UK P&I Club and CyberOwl have identified seven common insecure behaviors that can expose shipboard systems to cyberattacks and operational disruptions.
The findings are presented in the Risk Focus: Vessel cyber security report, developed by UK P&I Club in collaboration with maritime cybersecurity specialist CyberOwl. The report examines key cyber threats, insecure behaviors and practical measures to strengthen onboard cybersecurity, emphasizing that effective cyber risk management depends on both technical safeguards and the actions of crew members, visitors and third-party service providers.
As shipping becomes increasingly connected and reliant on digital technologies, everyday activities such as opening email links, connecting USB devices or allowing remote access can expose both information technology (IT) and operational technology (OT) systems to cyber threats.
According to CyberOwl’s analysis, human factors were associated with 26% of vessel cyber incidents recorded in 2024, while more than 75% of these incidents required response actions involving crew members. To illustrate where these risks arise in practice, the report identifies seven recurring patterns of insecure behavior, described as the seven ‘deadly sins’, based on analysis of vessel cybersecurity incidents during 2023 and 2024.
The seven ‘deadly sins’ of insecure behavior
Payments to unvalidated parties: Making payments without verifying bank account information or requests to change payment details can expose shipping companies to fraud. The report recommends confirming suspicious requests through direct telephone communication, particularly when changes to supplier banking details are involved.
Insecure use of removable devices: Connecting USB drives, external hard drives or mobile phones to multiple systems without appropriate malware scanning can spread malicious software. The risk becomes particularly serious when devices are transferred between IT systems and safety-critical OT equipment, including ECDIS and GMDSS.
Insecure links: Opening suspicious links received through emails or messaging applications such as WhatsApp and WeChat can direct users to malicious websites. These websites may be designed to install malware without the user’s knowledge, potentially compromising onboard computers and connected systems.
Insecure network connections: Connecting personal or unauthorized devices to critical vessel networks without proper security controls can introduce malware or create opportunities for unauthorized remote access. The report also warns against enabling hotspots on vessel computers or connecting personal devices without following established security procedures.
Unauthorized remote access: Allowing unknown or unverified parties to connect remotely to shipboard systems can create significant vulnerabilities. Cybercriminals may impersonate equipment manufacturers or service providers to gain access, install malware, steal information or interfere with system operations. Leaving remote connections active after maintenance work has been completed creates additional exposure.
Risky software downloads: Downloading unapproved applications from untrusted sources can introduce malware or security vulnerabilities. CyberOwl identifies PDF editors, image-editing applications and computer games among the common risky downloads observed during 2023 and 2024. Even software downloaded to complete legitimate operational tasks can unintentionally compromise onboard systems.
Supply chain attacks: Cybersecurity risks can also arise through suppliers and third-party contractors. Allowing unverified connections, poorly controlled remote access or unscanned devices from visiting technicians can expose vessel systems to threats originating outside the shipping company. Compromised suppliers may also provide attackers with opportunities to access customer systems or obtain sensitive information for fraudulent purposes.
These findings demonstrate that cybersecurity threats do not necessarily begin with sophisticated attacks against vessel infrastructure.
Routine activities and inadequate verification procedures can also provide opportunities for malicious actors to compromise shipboard systems.
Crew awareness remains central to cyber resilience
The report emphasizes that shipowners and managers must establish cybersecurity controls that address both technical vulnerabilities and the human factors associated with daily vessel operations.
These include maintaining accurate inventories of onboard IT and OT assets, implementing network segmentation, controlling access to critical systems, monitoring suspicious activity and establishing effective incident response procedures.
However, technical safeguards alone cannot eliminate cyber risks. Crew members must understand which activities may expose vessel systems to threats and how to identify and report potential security breaches.
The guidance also highlights the importance of cooperation between onboard personnel and shore-based IT teams, particularly when unfamiliar software, removable devices or remote maintenance activities are involved.
For shipowners and operators, the findings reinforce the need to integrate cybersecurity awareness into routine onboard practices rather than treating it solely as a technical responsibility.
——————————————————-
Click Here For The Original Source.
