Maritime Cybersecurity Learning Roadmap
From Cybersecurity Fundamentals to Maritime Cyber Resilience
ShipPaulJobs Knowledge Series · Course Navigation Hub — updated as each lesson is published
This roadmap builds from the foundations of cybersecurity — core concepts, common attack types, and the attacker/defender perspective — through SOC, SIEM, EDR/XDR, Threat Hunting, Detection Engineering, SOAR, and AI-assisted security operations, and into Maritime IT/OT Cybersecurity, IACS UR E26/E27, and Cyber Resilience. Each lesson goes beyond a glossary definition to show how the concept actually connects to real security operations and to the maritime IT/OT environment.
Every part is being expanded toward 12 lessons. The lessons listed below under each part are what is currently outlined — additional lessons will be added to each part as the series develops, and this page will be updated with links as each one publishes.
The Learning Path
How This Series Is Written
Every lesson in this series follows the same editorial standard:
- Based on verifiable technical facts, drawing first on official sources — NIST, CISA, MITRE, IACS, IMO, IEC, ISO, classification societies, and official vendor documentation.
- Clearly distinguishes Fact, Technical Interpretation, Example, and Forecast, rather than blending them.
- Does not invent statistics, incident cases, regulations, technical specifications, or product capabilities.
- Links to official primary sources for significant technical or regulatory claims wherever possible, and notes the applicable version or reference date for topics that change over time.
- Checks IACS/IMO and related classification/technical documents first for anything maritime-related, and does not declare one product superior to another without evidence.
- Explains attack techniques conceptually, for education and defense — never as step-by-step exploitation instructions.
PART 1 · Cybersecurity Fundamentals
Before learning about attacks, defenses, or maritime-specific security, it helps to share a common vocabulary. This part builds the core concepts, networking basics, and operating-system fundamentals that every later lesson in this series assumes.
-
1
What Is Cybersecurity? ↗Cybersecurity begins with a shared vocabulary. This lesson defines Cybersecurity and Information Security, introduces the CIA Triad (Confidentiality, Integrity, Availability) as the foundation of what security protects, and explains how Asset, Threat, Vulnerability, and Risk relate to one another — along with the difference between a Security Control and an Incident, and an introduction to Cyber Resilience, the concept this series builds toward.
-
2
Network Fundamentals for Cybersecurity ↗Most attacks and most defenses happen somewhere on a network. This lesson covers TCP/IP (Transmission Control Protocol/Internet Protocol), IP addressing, Ports, the difference between TCP and UDP (User Datagram Protocol), DNS (Domain Name System), and HTTP/HTTPS (Hypertext Transfer Protocol/Secure) — then introduces the Firewall, Routing, Network Segmentation, and VPN (Virtual Private Network), the building blocks of network defense used throughout the series.
-
3
Linux & Operating System Fundamentals ↗Security tools, logs, and attacker activity all run on top of an operating system. This lesson covers Process, User/Group, Permission, File System, and Service, along with Process Monitoring and the basic security differences between Windows and Linux — the knowledge needed to recognize what "normal" system behavior looks like before learning to detect abnormal behavior.
-
4
Kali Linux and Security Testing ↗Kali Linux is a Linux distribution built specifically for security assessment and penetration testing. This lesson explains what Kali Linux is used for and walks through the major stages of a typical security-testing workflow, framed for education and defensive understanding rather than as an offensive how-to guide.
-
5
Security+ and the Cybersecurity Knowledge Map ↗CompTIA Security+ is a widely recognized entry-level cybersecurity certification, and its exam objectives double as a useful map of the field. This lesson uses that map to lay out the overall terrain of cybersecurity — Network, Identity, Cryptography, Vulnerability, Operations, Incident Response, and Risk — so readers can see where each later lesson in this series fits.
PART 2 · Understanding Cyber Attacks
Understanding how to defend a system starts with understanding how it is actually attacked. This part walks through some of the most common and consequential categories of cyberattack, building the attacker's-eye view that later security-operations lessons depend on.
