After this lesson you can define cybersecurity and information security, explain the CIA Triad and apply it to maritime OT systems, classify assets, threats, vulnerabilities and risks, describe security controls by function and type, understand defense in depth, distinguish an event from an incident, and explain why cyber resilience requires more than just prevention.
Imagine a bulk carrier transiting a busy international shipping lane. The bridge team is focused on navigation — radar, ECDIS, AIS, weather overlay. What they may not see is that the same network carrying their electronic chart updates also connects to the crew Wi-Fi router, which someone has been using to download files from an unknown USB drive. Three weeks earlier, that USB drive had been quietly handed to a crew member at a foreign port. It contained a remote access trojan, dormant until the vessel came within satellite comms range of its command-and-control server.
This scenario is not fiction. Variants of it have been documented in maritime security incident reports. And it illustrates precisely why cybersecurity is no longer an IT department problem — it is an operational problem, a safety problem, and increasingly, a regulatory compliance problem for every vessel owner, operator, flag state, and port authority.
Before you can defend a system, you need to understand what you are defending, against what, and why certain things matter more than others. That understanding starts with the foundational vocabulary of cybersecurity — concepts that professional practitioners use every day, and that form the basis of frameworks like the NIST Cybersecurity Framework, IACS UR E26 and E27, and IMO MSC-FAL.1/Circ.3.
This lesson covers that vocabulary. It is deliberately conceptual — practical technical implementation comes in later lessons. But every technical tool, every compliance framework, and every incident response procedure you will encounter in this series traces back to the ideas on this page.
1. Cybersecurity and Information Security — What's the Difference?
The terms cybersecurity and information security (InfoSec) are often used interchangeably in conversation, but they carry different scopes that matter when designing programmes and assigning responsibilities.
Information security is the broader discipline: it covers the protection of any information — whether stored on paper, spoken aloud in a meeting room, written in a logbook, or transmitted electronically — from unauthorised access, use, disclosure, disruption, modification, or destruction. An information security programme encompasses paper records, verbal communications, physical filing systems, and digital data equally. ISO/IEC 27001 is the primary international standard for information security management systems (ISMS).
Cybersecurity focuses specifically on digital systems, networks, and the data that flows through them. NIST defines cybersecurity as "the process of protecting information by preventing, detecting, and responding to attacks" on computer systems and networks (NIST SP 800-12 Rev.1, 2017). Cybersecurity extends to Operational Technology (OT) systems — industrial control systems, programmable logic controllers, navigation systems — as well as cloud environments, IoT devices, and increasingly, satellite communication infrastructure.
Both fields share the same core principles — the CIA Triad — and in practice, a maritime cybersecurity practitioner must understand both. The cargo manifest stored in a fleet management system is an information security concern. The network that carries it is a cybersecurity concern. The paper copy locked in the safe is an information security concern. They are part of one risk picture.
2. The CIA Triad — The Foundation of Every Security Decision
Every security decision — from choosing an encryption algorithm to designing a network architecture to drafting an incident response plan — can be traced back to three core properties. The CIA Triad (Confidentiality, Integrity, Availability) is the foundational model of information security. It provides a consistent way to describe what protection means, why a specific control is needed, and what was lost when a breach occurs.
When a security breach is reported — a data leak, a system outage, manipulated records — the first question a security professional asks is: which of the three properties was violated? The answer determines the nature of the harm, the appropriate response, and the regulatory reporting obligations that follow.
Confidentiality
Information is accessible only to those authorised to see it. Confidentiality is violated when information is disclosed to an unauthorised party — whether deliberately (exfiltration) or accidentally (misconfigured access permissions). Controls include encryption, access control lists, role-based access control (RBAC), data classification, and need-to-know policies.
Integrity
Information and systems are accurate and have not been altered by unauthorised parties. Integrity is violated when data is modified, corrupted, or deleted without authorisation. Controls include cryptographic hashing (SHA-256, SHA-3), digital signatures, write-once storage, change-detection monitoring, and audit logging. Without integrity, you cannot trust what a system tells you.
