Maritime and Port Cybersecurity: Securing OT at Sea and on the Dock

01Key takeaways

1. 01

   Maritime OT spans two distinct worlds: shipboard systems such as ECDIS, bridge and propulsion control, and shoreside systems such as ship-to-shore cranes and terminal operating systems. Each needs its own zone model.

2. 02

   IMO Resolution MSC.428(98) made cyber risk management part of the ISM Code safety management system, so it is now a flag-state and port-state compliance matter, not just an IT concern.

3. 03

   IACS Unified Requirements E26 and E27 push cyber resilience into the design and equipment of newbuild vessels contracted on or after 1 July 2024, including network segmentation and secure remote access.

4. 04

   The highest-value controls are unglamorous: asset inventory, segmentation into zones and conduits, controlled remote access, and reducing inbound reachability from IT and satellite links into OT.

5. 05

   One-way data transfer fits maritime well because much OT data only needs to leave a zone: voyage data, machinery telemetry, crane and terminal logs flowing out for monitoring and reporting, with no return path required.

02What maritime and port cybersecurity actually covers

Maritime cybersecurity protects the digital systems that move ships and cargo. On a vessel, that means the bridge, the engine room and the cargo and ballast systems. In a port, it means the cranes, gates, and the software that schedules and tracks every container. Most of these are operational technology (OT): industrial systems that sense and control physical processes, where a failure can stop a ship or close a terminal.

The defining challenge is convergence. Modern vessels carry satellite broadband, crew Wi-Fi, remote diagnostics from equipment makers and shore-side fleet management. Ports run sprawling IT estates beside the OT that drives cranes and gates. The boundary between business IT and safety-critical OT has thinned, and that boundary is exactly where most maritime incidents begin.

Shipboard OT

Bridge navigation (ECDIS, radar, GNSS), integrated bridge and alarm systems, propulsion and engine control, steering, ballast and cargo handling.

Shoreside OT

Ship-to-shore (STS) cranes, rubber-tyred gantry cranes, automated stacking cranes, gate and reefer monitoring systems.

Coordinating IT/OT

Terminal operating systems (TOS), port community systems and electronic data interchange that schedule berths, moves and customs flows.

03Why maritime OT is a high-value, high-consequence target

Around 80 percent of world trade by volume moves by sea. A disruption at a major container terminal does not stay local; it ripples through supply chains within days. That concentration of consequence makes ports and shipping lines attractive targets and makes downtime expensive enough to fund poor decisions, such as paying ransoms or rushing risky recovery.

The threat picture is broad. Ransomware has repeatedly hit shipping lines and port operators, encrypting the IT systems that terminal operations depend on and halting cargo flow even when the cranes themselves were untouched. State-aligned actors have shown interest in port logistics and in the OT of cranes and cargo systems. GNSS jamming and spoofing are now routine in several regions, feeding false position and timing data into ECDIS and other bridge systems. The MITRE ATT&CK for ICS knowledge base catalogs the techniques used against industrial systems, and maritime incidents map onto a familiar pattern: get a foothold, move toward the OT seam, then disrupt operations or impair the operator's ability to respond.

• Initial access through internet-exposed remote services, satellite terminals, or phishing into the business network.
• Movement across a flat or weakly segmented network from crew and IT systems toward navigation, machinery or crane zones.
• Abuse of legitimate vendor remote-access tunnels left always-on and over-privileged.
• Removable media carrying malware into ECDIS or engineering workstations during updates.
• Impact through loss or denial of control, encrypting the TOS, or manipulating data the bridge or crane relies on.

04Shipboard systems: ECDIS, the bridge and the engine room

The Electronic Chart Display and Information System (ECDIS) is the clearest example of shipboard cyber risk. It is the primary means of navigation on most modern ships, it ingests Electronic Navigational Charts and position data, and it is updated with removable media or network connections. ECDIS units have historically run on long-lived, rarely patched operating systems, which makes both the chart-update path and the underlying host worth protecting.