-
6
Phishing Attack and Social Engineering ↗Phishing remains one of the most common ways attackers gain initial access to a system. This lesson explains Social Engineering as the psychological basis of phishing, how Credential Theft and malicious links or attachments are used to trick a user, and the detection and prevention measures organizations use to reduce the risk.
-
7
Ransomware and the Cyber Kill Chain ↗Ransomware attacks typically follow a recognizable sequence rather than happening in a single step. This lesson walks through that sequence — Initial Access, Execution, Privilege Escalation, Lateral Movement, Encryption, and Exfiltration/Extortion — and explains what Recovery from a ransomware incident actually involves.
-
8
DoS and DDoS Attacks ↗A DoS (Denial of Service) or DDoS (Distributed Denial of Service) attack targets Availability — the third pillar of the CIA Triad — rather than trying to steal or alter data. This lesson explains the difference between network-layer and application-layer attacks, and how organizations defend against and monitor for them.
-
9
Man-in-the-Middle (MitM) Attacks ↗A Man-in-the-Middle (MitM) attack intercepts communication between two parties who believe they are talking directly to each other. This lesson explains how such interception happens, why TLS (Transport Layer Security) and proper Certificate Validation matter, and what secure communication actually requires.
-
10
SQL Injection ↗SQL Injection remains one of the most common web-application vulnerabilities, arising from applications that handle user input insecurely. This lesson explains how vulnerable input handling enables this attack, and how techniques like Parameterized Query and Prepared Statement close that gap — core concepts for database and web security.
-
11
Cross-Site Scripting (XSS) ↗Cross-Site Scripting (XSS) lets an attacker run malicious code in another user's browser. This lesson distinguishes Stored, Reflected, and DOM-based XSS, and explains the browser-security concepts used to prevent it, including output Encoding and CSP (Content Security Policy).
-
12
Zero-Day Vulnerabilities and Exploits ↗A Vulnerability is a weakness; an Exploit is code or a technique that takes advantage of it. This lesson clarifies that distinction, defines a Zero-Day as a vulnerability exploited before a fix exists, and covers the Patch Gap, responsible Disclosure practices, and mitigation approaches used while a fix is unavailable.
-
13
DNS Spoofing and DNS-based Attacks ↗DNS (Domain Name System) translates domain names into IP addresses, which makes it a valuable target for attackers. This lesson explains how DNS works, how DNS Spoofing and Cache Poisoning manipulate that trust, and how protections like DNSSEC (Domain Name System Security Extensions) defend against them.
PART 3 · Attackers, Defenders and Cyber Defense
With common attack types established, this part turns to how organizations actually organize themselves to find and fix weaknesses before attackers do — and to the shared framework security teams use to describe attacker behavior in a structured, comparable way.
-
14
Red Team vs Blue TeamOrganizations test their own defenses by simulating attackers. This lesson explains Offensive Security (Red Team) and Defensive Security (Blue Team), how a Purple Team combines both perspectives, and how this kind of Security Validation improves an organization's actual defensive posture.
-
15
MITRE ATT&CK: Understanding Adversary BehaviorMITRE ATT&CK is a widely used knowledge base that catalogs real-world attacker behavior in a structured way. This lesson explains its core building blocks — Tactic, Technique, Sub-technique, and Procedure — and how security teams use that structure to guide Detection and Mitigation work.
PART 4 · Security Operations
This part moves from individual attack types into how organizations actually detect and respond to threats on an ongoing basis — the people, processes, and platforms that make up day-to-day security operations.
-
16
What Is a Security Operations Center?A SOC (Security Operations Center) is the team and function responsible for continuously monitoring an organization for cyber threats. This lesson introduces the SOC Analyst role and the operational cycle of Monitoring, Alert, Incident, Investigation, Threat Intelligence, and Incident Response that structures a SOC's daily work.
-
17
SIEM: Turning Logs into Security IntelligenceA SIEM (Security Information and Event Management) system is the platform a SOC typically relies on. This lesson explains how a Log becomes an Event, how Correlation and Detection Rules turn events into Alerts, and how those alerts lead into Investigation — along with the basics of SIEM architecture.
