CYBERGUARD:

Safeguarding
your business inthe Digital AgeSophisticated cybersecurity solutions to support
your vessel digitalisation

Broadband connectivity at sea andthe increasing use of digital systems
for everything from navigation
to container inspection has led toreduced operational cost and improved
efficiency in the shipping industry,
but it has also created a new type of
threat – cyber risk. While increasing
communication provisions haveenabled seafarers to use an average ofthree devices onboard, insecure private
devices may provide a vulnerability inthe vessel’s IT system.
Whether in regard to the protectionof data, potential damage and loss,
liability, compliance, or the impact
on insurance, companies need to beaware and well covered as they seek
to balance digital opportunity withnew cyber threats.

A holistic approach to security isneeded that enables response to newand ever-evolving risks. To support
your IMO2021 compliance and help
protect you from potential businessdisruption caused by a cyber attack,Marlink’s CyberGuard security portfolio
supports your business’ digitalisationand enables you to focus on yourcore business.

CyberGuard
Solutions Portfolio Our Framework

Key Facts• Vessels not compliant with the IMO
2021 Safety Management System (SMS)
regulation risk detention by port control

Marlink’s vision is an automated andstandardised architecture converging
IT and Operational Technology (OT).
Our communication experts are eager
to understand your requirements andconsult on the ideal blend of services.

• The most common motivation of cyberattacks is financial gain (29%), using
ransomware, card theft and illicit transfers• The second most frequent objective is data
theft (espionage, intellectual property)

Protecting a Maritime IT & OT network
against cyber threats requires a
combination of proven tools andprocesses. This avoids you being ina position of having to pay hackers
a ransom, pay a fine to national
bodies or suffering from a severe
loss of reputation. To secure theentire network, an assessment has
to be conducted at each layer and acontinuous cyber security process
followed.
Our solutions support the functional
requirements highlighted in the IMO2021
regulation regarding cybersecurity.
The IMO has indicated that maritime
companies must be able to demonstratethat they follow the NIST cyber security
framework of Identify, Protect, Detect,
Respond and Recover.

Our comprehensive
portfolio of cyber security
solutions means whatever
your business, we canprovide the best-fit,
most suited option foryour requirements• Vessel operators have reported a 400%
increase in cyber attacks since thecoronavirus pandemic began• On average, advanced attackers are on a
network for almost three months before
being detected• Business disruption costs of a network
outage caused by a cyber attack are likely
to exceed $50k per vessel per day
Cyber risk management should: IDENTIFY key stakeholders’ responsibilities, identify
the systems, assets, data and capabilities, which if disrupted, could pose risks tothe ship’s operations and safety. Establish technology such as a firewall andanti-virus and procedures to PROTECT against a cyber incident and ensure operational
continuity. Combine more advanced network-based hardware and software solutions
and expertise to DETECT vulnerabilities. All while implementing procedures to
RESPOND to and RECOVER from cyber security incidents, using a contingency planthat is assessed and re-evaluated regularly, as well as by giving regular training.

• Most hull insurances exclude consequencesof cyber attacks
Sources: Allianz Safety Shipping Review 2020, FireEye M-Trends 2020

• 24/7 Network protection and support• IT Infrastructure and software management• Uncover advanced cyber-attacks explicitly
targeting your company• Advanced, satellite-optimised end-point
Protection• Cyber Competence Expertise• Smart, integrated, remote communications
management

Maintain full control andensure IT and OT security
Marlink’s CyberGuard security solutions portfolio
effectively protects your vessel from cyber risk

Your first layer of defence: Sealink Network Security
Your cyber security begins with the
network layer, and Marlink makes
continual, extensive efforts to ensure
our core network is secure by design:• Marlink secures your onboard traffic
by providing private IP ranges toonboard networks.
• By standard, Marlink uses Port
Address Translation (PAT) at theinternet gateway, preventing traffic
originated from the Internet fromreaching the vessel.
• Marlink equipment is managed
via out-of-band networks thatare not connected to the Internet,
meaning an attacker could not 		take control of Marlink network 		
equipment. All equipment 		management access is authenticatedand encrypted.

• Marlink has a dedicated security 		organisation that supervises 		security policies, logs and alarms.