The bridge is not one device but an integrated bridge system: radar, GNSS receivers, the automatic identification system (AIS), the voyage data recorder, autopilot and alarm monitoring, often sharing a network. Below deck, propulsion, power management and machinery automation run on PLCs and serial or Ethernet industrial networks. Many of these talk to shore for condition monitoring and maker support.

• ECDIS chart and software updates delivered by USB or network, a recurring malware entry path.
• Remote maintenance links from engine, propulsion and automation vendors into machinery networks.
• Crew welfare and business networks bridged, deliberately or accidentally, to navigation or machinery zones.
• Satellite communication terminals exposed to the internet with default or weak credentials.
• Shared bridge networks where a single compromised device can reach navigation displays and sensors.

05Port and terminal systems: cranes, gates and the TOS

On the dock, the headline assets are ship-to-shore (STS) cranes and the yard cranes that move containers. These are large PLC-driven machines with operator cabins, increasingly remote-control or semi-automated, and frequently supplied with embedded cellular or vendor remote-access modems for diagnostics. A crane that stops, or one that an attacker can influence, is both a safety hazard and a throughput failure.

The coordinating brain is the terminal operating system (TOS). It plans vessel stowage, allocates yard slots, directs equipment moves and feeds the gate and customs processes. The TOS is mostly IT, but it is fused to OT: if the TOS is down, cranes have nothing to execute even when they are perfectly healthy. Several of the most damaging port incidents were TOS and IT outages, not crane compromises.

A useful planning rule for ports: treat the TOS as the seam between IT and OT. It must talk to business systems and to equipment, so it is the most likely path for an IT compromise to become an operational one. Segment it deliberately and watch the conduits on both sides.

06Reference architecture: zones, conduits and the IT/OT seam

The most useful mental model comes from ISA/IEC 62443: divide the environment into zones of similar trust and criticality, and allow communication only through defined conduits. On a ship, navigation, machinery, administration and crew welfare belong in separate zones. In a port, the TOS, the crane control networks, the gate systems and corporate IT belong in separate zones.

The hardest seam is where OT must share data with IT, the cloud and remote vendors. Maker condition-monitoring, fleet performance dashboards, terminal analytics and regulatory reporting all want OT data. The instinct is to open a firewall rule and let systems poll the OT side. That instinct creates the inbound reachability that attackers later exploit. The better design asks whether the data flow needs to be a conversation at all, or whether it only needs to go outward.

Navigation/control zone

Highest trust. ECDIS, bridge sensors, propulsion and crane PLCs. No direct internet, no general IT access.

Operations zone

TOS, historians, engineering workstations and monitoring servers that legitimately need OT data.

Enterprise/IT zone

Business systems, email, crew welfare and internet access. Treated as untrusted from the OT perspective.

Conduit

A controlled path between zones, ideally minimal, monitored, and one-way where the flow allows it.

07Practical controls for ships and ports

Most maritime cyber gains come from a short list of fundamentals applied consistently, not from advanced tooling. The goal is to know what you have, separate it sensibly, control how people and vendors reach it, and reduce the paths back into the systems that move the ship or the cargo.

• Build and maintain an asset inventory for shipboard OT and shoreside OT, including embedded modems and remote-access devices.
• Segment networks into 62443-style zones; isolate crew welfare and business IT from navigation, machinery and crane control.
• Control vendor and remote maintenance access through brokered, time-limited, logged sessions rather than always-on tunnels.
• Harden ECDIS and crane HMIs: remove default credentials, disable unused services, and govern USB and removable media with a sanctioning process.
• Forward OT logs, voyage data and machinery telemetry outward for monitoring, ideally over a one-way path that needs no inbound route.
• Plan and exercise manual fallback: paper-chart navigation drills for ECDIS failure, and degraded-mode crane and gate procedures for TOS outages.

Recovery planning is distinctive at sea. A ship cannot call an external incident-response team to the bridge in the middle of an ocean, so crews need workable procedures to operate in a degraded state and to restore systems from trusted, offline backups. Ports need the same discipline for the TOS, including the ability to run gate and yard operations on documented manual processes while the system is rebuilt.

