How Did They get Aboard my Ship?: Analysing Vessel Cyber Incidents Using the Cyber Kill Chain

The Global Maritime Transportation System (GMTS) is increasingly reliant on digitized and interconnected systems. This trend also applies to one of the most essential elements of the GMTS, vessels themselves. The Maritime Cyber Attack Database (MCAD) contains listings of maritime cyber incidents from public sources, including those involving vessels. Utilizing MCAD in this paper, we categorize and analyse these specific listings related to vessels. Vessels have complex networks of Information Technology (IT) and Operational Technology (OT). In this paper, we further categorize and systematically analyse selected cyber-attacks against vessels with the Lockheed Martin Cyber Kill Chain. This work also shows a significant rise in attacks against vessels since 2016. These case studies help industry more clearly understand the specific tactics and techniques used in cyber-attacks on vessels.