As satellite internet gets faster and ships stay connected to shore in real time, vessels now face the same cyber threats as shore offices — with one difference: at sea, no engineer can board right away when something goes wrong. Here is one overview of maritime cyber security for ships: why vessel cyber security matters now, the main threats, what international rules require, and how ship cyber security works in practice.
Why maritime cyber security matters now
- Always connected: high-speed satellite internet such as STARLINK keeps ships online 24/7, multiplying the paths reachable from outside.
- IT and OT converge: navigation and engine systems (OT) are now linked to office networks and remote-maintenance paths, so an ordinary PC infection can reach operational equipment.
- Hard to recover at sea: engineers and spare parts cannot be brought in mid-voyage, so even a small infection can mean delays and high costs.
- Rules and audits: IMO and IACS requirements, and charterer and insurer audits, now treat cyber risk management as mandatory.
Main cyber threats to ships
- Ransomware: arrives via USB, e-mail attachments or remote-access paths and encrypts files on office PCs and servers; without network segmentation it spreads across the whole ship.
- E-mail account takeover and payment fraud (BEC): attackers hijack the vessel e-mail account, watch correspondence with owners and agents, and change the bank details on invoices.
- Malware via USB: chart and document updates or personal USB sticks — one of the most common infection paths on board.
- Remote-access weaknesses: remote desktop and management ports exposed to the internet, or default passwords, are prime targets for automated attacks.
- GNSS (GPS) and AIS interference: jamming and spoofing of satellite navigation signals have been reported in some sea areas, so crews need a procedure to check navigation anomalies.
- Supply-chain and remote-maintenance paths: unmanaged remote-service accounts of equipment makers or contractors can become a back door.
International rules on maritime cyber security
- IMO Resolution MSC.428(98): cyber risks are to be addressed in the Safety Management System (SMS) no later than the first annual DOC verification after 1 January 2021.
- IMO Guidelines on maritime cyber risk management (MSC-FAL.1/Circ.3): recommend a framework built on five functions — identify, protect, detect, respond and recover.
- IACS UR E26 / E27: apply to ships contracted for construction on or after 1 July 2024 and set cyber-resilience requirements, with evidence, for the ship (E26) and for on-board systems and equipment (E27). See our guide to IACS UR E26 / E27.
- Existing ships are not retroactively covered, but class, charterer and insurer audits follow the same framework, so the preparation is effectively the same.
A five-step response framework
- Identify: build an IT/OT asset inventory and network diagram for each vessel, and map every external path (satellite links, remote access, USB).
- Protect: control every satellite link with a UTM firewall and separate navigation/engine (OT), business (IT) and crew welfare networks with VLANs. Add endpoint security, USB security, account and password management, and security updates.
- Detect: monitor firewall logs and network traffic from shore to spot abnormal connections, repeated login attempts and signs of infection early (Ocean-Spider™ network monitoring).
- Respond: prepare an incident procedure — isolate the infected PC, report to shore, remediate remotely — and keep it on board where the crew can follow it.
- Recover: run regular backups and real restore tests, and be able to recover even unbootable PCs remotely (OCEAN-SUPPORT™ remote management).
People are the biggest variable: crew security rules
- Do not open USB sticks or e-mail attachments of unknown origin.
- Do not use business PCs for personal browsing or streaming; keep crew Wi-Fi separate from the business network.
- Use personal accounts instead of shared ones, and remove accounts when crew sign off.
- Report anomalies such as sudden slowdowns, unknown pop-ups or changed file extensions to shore immediately.
Ocean Connect's maritime cyber security service
Ocean Connect delivers maritime cyber security as one operating system — see our vessel cyber security solutions: fleet-wide UTM firewalls and network segmentation, endpoint and USB security, and remote monitoring and recovery from shore. Findings from scheduled onboard inspections are reported so they can serve as evidence for class and charterer audits. Related: Why a loose firewall policy exposes vessels to security incidents
For a cyber security assessment of your managed vessels, contact us via the online inquiry form or our emergency 24-hour helpdesk (+82-70-7588-0611~0612).