08Standards and compliance: IMO, IACS and IEC

Maritime cyber requirements are now explicit. IMO Resolution MSC.428(98) requires that cyber risks be appropriately addressed in a ship's safety management system under the ISM Code; in practice, since 1 January 2021, this has been verified at the first annual Document of Compliance audit. IMO guidelines MSC-FAL.1/Circ.3 set out the supporting framework for maritime cyber risk management.

Classification societies turned that into design rules through the International Association of Classification Societies (IACS). Unified Requirements UR E26 (cyber resilience of ships) and UR E27 (cyber resilience of onboard systems and equipment) apply to vessels contracted for construction on or after 1 July 2024, covering segmentation, secure remote access, recovery and equipment-level security. IEC 63154 sets baseline cybersecurity requirements for shipborne maritime navigation and radiocommunication equipment such as ECDIS.

IMO MSC.428(98)

Requires cyber risk management in the ship safety management system under the ISM Code; effective for verification since 2021.

IACS UR E26 / E27

Class requirements for cyber resilience of ships and of onboard systems and equipment, for newbuilds contracted on or after 1 July 2024.

IEC 63154

Cybersecurity requirements and test methods for shipborne navigation and radiocommunication equipment, including ECDIS.

ISA/IEC 62443

The cross-sector OT security framework that underpins the zone, conduit and security-level thinking used above.

09Common pitfalls in maritime cyber programs

Maritime environments fail in predictable ways. Knowing them in advance is cheaper than discovering them during an audit or an incident.

• Treating MSC.428(98) as a paperwork exercise, with a policy document but no segmentation, inventory or drills behind it.
• Leaving vendor remote-access modems on cranes and machinery permanently connected and unmonitored.
• Bridging crew Wi-Fi or business networks to navigation or machinery zones for convenience.
• Assuming the cranes are the risk while the TOS and supporting IT remain the real single point of failure.
• Backups that are reachable from the same network as production, so ransomware encrypts them too.
• No manual fallback rehearsed, so a system outage becomes an operational standstill rather than a degraded mode.

A control is only as strong as the operating discipline around it. A firewall with a permanent any-any vendor rule, or a data path with a forgotten return channel, gives the comfort of a boundary without the protection of one.

10Where one-way transfer and exposure reduction fit

A great deal of maritime OT data only needs to travel outward. Machinery condition monitoring, voyage data, fuel and emissions reporting, crane and gate event logs, and security telemetry all flow from the protected zone to a monitoring, analytics or reporting destination. None of those flows requires the destination to send commands back. That is the natural home for one-way data transfer.

A data diode or unidirectional gateway enforces that direction at the boundary: the OT zone can publish telemetry outward, but the receiving network has no path back into navigation, machinery or crane control. Compared with a firewall rule, which remains technically capable of carrying return traffic if it is misconfigured or abused, a one-way boundary removes the inbound route by design. For the OT seam on a vessel or in a terminal, that is often exactly the property you want.

It is one control among several, not a cure-all. Two-way needs, such as legitimate remote maintenance, still require a brokered, monitored access path. Where a flow genuinely is publish-only, an AIRGAPNET one-way connectivity pattern can sit alongside segmentation and firewalls so that telemetry leaves the OT zone without opening a way back in. The decision should always start from the data flow, not the appliance.

11A pragmatic roadmap and closing thought

A workable maritime program tends to follow the same order whether the asset is a ship or a terminal. First, see what you have: inventory shipboard and shoreside OT, including the embedded modems nobody documented. Second, separate it: implement 62443-style zones and remove the casual bridges between IT, crew networks and OT. Third, control access: replace always-on vendor tunnels with brokered, logged sessions and reduce inbound reachability into control zones.

Then make data flow one-way where it can, monitor the conduits that remain, and rehearse degraded-mode operation so a system loss becomes an inconvenience rather than a stoppage. None of this is exotic. It is the same defense-in-depth discipline used across critical infrastructure, applied to an environment where the perimeter floats, the assets are decades old, and the consequence of getting it wrong is measured in stranded ships and idle docks.

FAQFrequently asked questions

SRCSources of record