Cybersecurity on board: where are the biggest risks?

For vessel owners, operators and other decision-makers in inland shipping, the most important cybersecurity risks can often be found in five areas:

• the growing connection between IT and OT;

• older systems that were not designed for today’s connected environment;

• remote access to systems on board;

• access and dependencies involving suppliers and service providers;

• human behaviour and everyday working practices.

These risks are closely connected. Protecting a vessel therefore requires more than securing individual computers or installing cybersecurity software. It requires insight into the complete digital environment on board and the connections between the vessel, the shore and external parties.

A modern vessel is no longer an isolated environment.

Systems on board exchange data with each other, with offices ashore and, in some cases, with external suppliers. Remote maintenance can reduce downtime. Operational data can provide valuable insights. Connected systems can make processes more efficient.

But connectivity also changes the risk profile.

A connection that is useful for the operation can also become a route through which an incident reaches systems on board. This is especially important when IT and OT are connected.

IT includes systems used to process and exchange information, such as computers, email, administration and communication systems. OT, or operational technology, refers to systems that monitor or control physical processes and equipment.

On board, OT can be directly related to the operation of the vessel.

That difference matters. If an office computer becomes unavailable, this is inconvenient and can interrupt work. If an operational system is affected, the consequences may extend to the availability or reliability of processes on board.

This is why OT-cybersecurity should be approached from the perspective of operational continuity.

Historically, many operational systems on board functioned largely independently. Today, more systems are connected to networks, data platforms and shore-based environments.

That creates value, but it also means that a problem does not necessarily remain within one system.

An infected laptop, an incorrectly configured connection or unauthorised remote access can potentially create a route towards other parts of the network. The exact risk differs from vessel to vessel and depends on how systems and networks have been configured.

The first question should therefore not be: Which cybersecurity product do we need?

A more useful starting point is: Which systems are connected on board, how are they connected and which connections are necessary for the operation?

Without that overview, it is difficult to protect the vessel effectively.

Vessels often have a much longer operational lifetime than the IT equipment used in an office environment.

As a result, older and newer technology frequently operate side by side. A system may still perform its operational task perfectly well while the underlying software is no longer regularly updated or supported by the manufacturer.

Replacing such equipment is not always practical or necessary.

But older systems do require additional attention.

Can the system still be updated? Does it need an internet connection? Which other systems can communicate with it? Who has access? And can unusual behaviour around the system be detected?

The objective is not simply to replace everything that is old. It is to understand the risk and apply appropriate protection around systems that cannot easily be changed.

Remote access has clear operational advantages.

A supplier can diagnose a technical problem without immediately sending an engineer to the vessel. A service provider can perform maintenance from another location. The crew can receive support faster, reducing unnecessary downtime.

But remote access also creates a direct connection between the vessel and the outside world.

The important questions are therefore straightforward: who can connect, to which systems, under what conditions and for how long?

Access that was created temporarily can sometimes remain active longer than intended. Accounts may be shared between users. Credentials may not be changed regularly. In other cases, it may simply be unclear which external parties still have access to equipment on board.

Safe remote access requires control.

Access should be limited to what is necessary, users should be identifiable and connections should be monitored where possible. When external access is no longer required, it should be removed.

No vessel operates entirely independently.

Equipment manufacturers, maintenance companies, software providers, connectivity partners and other specialists all play a role in keeping the operation moving. Many of these organisations need digital access, exchange data or supply technology that becomes part of the vessel’s environment.

Cybersecurity therefore extends beyond the vessel itself.

A supplier with legitimate access can unintentionally introduce risk if its own environment is compromised. Software updates, laptops used during maintenance and remote service connections can all create dependencies.

This does not mean that external access should be avoided. Cooperation is essential in the maritime sector.

It does mean that access and responsibilities should be clear.

Who is allowed to connect? How is that access protected? What happens when an incident occurs? And who is responsible for taking action?

Cybersecurity becomes stronger when these questions are discussed before an incident happens.

Technology alone cannot protect an operation.

Crew members and employees ashore make decisions every day that influence cybersecurity. They connect devices, open emails, use passwords, work with suppliers and respond when something does not behave as expected.

Most of these actions are completely normal parts of the job.

That is exactly why cybersecurity measures need to fit the maritime practice. Procedures that are too complicated are difficult to maintain in daily operations.

Awareness should therefore be practical.

Crew members do not need to become cybersecurity specialists. They do need to know what deserves attention, what they should avoid and who to contact when something unusual happens.

The same applies ashore. Clear responsibilities and a practical incident response process can make the difference between noticing an issue early and discovering it only after the operation has already been affected.

Cybersecurity risks do not stop at the vessel’s network.

On board, the priority is maintaining a safe and reliable operation. This requires visibility into connected systems, controlled access and the ability to identify unusual behaviour.

From the shore, organisations need sufficient insight to support vessels without relying solely on the crew to identify technical cybersecurity issues. Continuous monitoring can help recognise deviations and determine when further investigation is necessary.

Across the chain, clear agreements with suppliers and partners become increasingly important. As vessels, ports, cargo owners, charterers and service providers exchange more data, cybersecurity becomes a shared responsibility.

This is also increasingly relevant in the context of NIS2 and wider supply-chain responsibilities. Being able to demonstrate how risks are identified, monitored and addressed is becoming an important part of digital resilience.

Read more about  NIS2 New Cybersecurity Act

For MDM, effective cybersecurity starts with understanding the maritime operation.

A vessel must remain operational. Systems cannot simply be disconnected because they present a potential risk, and cybersecurity measures should not unnecessarily interfere with the work of the crew.

That is why MDM combines protection on board with 24/7 monitoring from the shore.

With MDM-PROTECT, network activity on board can be monitored for behaviour that deviates from what is expected. This creates insight into the vessel’s digital environment and helps identify situations that require attention.

The objective is not to promise that incidents can never occur. Every connected environment carries risk.

The objective is to recognise relevant deviations, understand what is happening and support an appropriate response before a cybersecurity issue can unnecessarily disrupt the operation.

Because protecting a vessel is not only about technology. It is about keeping the vessel, its operation and the wider maritime chain moving safely.

Cybersecurity becomes manageable when risks are visible.

Understanding your IT and OT environment, controlling remote access, working closely with suppliers and preparing people for incidents are practical steps towards greater cyber resilience.

MDM helps inland shipping organisations protect and monitor their connected environments on board and from the shore.

Want to understand where the cybersecurity risks are within your fleet? Contact MDM to discuss how MDM-PROTECT can help you gain insight, protect your operation and strengthen your cyber resilience.