## 3 Security Challenges in Industrial Control Systems  
ICSs in the Maritime Logistics Industry encompass SCADA, DCSs, and PLCs. They are found in the dockside container cranes, straddle-carriers and autonomous vehicles supporting stevedoring procedures and transporting containers in a commercial port with GPS and optical recognition port operations [51]. In addition, they are used in the bulk liquid and dry cargo handling systems that load and unload grain, crude oil, diesel, toxic chemicals and LNG. ICSs are also found aboard the support vessels such as pilot boats, tugboats, fireboats and oil spill response vessels, which ensure the safe movement of vessels and their cargo while entering and leaving a commercial port and monitor their safety while berthed at passenger and cargo terminals. Most ICSs began as proprietary, stand-alone systems that were separated from the rest of the world and isolated from most external threats. However, more recent SCADA systems have moved to more interoperability and open standards for cost efficiency and integration into management IT systems. For example, communication is now common over Ethernet TCP-IP including more standardized control protocols and applications. Open standards for SCADA systems are sources for adversaries to gain knowledge regarding the SCADA network topology [52]. Hence, SCADA systems are subject to external attacks and IT-based vulnerabilities. Contemporary SCADA technologies used in the maritime logistics sector depend on position and monitoring (e.g., IoT devices like cameras sending information to IT assets, navigation given by satellite terminals) and timing [51]. Maritime logistics, as other industries, faces cybersecurity issues due to the lack of management awareness, incomplete knowledge of attacks and SCADA asset vulnerabilities, focusing more on physical security measures neglecting to arrange cybersecurity drills to train SCADA operators [53; 54]. Summarizing, there is a strong need to enhance the cyber-threat awareness of SCADA systems within the MLoSC [53; 54]. As SCADA control systems become increasingly complex, distributed and interdependent with other sectors [51] the number of potential attack vectors also increases, including via the internet, enterprise network, and direct connections to the control networks and field devices. Some of the most common types of attack vectors against SCADA are Backdoors and holes in the network perimeter; Attacks on field devices; Database attacks; Communications hijacking and man-in-the-middle attacks; Cinderella attack on time provision and synchronization. The types of attacks on SCADA systems fall into five main categories [54]: (i) On the Communication stack attacks can occur for example on the network layer via a diagnostic server); (ii) on the UDP port attacks can occur on the transport layer, such as a SYN flood attack saturating resources by sending TCP connection requests faster than the machine can process them; (iii) at application layer intrusions can happen as a lack of security control to many of the SCADA protocols (e.g., DNS forgery and packet replay are common); (iv) on the hardware attacks may occur, for example, when adversaries manage to obtain unauthenticated remote access to devices and change data set points that may cause the devices to fail at low threshold or an alarm not to go off. Lack of authentication for administrative tasks on the hardware means that an attacker can reprogram the logic or values and affect the functional behavior of the device; (v) on the software a cyber-attack can occur because SCADA systems use a variety of software to provide functionality from traditional IT applications to bespoke embedded device applications and more accumulated memory fragmentation, which can lead to programs stalling. Structured Query Language (SQL) is widely used to store sensor information in historians and other databases, thus, if not designed properly at the application level the systems are susceptible to SQL injection attacks.