E26 Zone Defense — Learn IACS UR E26 as a Tower Defense Game

IACS UR E26 · Cyber Resilience · ShipJobs

Play UR E26
— E26 Zone Defense

Zones and Conduits, SL-T, CBS categories, defense in depth. I turned UR E26's security architecture directly into game mechanics — a tower defense you play right in the browser, no install required.

5 min readFree · No installMobile · Desktop

As UR E26/E27 became mandatory, owners, shipyards, vendors, and class surveyors alike now have to reckon with Zones & Conduits. Yet these ideas — how to divide systems into Zones, and which security controls to place on which Conduit to protect essential services — rarely click from documents and diagrams alone. So I took a hands-on approach.

Why a game

At its heart, UR E26 is a single mindset: stop threats layer by layer at the Zones and Conduits before they ever reach essential services — that is, defense in depth. Divide your Zones poorly or misplace a control on a Conduit, and the Core gets breached. These are exactly the same kinds of decisions you make when designing a real ZCD (Zone and Conduit Diagram). In five minutes you feel why a DMZ matters, and why higher-category systems belong deeper inside.

SATCOM / ShoreUntrusted› Business · ITCat I› DMZIT–OT boundary› NavigationCat II› ControlCat III› CoreEssential svcs

The game

You are the cyber security architect of a newbuild. Threats — malware, DoS floods, unauthorized access (APT) — pour in from the SATCOM / shore link (Untrusted) at the top. Place Firewalls · IDS/IPS · Network Segmentation along the Conduit to stop them before they reach the Essential Services Core (propulsion & steering) at the bottom. Defeating threats earns budget, which you reinvest to upgrade your controls. Defend all 10 waves to earn Cyber Resilience Verified.

Mechanics ↔ UR E26 concepts

Conduit pipeline

The communication path between Zones. A color change marks a Zone boundary.

Zone (Cat I/II/III)

System groups by criticality. Closer to the Core = higher category.

Security control (Tower)

Firewall · IDS/IPS · Segmentation — controls used to meet SL-T.

DMZ

The IT–OT boundary. Miss it here and threats reach OT.

Core Integrity

Falls when essential services are breached → 0 means a cyber incident.

Placement strategy

Layered protection across multiple Zones & Conduits = defense in depth.

How to play

1. Tap/click a ⊕ slot beside the pipeline to place a security control.
2. Firewalls deal damage, Segmentation makes slow-down kill zones, and IDS/IPS handles swarms.
3. Defeat threats → earn budget → reinvest in upgrading controls.
4. Reinforce before the later waves where APTs appear. Starting the next wave early grants bonus budget.

▶ Play fullscreen Switches automatically to a portrait layout on mobile and landscape on desktop.

Disclaimer

This game is intended for fun only.

Tip — Use it as an ice-breaker in internal UR E26 onboarding or a project kick-off. You can share the intuition behind Zones & Conduits in five minutes.

It's open to owners, shipyards, class, and vendors — and anyone learning UR E26 for the first time. Give it a play, and feel free to leave any ideas or feedback.

SJ

ShipJobs · Maritime Cyber Security

Maritime Cyber Security · IACS UR E26/E27

Writing about maritime cyber security — IACS UR E26/E27 compliance, ZCD (Zone and Conduit Diagram), and OT/IT security architecture.

🌐 shippauljobs.com in LinkedIn

#UR_E26#Cyber_Resilience#Zone_and_Conduit #Maritime_Cyber#ZCD#ShipJobs

⚓ Join the ShipPaulJobs Community

Join →