SIEM & Network VAPT for Vessels in the Maritime Industry

Client Overview

Industry: Maritime & Shipping

Product: Fleet of 18 vessels with onboard IT, OT and crew networks

Tech stack: Onboard SIEM appliances, VSAT communication, NMEA 0183/2000 network buses, ECDIS workstations, crew internet network, shoreside fleet management

The client operates a fleet of 18 vessels with critical onboard OT systems (navigation, propulsion, cargo handling) increasingly connected to IT networks for crew internet, telemetry and shoreside management. IMO 2021 cyber compliance was mandatory.

Challenge

Three factors drove the urgency of this engagement:

• No vessel-side visibility. The client had no insight into vessel network traffic, OT/IT segmentation effectiveness or threat detection at sea or in port
• IMO 2021 compliance deadline. Safety management certificate renewals required cyber risk management evidence within 6 months
• Insurance premium pressure. Marine insurance underwriters had begun pricing in cyber risk with documented mitigation evidence reducing premiums

Our Approach

Codesecure delivered a structured engagement combining automated coverage with deep manual testing focused on the specific risk areas for this client.

Scope of Testing

The engagement covered the following primary areas:

• Network VAPT of representative vessel covering IT, OT and crew networks
• Deployed lightweight SIEM appliances on each vessel with shoreside log forwarding
• Maritime-specific detection use cases (NMEA traffic anomalies, ECDIS access, satcom abuse)
• OT/IT segmentation review using IEC 62443 framework
• Penetration testing of shoreside fleet management systems
• IMO 2021 cyber security risk assessment aligned to BIMCO guidelines
• Trained vessel IT officers on incident response with satellite-link communication procedures

Reporting & Walkthrough

Executive summary delivered alongside a technical report containing reproducible PoC steps, CVSS v3.1 severity scoring and developer-actionable remediation guidance. Live walkthrough with the client team covered every critical finding with reproduction and recommended fix path.

Results

Critical Findings

• VSAT management interfaces exposed from crew networks on 8 of 18 vessels
• Active threat actor reconnaissance traffic detected on 3 vessels during the engagement
• OT/IT segmentation gaps allowing engine room access from crew internet networks on 5 vessels
• Default credentials on bridge equipment management interfaces on multiple vessels

High & Medium Severity

Insufficient logging on shoreside fleet management systems, weak passwords on ship management workstations, missing patches on vessel OT systems, unencrypted satcom configuration backups, no incident response runbook for cyber events at sea, USB ports unrestricted on workstations.

Before vs. After

Key Lessons

Conclusion

Maritime cybersecurity is a distinct discipline combining IT, OT and operational technology security with regulatory frameworks (IMO 2021, IACS UR E26/E27, TMSA) and the practical challenges of vessels operating at sea. SIEM + Network VAPT together deliver the visibility and assurance that maritime operators need.

For Indian shipping enterprises, port authorities and offshore operators, maritime cybersecurity is now operationally and contractually required. Codesecure delivers maritime-specialized cybersecurity engagements with deep sector expertise, vessel-aware SIEM design and shoreside SOC integration.