-
18
Microsoft SentinelMicrosoft Sentinel is a cloud-based SIEM/SOAR (Security Orchestration, Automation and Response) platform. This lesson walks through its core building blocks — Data Connector, Analytics Rule, Incident, KQL (Kusto Query Language), Threat Intelligence, and Automation — as a concrete example of the previous lesson's SIEM concepts in practice.
-
19
Splunk for Security OperationsSplunk is one of the most widely deployed platforms for security log analysis. This lesson covers how it ingests logs, supports Search and Correlation, and enables Detection and Investigation — a second concrete example of SIEM/Security Analytics in practice, alongside Microsoft Sentinel.
PART 5 · Endpoint Security
Beyond the network and the SOC, individual devices — laptops, servers, workstations — need their own layer of defense. This part covers how endpoint protection has evolved and how it fits into modern security operations.
-
20
From Antivirus to EDR and XDREndpoint protection has evolved substantially beyond traditional Antivirus. This lesson traces that evolution — Antivirus → EPP (Endpoint Protection Platform) → EDR (Endpoint Detection and Response) → XDR (Extended Detection and Response) — and explains how each stage adds Endpoint Telemetry, Detection, Investigation, and Response capability.
-
21
CrowdStrike, SentinelOne and Microsoft Defender for EndpointTo make the EDR/XDR concepts from the previous lesson concrete, this lesson compares three widely used endpoint security platforms — CrowdStrike, SentinelOne, and Microsoft Defender for Endpoint — from a functional and operational perspective, without declaring any one platform superior.
PART 6 · Advanced Detection & Response
Once basic monitoring is in place, security teams move toward more proactive and deliberately engineered ways of finding threats. This part covers how experienced teams go looking for what automated alerts miss, and how they systematically build and validate detection capability.
-
22
Threat HuntingThreat Hunting is a proactive, hypothesis-driven search for threats that automated alerts may have missed. This lesson explains how a hunt starts from a hypothesis, moves through Data Collection and Query, gathers Evidence, and ultimately feeds back into Detection Improvement.
-
23
Detection EngineeringDetection Engineering is the discipline of deliberately building detection capability rather than relying only on vendor-provided alerts. This lesson walks through its core pipeline — Threat → TTP (Tactics, Techniques, and Procedures) → Telemetry → Detection Logic → Alert → Validation → Tuning.
-
24
Security Analytics and Detection ValidationNot every detection rule is actually effective. This lesson covers how to measure Detection Coverage and manage False Positives and False Negatives, what Detection Quality means in practice, and how Testing, Tuning, and identifying Coverage Gaps keep a detection program effective over time.
PART 7 · Security Automation
As alert volume grows, manual response alone does not scale. This part covers how security teams use automation to respond faster and more consistently, while keeping humans in control of high-impact decisions.
-
25
SOAR: Security Orchestration, Automation and ResponseSOAR (Security Orchestration, Automation and Response) platforms connect security tools together and automate repetitive response steps. This lesson explains Orchestration and Automation, how a Playbook encodes a response procedure, and how Alert Enrichment and Threat Intelligence feed into Automated Response — while Human Approval remains part of the workflow for higher-risk actions.
PART 8 · AI and Cybersecurity
Artificial intelligence is increasingly part of how security teams detect and investigate threats. This part covers where AI genuinely fits into cybersecurity today, and how an AI-assisted SOC changes — and doesn't change — the analyst's job.
-
26
AI in CybersecurityThis lesson covers where AI (Artificial Intelligence) and ML (Machine Learning) are actually used in cybersecurity today — Anomaly Detection, Classification, and Threat Intelligence enrichment — and distinguishes established Security Analytics use cases from newer applications of Generative AI and LLMs (Large Language Models).
