# Bridging the Gap: Enhancing Maritime Vessel Cyber Resilience through Security Operation Centers
## 1 Introduction
### Vessel Connectivity Cyber Risks  
Improved connectivity has made it a key component of vital vessel functions such as navigation, which has become increasingly computer-aided. Modern vessels are today completely dependent on global navigation satellite systems (GNSS) for correct positioning, navigation, and timing, all complemented by interconnected sensors within what is known as an integrated bridge system. Figure 1, adapted from [13], highlights an overview of a modern-day integrated navigation system (INS). While the increased adoption of sophisticated communication networks has helped improve navigational situational awareness on the bridge, the downside is that these networks and systems were never designed with security in mind. They have been shown to be increasingly vulnerable to cyber-attacks which undermine the safety of the vessel  
Figure 1: Integrated Navigation System [13]. and its crew [14]. A closer examination both from a research perspective and real-life case examples shows that these concerns are indeed valid. The study by [15] evaluated the cyber posture of an INS on a roll-on/roll-off ship that was still operational. By using a widely deployed vulnerability scanner, the researchers were able to identify four critical vulnerabilities including an outdated version of the server message block (SMB) service, which was previously exploited by the destructive NotPetya ransomware attack impacting maritime operators such as Maersk [16]. A similar approach of scanning INS components was also utilized by [17]. By scanning the radar systems of two oil tankers, they identified a vulnerable SMB service. Research by [18] evaluated the cyber security risks of key network protocols utilized by maritime vessels. TCP/IPv6, CAN Bus, National Marine Electronics Association (NMEA) 0183, and Automatic Identification System (AIS) were all classified as being at a high risk of Denial of Service (DoS), spoofing, packet sniffing, and relay attacks. There has been research that has demonstrated how vulnerabilities inherent in the networking infrastructure can be exploited. Research conducted by [19] took advantage of the inbuilt weaknesses in the ASTERIX protocol used for radar data transmission to show how malware can be propagated in the INS. Ref. [20] demonstrated an attack concept exploiting the radar antenna to act as an open door for receiving malicious commands which are then propagated in the INS. One of the first recorded demonstrations of a Global Positioning System (GPS) spoofing event occurred in 2013 when researchers from the University of Texas caused a yacht to alter its course without the knowledge of the crew onboard [14]. Research by [21] demonstrated a successful case scenario of a GPS jamming attack that led to erroneous AIS position reporting on the radar. The study conducted by [22] successfully highlighted the weaknesses in the internal signaling of the INS by simulating a man-in-the-middle attack that intercepted and manipulated GPS coordinates. Real-life examples of GNSS spoofing events have also been recorded. In 2017, a ship off the Novorossiysk-Russia shore had its GPS show that it was inland near the Gelendzhik airport. It was later discovered that this problem had affected 20 other vessels in the area, and it was later attributed to a Russian GPS spoofing attack [23]. Around the port of Shanghai in 2018, there were cases of false signals that made it seem that ships were moving in ring patterns. The same phenomenon was also reported at Point Reyes in Northern California, USA where false signals made it seem that ships were moving in ring patterns. In 2019, a UK-flagged oil tanker, Stena Impero, and its crew were seized by the Iranian guard after having drifted into Iranian waters. This was later believed to have been caused by spoofing of the GPS signals. There was also another spoofing event around Elba Island in 2019, where several artificial AIS targets affected the navigation of ships around that area [24].