Your Cyber Security partner for end-to-end protection
CONNECTIVITY• Marlink can apply generic or
dedicated security rules in its
firewalls. Firewalls keep up to datemalware signatures and content
lists from multiple sources.

• Marlink conducts periodic 		
penetration testing provided by athird party security organisation.

• On top, our CyberGuard suiteof cyber security solutions 		
offer an additional layer of security,from scanning network traffic
to automating anti virus updates.

• To avoid illegitimate bandwidth use,
normal internet access via Marlink’s
VSAT network does not allow 		
shore-to-ship traffic to be initiated.
If a public IP is given, the customer
is asked for a list of authorised IPs
for access control.

On Land

At SeaGlobal Private Network• Each customer’s corporate network
traffic is kept private and segregatedwith tunnels and/or dedicated VRFs.
This forms a private network 		
dedicated to each customer.

VPN Interconnect• Point-to-point and Point to Multipoint VPN• IP Sec, OpenVPN, AES 256 bit encryption• Enabling efficient remote maintenance• Fully secured terrestrial infrastructure• The right connectivity to meet your needs• In-house teleports and link management• Satellite coverage redundancy• Private IP addressing

XChange• Onboard firewall & DNS Management• Network and user management• Secure communication & remote access• Cloud-based file management based on
secured private infrastructure

APPLIANCESSkyFile Anti Virus

Data Manager

SECURITY LAYERS

Addressing Cyber Risk - Marlink’s CyberGuard Solutions Portfolio
SCOPE

CYBERGUARD SOLUTION

Data Encryption

VPN Interconnect
Secure end-to-end transmission

Fleet-wide

Data Manager
Shore based gateway

Onboard Network

XChange
Centralised communication platform

Onboard Computers

SkyFile Anti Virus
Essential antivirus layer onboard

Fleet-wide

Cyber Detection
Network threat monitoring service

Onboard IT

KeepUp@SEA
Comprehesive IT management

IDENTIFY••PROTECT•••••DETECTRESPONDRECOVER

Cyber Detection

•
•

•
•
•
•
•

• Satellite-optimised signature
distribution• Anti-ransomware and anti-exploit• Mail attachment protection• Internet firewalling• Web filtering• Application blocking• Threat and Intrusion Detection• Cyber Dashboard• SOC Surveillance• Incident Investigation and Consulting

DATA
CENTER

SOFTWARE
SUITE

IDENTIFYPROTECTDETECT•XRESPONDRECOVER

KeepUp@SEA• Fleet-wide software standardisationand configuration• Onboard Asset Monitoring• Automated Back-ups and IT Resilience• Remote Incident Remediation

Scope: Data Encryption

Scope: Fleet-wide

Scope: Onboard Network

VPN Interconnect

Data Manager

XChange

PROTECTPROTECT

Marlink Virtual Private Network (VPN) solutions offer
encrypted communication, protecting from sniffing attacks
during data transmission over public internet. Marlink
provides a variety of interconnect and secured on demand
access solutions such as:• On Demand VPN to establish a secure remote connection
to equipment or computers on-board, typically used fordebugging, maintenance and configuration• Permanent VPN to secure regular transport data
traffic to a corporate network

Key Benefits:• Flexible security protocols: flexible integration withmultiple options (IPsec, OpenVPN)• Remote maintenance: essential and inexpensive
tool for managing onboard networks (XChange
Universal Remote Access)• Universal Connectivity: supports Sealink VSAT,
Fleet Xpress, FleetBroadband, Iridium OpenPort andCertus and other broadband connections like Marlink´s
4G services

X

RESPOND

Data Manager provides a variety of versatile features tomake managing data traffic more efficient, including web
filtering, enhanced firewall and more.
Managed via a secure and simple online portal, the solution
combines complex and powerful IP management capabilities
with administrative simplicity for ease of use and securecommunications.

