Ship cyber security is not complete with equipment alone — crews need to know what to do when an incident happens. Since IMO Resolution MSC.428(98) brought cyber risk management into the Safety Management System (SMS), cyber incident procedures deserve the same drills as any other emergency procedure. Here are five practical ship cyber security drill scenarios for vessel crews, and how to run them.
Before the drill
- Incident response procedure: one page stating who (master, officer of the watch, chief engineer) does what (isolate, report, record) and in what order.
- Contact chain: shore contacts, the IT support desk and a reporting form kept on board.
- Scope: start with a tabletop exercise that does not switch off real equipment, and practise only within limits that do not affect operations.
Scenario 1. Ransomware on an office PC
- Situation: file names on an office PC change and a ransom message appears.
- Action: unplug the infected PC from the network at once but keep it powered on to preserve evidence. Check other PCs on the same network, report to shore and follow instructions for remote remediation and recovery.
- Check: can the crew say where the backups are and when a restore was last tested?
Scenario 2. Malware from a USB stick
- Situation: an antivirus alert appears after inserting the USB stick used for chart or document updates.
- Action: remove and quarantine the USB stick and log its use. Do not plug it into another PC, and report the scan result to shore.
- Check: is there a rule that only approved USB devices may be used, and does the crew know it? (USB security)
Scenario 3. Phishing e-mail and bank-detail change request
- Situation: an e-mail impersonating an agent or supplier asks to change bank details or to open an attachment.
- Action: do not open attachments or links; verify the sender through another channel such as a phone call. Do not delete the e-mail — forward it to shore for analysis.
- Check: does the crew recognise suspicious e-mail and know how to report it?
Scenario 4. Loss of satellite link or firewall failure
- Situation: the main satellite link (VSAT or STARLINK) drops and e-mail and business systems stop.
- Action: confirm that traffic fails over to the backup link; if not, switch manually following the procedure or report to shore. Handle essential traffic such as e-mail and position reports first.
- Check: are link priorities and the manual switch-over procedure documented? (firewall and multi-link failover)
Scenario 5. GNSS (GPS) anomaly
- Situation: the GPS position jumps or does not match other navigation equipment.
- Action: cross-check with other navigation equipment and respond according to bridge procedures. Record the time, position and symptoms and report them.
- Check: is there a form and a reporting threshold for navigation equipment anomalies?
Recording and improving
- Record the date, participants, scenario, time taken, what went well and what to fix, and keep it as SMS evidence.
- Fix the gaps the drill reveals (missing contacts, unknown backup location, etc.) on the next onboard visit.
- Related: Maritime cyber security guide for ships, IACS UR E26 & E27 guide
Ocean Connect helps make sure the procedures you drill actually work — vessel-specific incident procedures, remote monitoring (Ocean-Spider™) and remote recovery (OCEAN-SUPPORT™) — see our ship cyber security solutions. To prepare vessel cyber security drills, contact us via the online inquiry form or our emergency 24-hour helpdesk (+82-70-7588-0611~0612).