This lesson explains security testing concepts for educational and defensive purposes. It describes methodology phases at a conceptual level — how assessors think and what they look for — to help defenders understand what testing reveals and how to interpret findings. This lesson does not provide step-by-step exploitation instructions. Offensive security testing requires written authorisation from the system owner; conducting it without authorisation is illegal in virtually all jurisdictions.
After this lesson you can explain what Kali Linux is and why it is the standard security testing platform, distinguish a vulnerability assessment from a penetration test and know when each is appropriate, describe the five phases of a standard penetration test methodology, explain why maritime OT environments require a fundamentally different assessment approach than standard IT systems, articulate the passive-first methodology and why it exists, and understand the full legal and ethical framework that governs all security testing activity.
In the previous three lessons of this Part 1 series, you built the conceptual and technical foundation for cybersecurity: what you are protecting and why (Lesson 1), how systems communicate and where networks fail (Lesson 2), and how operating systems manage the processes, users, and services that attackers target (Lesson 3). This lesson applies that knowledge to a different perspective: what it looks like when a professional security assessor actively tests those defences.
Understanding how security testing works is valuable whether you intend to conduct assessments yourself or whether you are on the receiving end as a ship operator, fleet manager, or security officer commissioning a maritime cyber assessment for IACS UR E26 compliance. In either case, you need to know: what does a competent assessor actually do? What should they be allowed to do? What should they absolutely not do on a live vessel? And what does the report they deliver actually mean?
The platform that most security professionals use for this work is Kali Linux. This lesson explains what it is, how professional security testing is structured, and why the maritime OT context demands a fundamentally different approach than standard corporate IT penetration testing.
1. What Is Kali Linux?
Kali Linux is a Debian-based Linux distribution developed and maintained by Offensive Security, designed specifically for security professionals performing penetration testing, digital forensics, and security research. It comes pre-installed with over 600 security tools organised by category: information gathering, vulnerability analysis, web application testing, exploitation frameworks, post-exploitation, wireless analysis, password attacks, digital forensics, reverse engineering, and more.
Kali is not an "attack operating system" designed to break into systems without permission. It is a professional assessment platform — the same tools that security professionals use are also available to malicious actors, but the difference is authorisation, scope, and intent. A surgeon's scalpel is not an assassination weapon because of who holds it and under what circumstances.
Because it is built on Debian Linux, everything from Lesson 3 applies: the same process model, the same user/group/permission system, the same file system structure, the same service management via systemd. Kali is simply Debian with a curated collection of security tools pre-installed and optimised. Learning Kali is therefore learning Linux with a security focus.
Kali can be deployed as a full installation on dedicated hardware, as a bootable live USB (no persistent changes to the host system), as a virtual machine (VMware, VirtualBox, Hyper-V), as a Docker container, or as a Windows Subsystem for Linux (WSL) instance. For maritime assessments, the live USB or read-only deployment model is often preferred: no data persists on the assessment device after the engagement ends, protecting both the assessor and the ship operator.
Kali is the industry-standard environment for certifications including OSCP (Offensive Security Certified Professional — considered the gold standard of hands-on penetration testing certification), GPEN (GIAC Penetration Tester), and PNPT (Practical Network Penetration Tester). It is also the environment most maritime cybersecurity assessors carry when conducting CRSI (Cyber Resilience Services Implementation) or IACS UR E26 compliance assessments.
2. Vulnerability Assessment vs Penetration Test
The two most common forms of security testing are frequently confused — even by people who commission them. They have different scopes, methods, resource requirements, and outputs. Choosing the wrong one for the situation provides false confidence or wastes budget.
The critical distinction: a vulnerability assessment tells you what might be exploitable. A penetration test tells you what actually is exploitable and what an attacker could do with it. A high-severity CVSS 9.8 vulnerability that requires local authenticated access on a system with no local users may be lower priority than a CVSS 5.3 vulnerability that is trivially exploitable from the internet and grants access to a navigation network.
