Maritime and logistics cybersecurity: when the OT floats

A container terminal or a vessel is an industrial control environment that happens to move, staffed by a rotating international crew, connected over expensive and intermittent links. Every assumption behind conventional enterprise security is strained somewhere in that description.

What makes it distinctive

• Operational technology at sea. Navigation, propulsion, ballast, cargo and safety systems are industrial control systems with long lifecycles, vendor-certified configurations and safety implications when interfered with.
• Connectivity is a constraint, not a given. Satellite bandwidth is limited and costly, so cloud-delivered agents, large updates and always-on monitoring cannot be assumed. Security tooling has to work offline and reconcile later.
• Crew rotation. Personnel change frequently, across nationalities and languages, which makes account management and training genuinely hard rather than merely tedious.
• Third-party access at every port. Technicians board to service equipment, often connecting laptops directly to systems — a removable-media and direct-access risk that is routine here and exceptional elsewhere.
• Enormous commercial leverage. A disabled terminal or diverted vessel halts trade, which is precisely why the sector is targeted.
• Position and cargo data is commercially sensitive and, in some contexts, a safety concern.

The regulatory picture

The International Maritime Organization requires cyber risk to be addressed within the safety management system, which means cyber risk sits under an established safety regime rather than a separate IT one. Classification societies publish their own cyber requirements for vessels and newbuilds. Port facilities fall under port security regimes and, in many jurisdictions, critical infrastructure legislation with its own reporting duties.

The practical consequence of cyber sitting inside the safety management system is cultural, not technical: it is assessed by people who think in terms of safety and continuity, and controls that compromise either will be rejected however sound they look on paper.

Control priorities

• Segment vessel networks — navigation and propulsion separated from crew welfare, business systems and guest connectivity. Crew internet access sharing a network with navigation is still found.
• Control removable media and technician access with a documented process at every port visit — scanning stations, approved media, supervised connection.
• Offline-capable protection on shipboard systems, with signature and policy updates that tolerate long gaps.
• Account management that survives crew rotation — no shared bridge accounts, and provisioning tied to a real joiner and leaver process.
• Backups that can be restored without shore connectivity, held onboard.
• Manual fallback procedures for navigation and cargo operations, exercised — the maritime equivalent of a continuity workaround, and the control that actually preserves safety.
• Shore-side systems — terminal operating systems, freight forwarding platforms and EDI links — secured to normal enterprise standards, since these are where most reported incidents have actually begun.

Where programmes struggle

Patching vessel OT within vendor certification constraints; providing security oversight across a fleet with thin telemetry; training a rotating multilingual crew; and getting security requirements into charter and service contracts where commercial terms dominate. None has a clean answer — the workable posture is strong segmentation, tight third-party access control, and compensating detection where prevention is impractical, all documented as accepted risk.

Key takeaways

• Cyber sits inside the safety management system — controls must respect safety and continuity.
• Connectivity constraints mean security tooling must work offline.
• Port-visit technician access and removable media are the routine physical risk.
• Most reported incidents begin shore-side, not on the bridge.