Most vessels now have a firewall, but a firewall with a loose policy is effectively an open door. A ship sailing with all traffic allowed looks, from the outside, like dozens of PCs connected directly to the internet. Here is how loose policies turn into real incidents, what they look like on board, and how to fix them.
What a loose policy looks like
- Everything allowed (any-to-any) since installation, 'just to make it work', and never revisited.
- Remote desktop or management ports opened directly to the internet for remote support, protected by a single password.
- Crew Wi-Fi, office PCs and navigation equipment on the same network with no segmentation.
- One of the VSAT / STARLINK / LTE links connected straight to the onboard switch, bypassing the firewall.
- Years of allow rules nobody remembers the reason for, so nobody dares to clean them up.
Incidents that follow
- Ransomware: malware arriving via a crew phone or USB spreads across the unsegmented network to office PCs, servers and navigation-support PCs and encrypts operational documents. At sea no recovery engineer can board, so the damage grows.
- Intrusion: an exposed remote-access port receives thousands of automated password attempts a day; once breached, the attacker has the whole onboard network.
- E-mail account takeover and payment fraud: malware on an onboard PC captures the vessel e-mail account; the attacker watches correspondence with owners and agents and alters bank details on ship supply or repair invoices (BEC).
- Satellite data bill shock: infected PCs recruited into botnets or crypto-mining, or uncontrolled streaming and updates, drive satellite data charges up sharply.
- Impact on navigation and engine systems: if ECDIS, VDR or engine monitoring (OT) are not separated from the office network, an ordinary PC infection can cause malfunctions or communication loss on operational equipment.
- Audit findings and charter consequences: missing segmentation and access control are the first findings in IACS UR E26, charterer and insurer audits, leading to delays and contractual penalties.
How to tighten a loose policy
- Inventory the traffic: vessel e-mail servers, company business systems, equipment-maker remote service, OS and antivirus updates — collect what is genuinely needed first.
- Switch to default deny: allow only required traffic and block the rest. Observe in monitor mode for a period and migrate in stages to limit complaints.
- Segment the network: separate OT (navigation and engine), office PCs, crew welfare and visitors into VLANs with explicit inter-zone rules.
- Control remote access: require VPN with two-factor authentication and never expose remote desktop ports directly.
- Put every link behind the firewall: VSAT, STARLINK and LTE must all pass through it, with the same policy applied after failover.
- Log and review: check allow/deny logs from shore, record the reason for every rule change, and prune unnecessary rules at least every six months.
Ocean Connect's approach
- Fleet-wide UTM firewalls (FortiGate) with a standard policy template per owner applied identically to every vessel, so no 'loose ship' exists — the foundation of our vessel cyber security solutions.
- OT / IT / crew segmentation, consolidated satellite links and VPN + two-factor remote access in the baseline configuration.
- Our Ocean-Spider™ monitoring platform shows firewall status and traffic from shore in real time, and policy reviews are reported after every scheduled visit.
A firewall is completed by its policy, not its installation. Contact us via the inquiry page or our 24-hour helpdesk (+82-70-7588-0611) to check the state of the firewall policies on your managed vessels.