## 1 Introduction
Attacks on the MLoSC may cause not only disruption of its services but also tremendous damage to the maritime operations and furthermore to the economies, societies, and environment, threatening the safety, security and stability within the EU and beyond. For example, an illegal intrusion on the ICS (e.g., supervisory control, SCADA installations) hosted in ports or maritime transport companies may lead to the disruption of loading/unloading services or harm critical mechanical devices (e.g., container cranes, safety and mechanical systems that operate locks and dams), or even worse, cause human casualties, loss of cargo and serious vessel damages. Another example is an attack on a container terminal management system causing malfunctions in the intermodal container services involving maritime, rail and truck transportation. Cyber-attacks (e.g., inserting a malware) in the ports' SCADA systems may generate fuel spills and affect water quality; attacks in the Port Community Systems (PCS) may turn LNG tankers into floating bombs; physical attacks (e.g., bombing) in a dry bulk storage area of coal products may create and carry dust by wind to tourist terminals or nearby residences. Due to these threats, there is an urgent, pressing challenge for MLoSCs security officers and operators to protect their interconnected CIs', such as SCADA systems (i.e., telemetry systems, pipelines monitoring system, data collectors, lift stations and gantry crane crowbars) in the new digital maritime era. Existing risk management policies in EU Ports are using their own disparate methodologies which hurdles the comparison of risk assessment results among the Member States and greatens the appearance of cross-border multi-risks across the MLoSC [7]. In addition, the literature review [7; 8] raises the challenge to update and combine security standards, such as NIST800-37 [9],ISO27001 [10], ISO27005 [10] and ISO28001 [11]. Furthermore, there is a compelling need for more targeted Risk Assessment (RA) approaches dealing with the distributed and interconnected nature of the dynamic, ICT-based MLoSC environments. The current study aims to present a novel evidence-based risk assessment methodology and illustrate the utilization of its generated sophisticated RA system, which has been developed under the EU H2020 Research Project \"MITIGATE\" [12]. The proposed methodology addresses the specificities and particularities of MLoSC cyber-assets, such as composite SCADA-based infrastructures and evaluates their evolving risk landscape by identifying assets interdependencies regarding the associated threats and cascading effects. To illustrate the level of disruption and damage that can cause a potential sophisticated cyber-attack to the MLoSC performance and underscore the necessity of protecting complex maritime logistics infrastructures, such as SCADA systems, we present three real-life SCADA cyber-attack scenarios on critical services of the MLoSC. Furthermore, to demonstrate how cybersecurity risks of SCADA installations pertaining the MLoSC can be captured, assessed and evaluated, we implement the MITIGATE effective, collaborative, standards-based security assessment services on a relevant SCADA supply chain scenario. To this purpose, all threats arising from the global supply chain will be considered, including those related to port CIs interdependencies and associated cascading effects. Section 2 presents related works. In Section 3 security challenges on Industrial Control Systems (ICS) are addressed. Section 4 describes the MITIGATE evidence-driven risk assessment methodology and analyze its security assessment services. Section 5 presents SCADA real-life cyber-attack scenarios on maritime logistics critical services. Section 6 refers to the utilization of the MITIGATE system security assessment services on SCADA systems.