-
27
AI SOCThis lesson compares a traditional SOC (Security Operations Center) to an AI-assisted SOC — how AI can help with Alert Summarization, Investigation, and Correlation, and support Detection — while explaining why a Human-in-the-loop approach remains central to how these systems are actually used.
PART 9 · Maritime Cybersecurity
With the general cybersecurity foundation in place, this part turns to what actually changes when these concepts are applied on board a ship — IT and OT (Operational Technology) systems under safety-critical, often legacy, and physically isolated conditions that land-based guidance doesn't fully address.
-
28
What Makes Maritime Cybersecurity Different?This lesson explains why maritime cybersecurity cannot simply reuse land-based IT security practices unchanged. It covers the IT/OT (Information Technology / Operational Technology) distinction, the added weight of Safety and Availability requirements at sea, Connectivity and Remote Access constraints, Legacy Systems, Asset Lifecycle realities, and Supply Chain considerations specific to shipbuilding.
-
29
Shipboard IT and OT ArchitectureBefore threats or defenses can be discussed meaningfully, it helps to know what systems are actually on board. This lesson introduces the Bridge, Navigation, ECDIS (Electronic Chart Display and Information System), AIS (Automatic Identification System), GMDSS (Global Maritime Distress and Safety System), VDR (Voyage Data Recorder), IAS (Integrated Automation System), PMS (Power Management System), AMS (Alarm Monitoring System), propulsion-related systems, and the networks and remote-access paths that connect them.
-
30
Cyber Threats Against Maritime IT/OTThis lesson takes the attack types covered earlier in the series — Phishing, Ransomware, MitM (Man-in-the-Middle), DoS (Denial of Service), and Credential Theft — and applies them specifically to the shipboard environment, showing how each plays out differently when OT systems and safety-critical operations are involved.
PART 10 · Maritime Threat Detection & Resilience
Detecting threats on a ship is not the same as detecting them in a corporate data center. This part applies the threat-hunting and detection-engineering concepts from Part 6 to the maritime OT environment, and introduces how shore-based monitoring extends a SOC's reach to an entire fleet.
-
31
Threat Hunting in Maritime OTThis lesson applies the Threat Hunting concept from Part 6 to maritime OT (Operational Technology), starting from what normal vs. abnormal OT behavior actually looks like. It covers Network Monitoring, Remote Access, the Engineering Workstation as a common point of exposure, and the importance of Asset Visibility on board.
-
32
Detection Engineering for Maritime OTThis lesson adapts the Detection Engineering pipeline from Part 6 for the maritime OT context: Maritime Asset → Threat Scenario → Attack Technique → Telemetry → Detection → Investigation → Response — showing how each stage differs from a land-based IT environment.
-
33
Maritime SOC and Shore-based Cyber MonitoringA single ship cannot maintain a full SOC (Security Operations Center) on board, so monitoring is often extended from shore. This lesson explains the relationship between Vessel, Fleet, and Shore-based SOC, how Security Data and Fleet Visibility are maintained, and how Incident Escalation and Response Coordination work across that structure.
PART 11 · Maritime Compliance
This part widens the lens from IACS's technical requirements to the broader maritime compliance landscape — SOLAS, port security, the IMO Maritime Safety Committee, and the MASS Code — showing how UR E26/E27 sit inside a larger international regulatory framework.
-
34
IACS UR E26: Cyber Resilience of ShipsIACS (International Association of Classification Societies) UR (Unified Requirement) E26 sets ship-level cyber resilience requirements. This lesson explains what E26 actually requires and how the security perspective it introduces applies across a ship's design, construction, commissioning, and operational phases.
-
35
IACS UR E27: Cyber Resilience of On-board Systems and EquipmentWhere E26 addresses the ship as a whole, IACS UR E27 addresses cyber resilience at the level of individual on-board systems and equipment. This lesson covers what E27 requires of equipment suppliers — Secure Development, Hardening, Interface requirements, and the Type Approval process.
-
36
E26 vs E27: Ship-Level vs System-Level Cyber ResilienceThis lesson directly compares the scope and role of E26 and E27, clarifying which requirements apply to the ship as a whole versus to individual equipment, and explaining how the two Unified Requirements are designed to work together rather than in isolation.