Availability
Systems and data are accessible to authorised users when needed. Availability is violated when authorised users cannot access systems or data — whether due to attack (DDoS, ransomware), hardware failure, or misconfiguration. Controls include redundancy, backup systems, disaster recovery plans, DDoS mitigation, and high-availability architectures.
⚠️ Critical Maritime Note — The Priority Inversion: In IT systems (corporate networks, email, ERP), Confidentiality is often the primary concern. A data breach that leaks sensitive business data is a serious harm, but it rarely endangers lives. In maritime OT (Operational Technology) — propulsion control, steering gear, ballast water systems, fire detection, ECDIS, GMDSS — Availability and Integrity are the dominant priorities. A navigation system that is unavailable or that reports incorrect position data is a direct safety hazard. A compromised propulsion controller can cause collision or grounding. This asymmetry — IT prioritises Confidentiality; OT prioritises Availability and Integrity — drives much of maritime cybersecurity's distinct technical character and is the reason OT and IT systems require different security approaches.
The CIA Triad also maps directly to regulatory frameworks. IACS UR E26 (Cyber Resilience of Ships) requires shipowners to assess cyber risks across all onboard systems — and those assessments are structured around exactly these three properties. IMO MSC-FAL.1/Circ.3 on Maritime Cyber Risk Management uses the same triad as its risk evaluation basis.
3. Asset, Threat, Vulnerability, and Risk
These four terms are the building blocks of every risk assessment — and they are often confused, even by experienced professionals. The confusion leads to poor decisions: spending money protecting low-risk assets while ignoring high-risk ones, or conflating a threat with a vulnerability and failing to address either properly.
Understanding the precise meaning of each term, and the relationship between them, is the prerequisite for every risk management framework — NIST RMF, ISO 31000, IACS UR E26 — that you will encounter in professional practice.
The critical relationship: Risk is not the same as threat, and not the same as vulnerability. A vulnerability on a completely isolated system with no network path and no physical access (no credible threat vector) presents negligible risk. The same vulnerability on an internet-facing server with known active exploits presents high risk. Risk analysis always evaluates both dimensions — likelihood and impact — together.
This is why a pure vulnerability scan is not a risk assessment. A vulnerability scanner can identify weaknesses (vulnerability), but it cannot tell you which threat actors are likely to exploit them (threat), which assets are most critical to protect (asset), or what the business and safety consequences of exploitation would be (impact). All four terms are needed for a complete risk picture. Reference: NIST SP 800-30 Rev.1, "Guide for Conducting Risk Assessments."
⚠️ IACS UR E26 connection: Section 3 of IACS UR E26 requires shipowners and yards to conduct a cyber risk assessment covering all onboard systems. That assessment must identify assets (ship systems and their functions), threats (potential attack vectors), vulnerabilities (weaknesses in those systems), and resulting risks — exactly the four terms above, applied systematically to every vessel system from propulsion to navigation to cargo handling.
4. Security Controls — What We Do About Risk
Once risk is identified and assessed, the response is to implement security controls — safeguards and countermeasures that reduce the likelihood of an attack succeeding, detect it if it does, and restore systems afterward. Controls are the "doing" part of security: policies, technologies, processes, and physical measures that operationalise the CIA Triad.
NIST SP 800-53 organises controls into 20 families (Access Control, Configuration Management, Audit and Accountability, etc.) covering hundreds of specific requirements. For conceptual understanding, controls are commonly grouped by their functional purpose:
Stop an attack from occurring or from succeeding. Act before or during the attack phase. Goal: reduce the likelihood that a threat successfully exploits a vulnerability.
Technical: Firewall, multi-factor authentication (MFA), encryption, access control lists, network segmentation, patch management, application whitelisting.
Administrative: Security policies, crew cyber awareness training, background checks, acceptable use policies.
Physical: Locked server rooms, cable management, USB port blockers, badge access to bridge and ECR.
Identify and alert on attacks that are in progress or have already occurred. Cannot stop an attack by themselves — only reveal it. Without detective controls, breaches may go undetected for months (the industry average "dwell time" of an attacker inside a network before detection is measured in days to weeks depending on the sector).
Technical: SIEM (Security Information and Event Management), IDS/IPS (Intrusion Detection/Prevention System), log monitoring, file integrity monitoring, anomaly detection.