Key Benefits:• Security: full security package to protect yourterminals from internet attacks• Flexibility: customisable features like firewall,
web filtering• Universal Connectivity: supports Sealink VSAT,
Fleet Xpress, FleetBroadband, Iridium OpenPort
and Certus• Simplicity: no installation required, all standard webbrowsers supported• Concealed Network: hides your vessel from public
Internet and potential cyber attackers• Saves time and costs: no need for additional hardware orintervention on board

IDENTIFYPROTECTXRESPOND

Marlink’s integrated communication management platform,
XChange has been expertly designed to empower yourconnectivity and manage all satellite networks (VSAT and
MSS). Among its many features, within the context of IT, OT
and Network Security, XChange supports the following:
Segregated LAN Management - The network is split into
multiple local networks (LANs) typically separating businessfrom crew communication and avoiding infection caused byprivate equipment.
User Access Management - XChange acts as a gateway
permitting or declining access to applications depending
on preset policies and access rules - managing who is able
to communicate, through which terminal, at what time andfor how long.
Multi-Stage Firewall - XChange includes 2 firewall
stages, which filter IP-based data communication basedon ports, IP protocols and addresses:• Level 1: Terminal level Firewall - block certain
traffic types per terminal (VSAT, MSS)
• Level 2: User-group Firewall - determines
traffic type per specific users or groups of users• Level 3: Combined with Data Manager provides a third layer of firewall protection at shore

Example Scenarios
ThreatSolutionA third-party intercepts
confidential data sent overthe public internet

Marlink provides several
satellite optimised
end-to-end as well as
terrestrial VPN Solutions
routing traffic over secure
private network lines

A crew member visits
undesired / dangerous
websites

Data Manager offers alarge number of categories
simplifying accessmanagement to Websites

XChange Cloud - Avoiding exposure to risks by the public
internet, XChange Cloud is a Secure Content Delivery
infrastructure from Shore to Vessel. This service
streamlines and enhances business, logistical and vessel
operations by providing a reliable, easy to manage platform
to share and automatically synchronise important files ofany size or type throughout a fleet.

Key Benefits:• Secure: multi-stage firewalls guard what trafficis routed to and from the vessel• Access Control: set group policies on access rules,
time frames and time limits• Split networks: separate and prioritise businesscritical communication over crew data traffic, thereby
reducing cyber threats to operations• Full Remote Management: administer XChange
remotely or locally• DMZ Content Delivery: transfer and synchronise
files using XChange Cloud

Example Scenarios
ThreatSolution

A malware infection
spreads from the crewwelfare to the operational
business network

XChange splits the physicalnetwork into multiple
LANs ensuring businessremains unaffected

A crew member connects
an unauthorised device
onboard, which may
potentially be infectedby viruses

XChange can limit accessto known pre-entered MAC
addresses of approved
devices only

An onboard device isaccessed remotely via apublic, static IP exposing
the device to cyberattackers

Instead of using a public
IP, URA uses secureauthentication and an
encrypted connection toremotely access devices

Scope: Onboard Computers

Scope: Fleet-wide

SkyFile Anti Virus

Cyber Detection

PROTECTDETECTXRESPOND

SkyFile® Anti Virus is Marlink’s complete anti-virus
software package, providing remote onboard PCs withprotection against viruses and other external threats.
Fully automatic anti-virus updates, notification and version
verification ensure you keep your computers and LAN safe
even while at sea.
Augmented specifically for satcom connectivity, SkyFile®
Anti Virus combats a wide range of threats such as viruses,
Trojan horses and other malicious software (malware).
As part of SkyFile® Anti-Virus Premium, ransomware andexploit mitigation enables even more advanced endpoint
protection. Eliminate malware, prevent exploit vulnerabilities
and get a deep clean on any potentially hidden malware
using our premium options.
SkyFile® Anti Virus works seamlessly with one of Marlink’s
most popular solutions - SkyFile® Mail to deliver daily
malware signature updates. With more than 40,000 mariners
utilising the service daily, SkyFile® Mail provides reliable andcost-effective email, fax and SMS messaging. Viruses andspam are eliminated based on typical properties (blocked
HELO, grey listing, etc.) reducing email threats - the mostgrowing method of cyber intrusion.

