# Bridging the Gap: Enhancing Maritime Vessel Cyber Resilience through Security Operation Centers
## 2 Background  
### Maritime SOC Adoption  
Security Operation Centers (SOCs) are an integral part of an organization's security incident response process, and their effectiveness is dependent upon their visibility into enterprise networks and systems, access to actionable threat intelligence, forensic and analytic capabilities [33]. Their implementation is usually tied to the need to meet business requirements, regulatory requirements, or both. The adoption of M-SOCs by vessel operators has been done to satisfy both business and regulatory requirements. From a business perspective, the increasing incidences of cyber-attacks targeting the maritime domain are a cause for concern. Vessels only make money when they are sailing and so the possibility of a cyber-attack crippling vessel operations would be detrimental to the bottom line. From a regulatory perspective, the IMO cyber security regulation [26; 27] calls for the timely detection of cyber anomalies by domain stakeholders. M-SOCs are therefore well-positioned to satisfy both needs, hence their increasing adoption. When it comes to vessel cyber-resilience, M-SOCs aim to monitor both the onboard Information Technology (IT) and Operational Technology (OT) systems in real time for any cyber anomalies. However, their relatively recent adoption means that the body of research looking into them has only just begun to emerge. Research by [34] proposed four essential blocks for fully capable M-SOCs. The first block defined was the Ship Shore Manager (SSM) whose function was to ensure that all data collected onboard was properly received at the shoreside within the specified bandwidth limits. The Central Processor, which was the second defined block, helped to filter, normalize, and transform all the metadata alerts and logs being received from the ship. The third block, Data Store, was envisioned as a big data engine, while the Bandwidth Manager, the fourth block, was to help monitor the bandwidth configuration for various ships. With the increased threat attack surface largely acknowledged, one emerging concern is the alarming shortage of qualified cyber security personnel both onboard vessels and shoreside capable of handling not only Information Technology (IT) but also Operational Technology (OT) cyber security [10; 35; 36]. To compound this problem further, there are currently no formal cyber security training guidelines in the Standards of Training, Certification, and Watchkeeping (STCW) for Seafarers [37]. With the aforementioned cyber skills shortages in the maritime domain, it comes as no surprise that a popular M-SOC research theme has been enhancing M-SOC analysts' skills, with one study recommending the application of the NIST National Initiative for Cybersecurity Education (NICE) framework [38] to define skills, knowledge, and training objectives of an M-SOC operator [39]. Research by [40] suggested the use of cyber ranges to provide M-SOC analyst training scenarios tailor-made for the maritime domain. While SOC implementations exist in other critical infrastructure domains, the maritime domain has some unique characteristics that would influence the effective operation of M-SOCs. Poor connectivity at sea meant that for a long time the best defense a vessel had was isolation. This meant that not enough effort was put into designing cybersecure systems. When coupled with the long operational lifespan of vessels, and the cost-conscious nature of the domain [41], we now have a situation where the bulk of the vessels sailing today are heavily dependent on legacy equipment, particularly OT systems. This is a problem for SOCs as a recent SANS report [42] highlighted that the technical integration of legacy systems with modern IT systems was the biggest challenge organizations faced. M-SOCs therefore have to be aware that their visibility into vessel systems and the subsequent effectiveness of their monitoring can be impeded by this technical integration challenge.