-
37
SOLAS and Maritime CybersecuritySOLAS (International Convention for the Safety of Life at Sea) is the foundational IMO (International Maritime Organization) treaty governing ship safety. This lesson explains SOLAS's role as the legal basis that ties cyber risk management to a ship's Safety Management System (SMS), and how that connects to the more technical IACS UR E26/E27 requirements covered earlier in this part.
-
38
Port Security and the ISPS CodeShip security does not end at the ship's rail — ports are a critical link in the maritime supply chain. This lesson introduces the ISPS Code (International Ship and Port Facility Security Code), the SOLAS-linked framework governing port and ship security, and explains why port facilities and ship-port interfaces are an increasingly important part of the maritime cyber risk picture.
-
39
IMO MSC and Maritime Cyber Risk GuidelinesThe IMO MSC (Maritime Safety Committee) is the body responsible for issuing the Guidelines on Maritime Cyber Risk Management. This lesson walks through what the MSC does, how its guidelines connect governance, identification, protection, detection, response, and recovery into a single framework, and how that framework relates to the more technical IACS requirements covered in this part.
-
40
The MASS Code and Autonomous Ship ComplianceThe MASS (Maritime Autonomous Surface Ships) Code is the IMO's framework addressing ships that operate with reduced or no crew on board. This lesson covers the Code's degree-based classification of autonomy, its Remote Operations Centre (ROC) and connectivity-security provisions, and why autonomous shipping represents the newest frontier of maritime compliance.
PART 12 · From Compliance to Cyber Resilience
This final part connects everything the series has covered — from fundamentals to maritime OT detection to IACS requirements — into a single picture of how technical compliance actually becomes operational cyber resilience, and where the field is likely headed next.
-
41
From E27 Type Approval to E26 Ship IntegrationThis lesson traces the full lifecycle connecting the two Unified Requirements from Part 11: Equipment → E27 (Type Approval) → Integration → E26 (Ship-level Compliance) → Operation → Monitoring → Resilience — showing how equipment-level and ship-level cyber resilience requirements connect across a vessel's lifecycle.
-
42
Cybersecurity Compliance vs Cyber ResilienceMeeting a compliance requirement is not the same as actually being resilient to a cyber incident. This lesson draws out the distinctions between Compliance, Security, and Resilience, and explains how they relate to and depend on one another in practice.
-
43
The Future of Maritime CybersecurityThis closing lesson looks at where maritime cybersecurity appears to be headed — AI-assisted Security Operations, Continuous Monitoring, Threat Intelligence sharing, maturing Maritime SOC capability, Fleet-wide Cyber Resilience, and the security implications of increasingly Autonomous Ships.
How This Series Is Structured
- 1Early lessons explain fundamentals clearly enough for a general cybersecurity audience.
- 2From the midpoint, technical depth increases and the lessons start showing how attack, defense, and detection actually connect.
- 3In the later parts, these general cybersecurity concepts are re-applied specifically to the maritime IT/OT environment.
- 4IACS E26/E27 lessons connect back to the Asset, Threat, Detection, Response, and Recovery concepts introduced earlier in the series.
- 5Each lesson closes with What We Learned and Where This Leads Next, linking forward to the following lesson.
- 6Where possible, each lesson provides official primary sources and further-reading material.
This navigation hub is updated as lessons move from Planned to Published, with links added here as each one goes live.
This is not meant to be simply a collection of introductory cybersecurity content. It is built to take the fundamental principles of cybersecurity, apply them to real security operations and to the maritime IT/OT environment, and ultimately connect them to IACS E26/E27 and Cyber Resilience — ShipPaulJobs' long-term knowledge series on maritime cyber resilience.
Maritime 4.0 · AI & Cybersecurity Intelligence from Real Shipyard
Experience
www.shippauljobs.com
⚓ Join the ShipPaulJobs Community
Join →
Comments
Post a Comment