Threat Hunting and Security Analysis for Maritime Vessels

The growing reliance on digital technologies onboard vessels has significantly increased their attack surface. As a result, both IT and OT systems are now vulnerable to a range of cyberattacks. However, existing methods used to assess vulnerability and threats often rely on outdated threat or vulnerability information, limiting their effectiveness. Consequently, a more proactive approach to assessing the security of vessel systems is needed. Threat hunting offers a proactive way of gathering the latest threat and vulnerability data from operational maritime vessels, which can be used for comprehensive security assessments. However, there is a lack of systems specifically designed to perform both threat-hunting and security assessment operations. In this paper, we propose a threat-hunting and security assessment framework that collects and processes real-time data from vessels and conducts security analysis using a graphical security model designed for vessel systems. Our approach demonstrates how the collected information can be used to evaluate a ship’s security posture by simulating potential attack scenarios and understanding how an adversary might attempt to compromise the vessel’s network. It also provides a foundation for more informed, data-driven cybersecurity strategies for the unique systems found onboard maritime vessels.