DETECT

Key Benefits:• Security: Reliable detection using Sophos-based engine• Ransomware protection: detects and blocks even brandnew ransomware threats• Cost efficient: several compressed low data volumeanti-virus updates per day• Universal Connectivity: Supports Sealink VSAT,
Fleet Xpress, FleetBroadband, Iridium OpenPort andCertusExample Scenarios
ThreatSolution

A crew member connects a
malware-infected USB stickto the bridge PC

SkyFile Anti Virus detects
and blocks viruses andother malware such as
Trojan horses or spyware
using a Sophos-based virus
detection engine

New ransomware which
is not yet detected by theanti-virus signatures is
executed on a computer
Fraudulent spam andphishing emails arereceived onboard which
direct crew members
to websites stealing
confidential information

SkyFile Anti Virus
Premium uses behaviouralmonitoring to detect andblock even new, previously
unknown ransomware
SkyFile Mail scans mailattachments for infections
and moves spam toquarantine before delivery
to the vesselX

RESPOND

Marlink’s Cyber Detection service monitors yourcommunications for any threats that may be putting
the confidentiality and continuity of your business
operations at risk.
Threat Monitoring: the service monitors all network
traffic around the clock and provides an overview of
threats affecting your vessels through an intuitive,
web-based dashboard. Each threat description gives
practical counter-measure suggestions to remedy theincident, while notifications on critical threats may bereceived by email.

Key Benefits:• Threat detection: uncovers advanced cyber-attacks
targeting your company• Maritime SOC Monitoring: dedicated maritime cybersurveillance expertise• Actionable reporting: clear alert description andsuggested counter-measures• IT and OT conformity: detects abusive usage onboard
circumventing safeguards• Scalable: subscription model, no investment required

The Marlink Security Operations Centre (SOC)
is operated by highly-skilled cyber security experts.
Being focused exclusively on maritime satellite
communications enables our agents to understandand track how attackers operate and impact
shipping companies.

Example Scenarios
ThreatSolutionFull visibility: Cyber Detection can uncover a multitudeof threats and is continually evolved to keep up withthe latest threat landscape, including:A targeted attack exploits aunique weakness and stays
undetected for a long time

Marlink’s Security
Operations Center (SOC)is specialised in hunting
sophisticated 0-day attacks

A crew member finds a
method to access a blocked
application or website
bypassing all protection
solutions

In tune with your IT andOT Policies, the Cyber
Dashboard reports any
breach even if the onboard
protection is inactive

A device has been infectedby malware and is wasting
bandwidth, slowing down
communication onboard

Marlink’s Cyber Detection
Service reports on
infected devices in the
Cyber Dashboard• Malicious applications• Abusive usage• Intrusion attempts• Confirmed intrusions• Social engineering, etc.
Versatile Package Options: Choose your ideal
service package in accordance with your preferences
and in-house resources:• Entry Package - full Cyber Dashboard access, with withsuggested standard counter-measures following thedetection of threats.
• Business Package - full Cyber Dashboard access with
our Maritime SOC performing managed threat validation,
contextual countermeasure suggestions as well as being
your point of contact for any questions and investigations.

Scope: Onboard IT

KeepUp@SEA
IDENTIFYPROTECTXRESPOND

KeepUp@Sea is a unique IT operational platform andsolution to standardise, simplify and automate your vessel
IT environment, permitting central remote management,
IT resilience, fast migration, and effective operation of IT
services across the fleet.
The solution combines expert advice and proactive support,with practical tools for system design, installation, logistics,
and operational services. The solution can either be
adopted to be supported by your internal IT team, or as afully outsourced service, and comprises the following key
modules:
KeepUp@SEA Dashboard: presents fleet-wide health status
for critical components on board – verifying that e.g. backup
is performed successfully and antivirus protection andapplication versions are up to date.
KeepUp@SEA Appstore: helps crew locate businessapplications and trigger automated install, update, repair of
single application(s) or full reinstallation of a computer if/
when required.
KeepUp@SEA BackUp: enables proactive, vessel-optimised
protection of business-critical data through automatedsynchronisation, and complete data recovery in case of anincident.
KeepUp@SEA Disaster Recovery: enables full restorationof entire vessel server to either the same hardware, adedicated spare server or a designated low computer
without requiring a costly and complex dual server design.
Additionally, KeepUp@Sea embeds incident prevention
barriers, such as blocking USB storage devices, revoking
local admin rights, access control management, and so on;
reducing the probability of unwanted or critical situations,and reducing the consequences and damage caused by acyber incident.
New! KeepUp@Sea Monitor is an entry level package available
to meet the needs of customers seeking only basic hardware
and software monitoring. Features include a dashboard
overview, KPI reporting and software installation status.

