# Bridging the Gap: Enhancing Maritime Vessel Cyber Resilience through Security Operation Centers
## 5 Discussion
### Connectivity and Domain Knowledge  
Effective M-SOC operations in any critical infrastructure domain are highly dependent on having good visibility into all the assets. A 2022 SOC performance report highlighted a lack of visibility as the biggest factor contributing to the ineffectiveness of SOCs [71]. While connectivity is a major contributor to having good visibility of all the assets that are planned for monitoring, its criticality is magnified when monitoring offshore assets as compared to onshore assets. High bandwidth connectivity is almost always a guarantee for most onshore locations. The same, however, cannot be said for offshore locations. For a long time, offshore locations, particularly in the deep sea, have been characterized by high initial set-up costs, low bandwidth even for the paid-for service, high propagation delays, and often unsteady connection with frequent link breakages. This is the environment that M-SOCs have had to deal with, particularly when vessel monitoring is considered. These concerns were not lost on our respondents, some of whom highlighted that they were yet to operationalize real-time monitoring due to bandwidth limitations. The degree of vessel connectivity was also one of the concerns that they had to factor in during the onboarding process so that they could establish the service offering they could provide to their customers. Closely related to this discussion was the need to prioritize critical systems on board if the bandwidth could not support monitoring all systems. Incident prioritization as a critical SOC process is not a new concept. Due to the high volume of alerts often seen in the SOC, prioritization has been suggested as one of the ways that can help analysts effectively handle this sea of data. For example, a study by the Naval Research Laboratory defined some prioritization parameters which included priority queuing, the host importance, incident criticality, asset criticality, and connectivity between hosts [72]. Strategy 5 in MITRE's 11 strategies of a world-class SOC report talks about the need to prioritize the incident response process [73]. While M-SOC analysts would stand to benefit from prioritizing alerts due to the potentially large volume of incoming data, the type of prioritization strategy of most concern given the current bandwidth limitations would be determining the critical systems on the vessel and focusing monitoring on those. This is, however, not a simple task as all systems could potentially be considered critical for the safe operation of the vessel. One of the maritime cyber security guidelines that M-SOCs can use as a guide in determining critical systems onboard the vessel is the Bureau Veritas rules on cyber security for the classification of marine units (NR 659) [30]. These guidelines have established a criticality assessment whose function is to group IT and OT equipment into three levels of criticality, namely harmless, significant, and critical. The criticality assessment has multiple inputs, among them being the system connectivity, which refers to its interconnectedness to other systems onboard the vessel. These guidelines are an example of maritime-specific attempts at classifying the critical systems onboard the vessel. Once connectivity has been established and monitoring has begun, there emerges another challenge of determining which of the alerts are true positives and those that are false positives. The use of contextual information has been proposed as one of the efficient ways of dealing with this challenge [74] with the same also being highlighted by our respondents. Within the M-SOC context, geographical information emerged as the most prevalent type of contextual information used by analysts to help determine whether an alert was a true positive or a false positive. As was highlighted in the literature review, there have been previous incidences of vessels experiencing GPS and AIS spoofing attacks by being near geopolitically sensitive navigational areas [23].