Physical: Security cameras, motion sensors, audit trails for physical access to server rooms and bridge systems.
Restore systems and operations to normal after a security incident. Act after an attack has been detected. The goal is to minimise harm, restore availability and integrity, and prevent recurrence. Without corrective controls, even a detected attack can cause prolonged outage.
Technical: Verified data backups, system imaging and recovery procedures, patch deployment, malware removal tools, network quarantine capabilities.
Administrative: Incident response plan, business continuity plan, lessons-learned process, post-incident review.
Controls are also classified by their nature — Technical (implemented in software or hardware), Administrative (policies, training, procedures), and Physical (locks, barriers, environmental controls). A robust security programme layers all three natures across all three functional categories. A firewall alone is not enough if crew members are not trained on phishing. A training programme is not enough if physical access to bridge systems is uncontrolled.
Maritime application: IACS UR E26 requires documented security controls across all onboard systems, mapped to specific risk scenarios. The control categories above map directly to what the standard calls "protection measures" (preventive), "detection measures" (detective), and "response and recovery measures" (corrective).
5. Defense in Depth — Why One Control Is Never Enough
Defense in depth is the security principle of layering multiple independent controls so that the failure of any one control does not result in a complete breach. The concept originates from military strategy: a fortress with only one wall falls when that wall is breached; a fortress with multiple defensive rings, moats, checkpoints, and internal compartments forces an attacker to defeat each layer in turn.
In cybersecurity, defense in depth means that no single technology is trusted as the sole protection. A firewall is the perimeter wall — but if malware arrives via a phishing email that passes through the mail server (which sits behind the firewall), the firewall has been bypassed. The next layer — endpoint antivirus — should catch it. If the malware is zero-day and bypasses the antivirus, the SIEM should detect its anomalous behaviour. If detection is delayed, a backup and recovery procedure limits the blast radius.
Each layer compensates for the potential failure of the others. This is why experienced security practitioners resist "silver bullet" thinking — no single product, no single tool, and no single technology provides adequate protection on its own.
A ship that relies only on its perimeter firewall and no other controls is as vulnerable as a fortress with one wall. If an attacker penetrates the perimeter — through a phishing email, a compromised USB device, or a misconfigured remote access service — there are no further barriers. Defense in depth ensures that penetrating one layer still leaves multiple more to defeat.
6. Event vs Security Incident
A security event is any observable occurrence in a system or network — a login attempt, a packet traversing a firewall, a file being modified, a service starting or stopping. Events are not inherently harmful. They happen constantly, in their millions, across any networked system. Events are what security tools are designed to collect, store, and analyse.
A security incident is an event (or series of related events) that has actually or potentially violated security policy, threatened the CIA Triad, or caused harm to the organisation. Not every event is an incident — but every incident is made up of events.
The distinction matters enormously in practice. Security analysts spend a significant portion of their working time triaging events — determining which are genuine incidents that require response and which are benign noise. Miscategorising events (treating benign activity as an incident, or failing to escalate a real incident) wastes resources or enables attackers to persist undetected.
A SIEM (Security Information and Event Management) system collects events from across the network — firewalls, servers, endpoints, OT sensors — applies correlation rules, and generates alerts for human review. The challenge is the signal-to-noise ratio: a large network can generate millions of events per day, of which a tiny fraction represent genuine incidents. A well-tuned SIEM filters the noise and surfaces the signal. A poorly tuned one produces alert fatigue — so many false positives that analysts begin ignoring alerts — which is exactly the condition attackers exploit to go undetected.
IMO MSC-FAL.1/Circ.3 and IACS UR E26 both require operators to have incident detection and reporting procedures. A vessel that cannot distinguish events from incidents — that has no systematic method for reviewing security logs — cannot meet these requirements in any meaningful way.
7. Cyber Resilience — Beyond Prevention
Traditional cybersecurity thinking was largely defensive and prevention-focused: build high enough walls that attackers cannot get in. This model has a fundamental flaw — no defensive perimeter is perfect. Sophisticated threat actors, zero-day vulnerabilities, insider threats, and supply chain compromises mean that a determined attacker against a determined target will, eventually, find a way in. Prevention alone is necessary but not sufficient.