RESOLVE

Key Benefits:• Full configuration control: centrally managed; trackchanges, upgrades and the operational status of vessels’ IT• IT resilience & recovery: proactive safeguarding of all
vulnerable data and automated recovery if needed• IT Standardisation: support in achieving harmonised
computer and server configuration across the fleet• Reduce onboard workload: routine tasks are automatedand no specialised onboard IT competence is required• Proactive support: from vessel IT experts with thecapabilities to promptly resolve challenges

Example Scenarios
ThreatSolution

Outdated software contains
security vulnerabilities
which allow attackers toenter the network

KeepUp@Sea monitors
software on all PCs
onboard. Updates
to mitigate known
vulnerabilities can swiftly
be distributed to the fleet

A crew member has modified
a PC’s configuration
for a leisure application
without approval of the IT
department

KeepUp@Sea will present
installation activity via themonitoring tool and support
automatic removal ofunapproved applications

A malware has modified
the IT system and/or
deleted important businessdocuments

KeepUp@Sea supports
automated Windows OS &applications repair, restoringfull endpoint functionality
via simple, user-friendly
procedures. KeepUp@Sea
Backup saves all businesscritical data to external
device(s) according toagreed data retention policy

Creating a secure culture
Today’s shift towards increasing interconnectedness
at sea is continuing to enable significant efficiency gains
and new capabilities for maritime operations. Running inparallel to this trend is an increase in vulnerability tocyber-attacks within the maritime industry.
Although historically not considered part of the criticalinfrastructure sector, considering that now more than
90% of global trade is carried by sea, maritime has
increasingly become a cyber target, as proven byrecent high-profile, damaging cases.
To remain safe and competitive, ship operators should aim
to employ not just a short-term incident resolution, but ablend of tools and complementary solutions to cover all
aspects of the Protect, Detect and Resolve process.
Marlink’s more than 70 years’ experience in the maritime
sector has been harnessed into designing sophisticated, but
straightforward and easy to roll-out solutions to precisely
fit this purpose.
The Human Element
In addition to technical cyber security solutions, it isessential to create awareness among staff through regulartraining and a clearly defined IT system usage policy.
Whilst the technology and solutions onboard are essential
elements to addressing cyber security, only by combining
training, technology, regular reviews of business processes
and implementation of the correct policies can a shipping
company hope to reduce its cyber risk level.

Protecting Your Businessin the Digital Age• Comprehensive solutions portfolio• Focus on ongoing protection, detection and threat
resolution• Efficient, quick deployment technology• Remote management from shore• Optimisation for satellite environments• Customer consultants located in regional offices
worldwide• Support available 24/7/365• Regional, cultural and technical understanding

Are you IMO2021 Compliant?
Applicable to commercial ships with over 500 gross
tonnage, the IMO resolution (MSC 428, 98) confirmed all
shipping companies need to have cyber security in theirsafety management system. Flag states are encouraged tocheck this in the first annual audit after January 2021.
Our solutions support all the functional elements of the
IMO2021 regulation regarding cyber security.
Contact us for a free consultation.

Marlink is a true partner, who goes Above and Beyond to help
you run your remote operations in ever smarter, more profitable
and sustainable ways and give you the competitive edge.

1000+ employees
in 23 countries

Unique solutions portfolio

Global customer support

IT & OT and Cyber services

365/24 service

Strong partnerships

Managed services

with all satellite network
operators and hardware partners

Future-readynetwork of networks

fully operated forour customers

24/7/365

leading edge multi-bandconnectivity

for secure andresilient connectivity

Global service network
1250+ in-country service points

Marlink Service Desk
EMEA: +33 (0)1 70 48 98 98
Americas: +1 (310) 616 5594 | +1 855 769 39 59 (toll free)
Asia Pacific: +65 64 29 83 11
Email: servicedesk@marlink.com
Web: www.marlink.com
CG 01 20

7000+ VSAT