Maritime and port cybersecurity.

On July 31, 2025, the CISA (Cybersecurity and Infrastructure Security Agency) and the U.S. Coast Guard (US Coast Guard, USCG) published a joint advisory (available here:
https://www.cisa.gov/sites/default/files/2025-07/joint-advisory-cisa-identifies-areas-for-cyber-hygiene-improvement-after-conducting-proactive-threat-hunt.pdf).

The document follows a proactive threat-hunting operation conducted on the network of a U.S. critical infrastructure organization. Such initiatives are aligned with the Cybersecurity Performance Goals (CPGs) jointly driven by NIST and CISA, as well as with the longstanding - and more recent - work of the USCG on maritime cybersecurity.

As part of your healthy summer reading, have you also gone through the CCDCOE paper, “Addressing State-Linked Cyber Threats to Critical Maritime Port Infrastructure”?

No?

Then let me offer a brief personal reflection on and around the topic of port cybersecurity.

In this fine month of July 2025, the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) published a Policy Brief entitled “Addressing State-Linked Cyber Threats to Critical Maritime Port Infrastructure”.

This article is also available in French.

Only a few hours after the collision between two vessels off the coast of Oman, the first claims attributing the accident to GNSS spoofing (GPS spoofing) began to circulate.

It is likely that we will soon see many screenshots and analyses claiming that GPS spoofing is responsible… or that it is not.

As is often the case with this type of event, it is better to wait for the results of the investigation before drawing conclusions.

536 incidents recorded in 2023, against 149 the year before. The total is multiplied by 3.6 in twelve months, and a single group accounts for most of the gap. In October, meanwhile, a bulk carrier dragged its anchor for two hundred kilometres along the floor of the Gulf of Finland.

149 incidents recorded in 2022, against 124 the year before. The rise, 20%, is the smallest of the past three years. The nature of what I record does change: until 2021 my dataset held almost nothing but extortion crime, and 2022 brings politics into it.

124 incidents recorded in 2021, against 78 the year before. Ransomware still supplies the largest share of the volume, but two things change: Asia, up from 8 records to 39, closes in on Europe in my records, and part of the attacks no longer seek to be noticed at all.