Cyber resilience shifts the question from "how do we prevent all attacks?" to "how do we continue to operate safely even when attacks succeed, and how do we recover faster than an attacker can cause harm?" It is the capacity to anticipate threats, withstand their effects, recover from incidents, and adapt so that the same attack cannot succeed again at the same scale.
NIST SP 800-160 Vol.2 defines cyber resilience as "the ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by cyber resources." This definition acknowledges that cyber resilience applies even to naturally occurring disruptions — equipment failures, power outages, human error — not only deliberate attacks.
The IMO's Guidelines on Maritime Cyber Risk Management (MSC-FAL.1/Circ.3, and its revision Circ.3/Rev.3) structures maritime cyber resilience around five functions — Identify → Protect → Detect → Respond → Recover — the same five functions as the NIST Cybersecurity Framework (CSF). These five functions are not sequential steps; they are concurrent, overlapping activities that together constitute a complete cyber risk management cycle.
For a vessel operator, this means: Identify — knowing every system onboard and its cyber dependencies. Protect — firewalls, access control, network segmentation, patch management. Detect — monitoring systems and logs for anomalies. Respond — crew-level incident response procedures for cyber events, as formalised as MOB drills. Recover — verified offline backups, redundant systems, tested procedures for restoring navigation capability after a cyber incident at sea.
From 1 January 2024, IACS member societies require newbuild vessels to comply with UR E26 (ship cyber resilience requirements) and UR E27 (organisation cyber resilience requirements). Both standards are structured around this same five-function resilience cycle.
"Cybersecurity is an IT problem, not our problem."
Onboard navigation systems, propulsion controls, ballast systems, and cargo handling systems are all computer-dependent. They are all cyber assets. The bridge team, the chief engineer, and the company security officer share responsibility — not just the IT department ashore.
"We have a firewall, so we're protected."
A firewall is one preventive control on the perimeter. It does nothing to stop phishing emails, USB-borne malware, insider threats, or attacks that arrive through a legitimate remote access service. Defense in depth requires layers — not one tool.
"Our systems are air-gapped, so they can't be attacked."
True air gaps are rare on modern vessels. VSAT, GMDSS, port connectivity, laptop USB connections, and crew personal devices create pathways across supposed air gaps. The Stuxnet worm — designed to destroy industrial centrifuges — crossed an air gap via USB. Maritime OT is not as isolated as operators often believe.
- Cybersecurity is the digital-systems subset of information security; both share the CIA Triad as their foundation.
- The CIA Triad — Confidentiality, Integrity, Availability — is the framework behind every security decision. In maritime OT, Availability and Integrity dominate over Confidentiality.
- Asset, Threat, Vulnerability, and Risk are precise terms. Risk = Likelihood × Impact; it emerges only when a threat can actually reach and exploit a vulnerability against a specific asset.
- Security controls are Preventive, Detective, or Corrective in function, and Technical, Administrative, or Physical in nature. A strong programme layers all six combinations.
- Defense in depth means no single control is trusted as sole protection; multiple independent layers compensate for each other's potential failures.
- Not every event is an incident; security analysts triage events using SIEM correlation rules. Alert fatigue from poor tuning enables attackers to persist undetected.
- Cyber resilience — Identify, Protect, Detect, Respond, Recover — accepts that prevention is imperfect and builds the capacity to operate through and recover from successful attacks.
- IACS UR E26/E27 and IMO MSC-FAL.1 structure maritime cyber requirements around exactly these concepts.
Lesson 2 — Network Fundamentals for Cybersecurity builds directly on this foundation. You now know what you are protecting (assets), why (CIA Triad and risk), and what categories of protection exist (controls and defense in depth). What you do not yet know is how data actually moves between those assets — and that is the prerequisite for understanding how attackers move, and how defenders stop them.
Lesson 2 covers TCP/IP (the model that governs how all networked communication works), IP addresses and ports, the difference between TCP and UDP and why it matters, DNS and how it can be exploited, the mechanics of firewalls and network segmentation, and how VPNs protect remote access — all with maritime OT context throughout.
⚓ Join the ShipPaulJobs Community
Join →
Comments
Post a Comment