV maritime cyber security pages

• Maritime Cyber Threats Research Group (University of Plymouth, United Kingdom): the group works on decision support, supply chain vulnerabilities, the cybersecurity of autonomous ships and the human factor.
• In the summer of 2013, researchers from the University of Texas ran the first GPS spoofing experiments against a luxury yacht at sea.

• IOActive report on the vulnerabilities of satellite terminals
• Pentest Partners on vulnerabilities in container ship load planning software
• Pentest Partners on OSINT and social engineering risks around ship satellite communications
• A US Department of Homeland Security document on the cyber risks of port operations

Most of the awareness videos I collect are gathered in a dedicated YouTube playlist:

This article is also available in French.

Who might want to target maritime information systems?

Intentional threat sources are broadly similar to those encountered in other sectors. Rather than reproducing a long and exhaustive list of possible threat actors, it is worth noting that the French cybersecurity agency ANSSI has already documented them in detail (see p. 15 and following pages in the reference below).

Today, the most realistic threat sources include: