# Bridging the Gap: Enhancing Maritime Vessel Cyber Resilience through Security Operation Centers
## 4 Results
#### Cyber Onboarding  
The onboarding process is a critical step for any SOC. Moreso for an M-SOC because they are at any one time having multiple vessel types being monitored. An understanding that these are bound to have differences in their monitoring requirements is an important first step. \"Yes, there are different systems that you can find on board super yachts that you will not find on commercial ships and vice versa. But that is true for any type of vessel. Another thing is that in many cases they are not unified. So, company X could have 20 vessels, but each one could be completely different from the other. So not always there you will see a unified infrastructure or anything like that.\" (P4)  
However, while these differences make monitoring more challenging, it was also highlighted that it could benefit the domain by making propagating vessel cyber-attacks more difficult. \"We believe that an attack will first go to other sectors than the maritime sector. This is because, in the maritime sector, every vessel is unique, so it's more difficult to attack. An attacker would have to tailor-make everything, so I think that is part of the protection as well. It does not mean that we can continue that down that path. But currently, I think the maritime sector is more protected than a lot of other kinds of sectors.\" (P8)  
Connectivity challenges have for a long time been known to plague the maritime domain, particularly in the deep sea. This will be an even more pressing concern when a future with autonomous vessels is considered. It was therefore not a surprise when connectivity emerged as one of the key considerations during the cyber onboarding process. Additionally, not all respondents had managed to set up real-time monitoring due to connectivity challenges:  
\"The connectivity depends on how far they operate from a coast. Offshore supply can be either way. They can either have 4G or even be connected to a platform that has a wired connection, but if they're crossing an ocean, they do not have connectivity.\" (P7)  
\"Because of the current connectivity state of the vessels, we do not have the luxury to monitor our vessels 24/7. However, because this will be the case in the near future, we have started considering how to integrate some cybersecurity solutions with the SOC service to generate reports that will give us a picture of what is happening in our fleet.\" (P9)  
Figure 2: Thematic Map. For the M-SOC that had managed to set up real-time monitoring, there were still concerns about how much the network could sustain and if they had to prioritize only critical systems:  
\"I think for us we are very concerned on how much connectivity there is when we are setting up. For example, if they say they only have 256 KB bandwidth, then we have to prioritize which systems are more important. The servers might be more important than the client systems. So, we monitor those areas that we make a prioritization on.\" (P8)  
It was, however, highlighted that the implications of a stable connection would be an increased throughput which can be easily managed by the M-SOC if their triage process has been automated. \"It does not affect the work we do. It does affect the output because more connectivity means more data going through the system, more threats that could be detected, and more false positives that need to be detected and ignored. The main change is the rate of data.\" (P4)  
Additionally, our respondents highlighted that their monitoring approach presently involves focusing on systems that are already internet-facing. The rationale behind this is to avoid increasing the vessel threat attack surface:  
\"What we see is that we do not want to monitor things that are not connected to the Internet. So, if something is offline, it remains offline.