A third type — the Red Team Exercise — goes further still: it simulates a full adversary campaign, including social engineering, physical access attempts, and multi-stage attack chains against a defined objective (e.g., "demonstrate ability to disrupt cargo operations from the public internet"), often without the defensive team knowing the timing. Red teaming is covered in Part 3 of this series.
3. The Standard Penetration Test Methodology — Five Phases
Security testing follows a structured process. The most widely referenced methodologies — PTES (Penetration Testing Execution Standard) and the OWASP Testing Guide — converge on five distinct phases. Understanding these phases helps defenders identify exactly which controls must be strongest, and at what point in an attacker's kill chain they can best interrupt progress.
Passive: OSINT with no direct interaction with the target — public DNS records, WHOIS, certificate transparency logs (crt.sh), Shodan results, LinkedIn/job postings (revealing internal tool names and technology stack), GitHub repositories (credentials accidentally committed), and Google dorking (finding exposed login pages, configuration files, backup files via Google search operators).
Active: Direct interaction begins — port scanning with nmap, service fingerprinting, banner grabbing, web crawling. Goal: build a complete map of the attack surface before any exploitation is attempted. A professional assessor spends significant time here — attacking the wrong target or the wrong port wastes time and increases noise.
Active, directed probing of in-scope systems: identify open ports, running services, software versions, and known CVEs. Vulnerability scanners (Nessus, OpenVAS) cross-reference discovered software versions against vulnerability databases and generate a prioritised finding list. Enumeration extracts deeper information: usernames, SMB shares, domain structure, SNMP community strings, web application directory listings, API endpoints.
A critical sub-task here is service fingerprinting — determining exactly what software and version is running on each port. An HTTP server on port 80 might be Apache 2.2.15 (a version with known critical vulnerabilities) or NGINX 1.24 (current). The version matters enormously for both the attacker's next steps and the defender's prioritisation.
Within the agreed scope, testers attempt to exploit identified vulnerabilities to gain unauthorised access. They use exploit frameworks (Metasploit, which includes a database of ready-to-use exploits for known CVEs), custom code, or manual techniques. The goal is to prove that a vulnerability is practically exploitable, not merely theoretically present — a scanner can flag a vulnerability that requires specific conditions that don't exist in this environment, making it a false alarm in practice.
A professional assessor documents every step — including exploits attempted, what succeeded, what failed, and the exact evidence chain — so that findings can be reproduced and remediated. "We got in" without documentation is not a penetration test; it is just hacking.
After gaining initial access, testers ask: what can an attacker do from here? They attempt to: maintain persistence (so access survives reboots), escalate privileges (from regular user to administrator or root), harvest credentials (passwords, API keys, SSH keys from the compromised host), and move laterally to other systems in the network. This phase shows the real business impact of a breach — not just "we got in through the VPN" but "and then we could reach the cargo management system, the ballast water management controller, and the vessel management interface."
The pivot point is particularly revealing for maritime environments. If a tester compromises the crew Wi-Fi network and then finds they can reach the ECDIS workstation — because no network segmentation exists — that finding has immediate safety implications beyond just IT security.
A penetration test without a clear, actionable report provides no security value. The report is the actual deliverable. Professional reports have two distinct sections: an executive summary that communicates risk posture and business impact to non-technical management without technical jargon, and a technical findings section where each vulnerability is documented with severity rating (CVSS score), supporting evidence (screenshots, logs, command output), step-by-step reproduction procedure, and specific, actionable remediation guidance.
Good reports distinguish between what was found and what was actually exploitable — because that distinction drives prioritisation. A critical CVSS score that cannot be exploited in this specific environment may be lower priority than a medium CVSS finding that yields domain administrator access in three steps.
4. Security Testing in the Maritime Context — Why OT Changes Everything
Maritime cyber security assessments apply the same five-phase methodology described above, but within constraints that are fundamentally different from standard corporate IT penetration testing. Understanding these constraints is not optional — they exist because of genuine safety risk, operational continuity requirements, and the legal framework of maritime law. Disregarding them on a live vessel can cause loss of life or maritime incident.
