# Bridging the Gap: Enhancing Maritime Vessel Cyber Resilience through Security Operation Centers
## 4 Results
#### Cyber Onboarding
We do not want to monitor it, so instead we just prioritize what you are going to connect to the rest of the world.\" (P7)  
Crucially for operational technology (OT) systems onboard the vessel, which are increasingly coming online, a stable connection is always preferred for efficient monitoring:  
\"So, for IT, I do not think it's that much of a problem because if the vessel is offline, you cannot hack it. The problem comes with OT because you want to have constant monitoring and when you lose the connection, you do not know what's going on. You want to have equipment on board the vessel that can monitor it still and then pass the alert when the link is up again.\" (P8)  
Vessel differences from a connectivity perspective were also apparent in the way they were set up to maximize bandwidth usage. Superyachts were mentioned frequently as one of the vessel types that have significantly higher connectedness compared to most other vessel types:  
\"The loads can be different because usually, super yachts are more connected like bandwidth is used much higher rates over there.\" (P4)  
\"Well, from our point of view, it's very different because super yachts have a lot of gadgets and new technologies like IPTVs, so they have great connectivity. They have huge bandwidth of vsat and whatever they need.\" (P6)  
However, what has also been seen is that the setup of the IT systems is usually largely similar even across different vessel types. This could probably point to the OT setup being the differentiating factor. \"But right now, we are monitoring a few passenger vessels: medium and long-range ferries, and a lot of offshore support vessels. Their IT onboard is often built up very similarly such as e-mail, end-users, etc.\" (P7)  
When it comes to the implications of having a more connected domain, there was a consensus that it will certainly result in more attacks but there was also confidence in the ability to handle them:\"So basically, yes as regards the connectivity enhancements in the near future, there will be of course more cyber-attacks occurring in vessel digital infrastructure, but I believe there are solutions that can support the cyber security part of the operation of the vessels.\" (P3)  
Another perspective that emerged from the discussions was how crucial context plays a role during their monitoring activities and in understanding the alerts that they were seeing on the dashboard:  
\"So, the system is context aware. We understood early on that the difference between a ship and an office, shockingly enough, is that it's moving, but not only that but it has several operations states. So, for example, when the ship is in the port, usually the activity is very high because that is where most work is being done. And when the vessel is sailing the activity is a lot less.\" (P4)  
\"In our system specifically, have several anomaly detection mechanisms on several level layers and context is part of the information fed. So, for example, where is the ship at and other contextual information depending on how we connect.\" (P4)  
\"In many aspects, you need to know what's going on in the vessel itself. Again, another example is if the ship is in the port, you could see an indication of unwanted activity. But that could be just the consequences of the maintenance because some guy is connecting something.\" (P8)  
\"The context is key to rapidly understand if we have a false positive or a true positive.\" (P5)  
Multiple crucial perspectives emerged during the discussion. With regard to connectivity, low bandwidth concerns meant that prioritizing critical systems was something that warranted further consideration by the M-SOCs. Additionally, it was highlighted by one respondent that they only monitored systems that were already internet-facing to keep the threat attack surface to a minimum. Finally, context awareness was critical during the monitoring process, with geographical location emerging as one of the most utilized sources of contextual data.