5. The Passive-First Approach — Maritime OT Assessment in Practice
Given the safety and operational constraints above, a competent maritime cybersecurity assessor defaults to a passive-first methodology: gather as much intelligence as possible through non-intrusive means before any active probing, and restrict active methods to the minimum necessary to answer each specific security question.
nmap -sV --version-intensity 0 -T2 (slow timing, minimal probes). Always scan during a maintenance window with the Master's knowledge. Never run aggressive timing (-T5) or SYN scans against OT targets.The passive-first approach is not a limitation on assessment quality — it is the appropriate methodology for safety-critical operational technology environments. A well-executed passive assessment of a vessel's network can surface critical findings (open Modbus port accessible from crew Wi-Fi, Telnet HMI visible from VLAN 1, AIS receiver on same switch as cargo management) without touching a single live system. The evidence quality is high, the operational risk is zero, and the findings are directly actionable.
6. Legal and Ethical Framework — No Authorisation, No Testing
Unauthorised access to computer systems is a criminal offence under laws including the Computer Fraud and Abuse Act (CFAA) in the United States, the Computer Misuse Act 1990 (CMA) in the United Kingdom, the Cybercrime Prevention Act in the Philippines (relevant for Filipino-crewed vessels), and equivalent legislation in all IMO member states. "But I wanted to test the security" is not a legal defence. Ignorance of scope boundaries is not a defence. Working from a Kali Linux distribution is not a defence.
The jurisdictional complexity of maritime law adds additional layers: a vessel in international waters is subject to the law of its flag state; in territorial waters, the coastal state's laws apply; at port, the port state's laws apply. An assessor who exceeds their agreed scope while a vessel is at anchor in a foreign port may face prosecution under three different jurisdictions simultaneously.
Professional certifications such as OSCP (Offensive Security Certified Professional), GPEN (GIAC Penetration Tester), and PNPT (Practical Network Penetration Tester) all include mandatory ethical frameworks. The EC-Council Code of Ethics requires practitioners to obtain explicit authorisation, protect client data, disclose all findings, and report illegal activity encountered during an engagement. These are professional obligations — violating them results in certification revocation in addition to legal consequences.
- Kali Linux is a Debian-based professional assessment platform with 600+ pre-installed security tools — not an attack OS, but a practitioner's environment that requires authorisation to use legitimately.
- A vulnerability assessment identifies weaknesses without exploiting them; a penetration test actively exploits to demonstrate real-world impact. Choose based on the security question you need to answer.
- The five-phase pentest methodology: Reconnaissance → Scanning/Enumeration → Exploitation → Post-Exploitation → Reporting. Each phase has direct relevance to defensive control design.
- Maritime OT assessments apply the same methodology but under strict constraints: no active exploitation of safety systems, operational continuity requirements, asset inventory before scanning, zone/conduit verification, and signed Rules of Engagement.
- The passive-first approach — network traffic monitoring, configuration review, physical inspection — gathers critical intelligence without touching live systems, which is the appropriate methodology for safety-critical OT.
- No security test may proceed without written, scoped, signed authorisation. Maritime jurisdictional complexity adds flag state, coastal state, and port state law considerations simultaneously.
Lesson 5 — Security+ and the Cybersecurity Knowledge Map zooms out from the specific tools and techniques of this lesson to give you the full map of cybersecurity domains — what you have learned in Part 1, and where the remaining 11 lessons in this series will take you. CompTIA Security+ SY0-701 provides the most recognised vendor-neutral framework for understanding the complete scope of cybersecurity practice: from identity and access management through cryptography, incident response, and risk management. For maritime professionals without a formal cybersecurity background, understanding where Security+ fits in the learning landscape — and how it maps to IACS UR E26/E27 requirements — is the essential orientation for everything that follows.
⚓ Join the ShipPaulJobs Community
Join →
Comments
Post a Comment