Perspectives on the Cybersecurity of the Integrated Navigation System

Abstract

As maritime operations become increasingly reliant on interconnected information technology (IT) and operational technology (OT) systems, ensuring cybersecurity on vessels has become more critical than ever. One of these systems is the Integrated Navigation System (INS), which assists the Officer of Watch (OOW) on the bridge in ensuring safe navigation. The INS comprises several components that may be susceptible to cyber attacks, hence it faces cyber risks that need to be mitigated. Cyber risks are understood differently, depending on perspective. In this paper, we determine the perspective that the research community has of cyber risk, focusing on the INS, and that of professionals representing the maritime industry, and analyze similarities and differences. To this end, we conduct a systematic literature review and interviews with maritime professionals. This study provides useful insights for researchers and professionals seeking to understand the cyber risks of the INS.

1. Introduction

The maritime ecosystem has been exposed to cyber attacks. To the best of our knowledge, currently, two cyber incident databases are available specifically for the maritime field. One of them is called the Maritime Cyber Attack Database (MCAD), consisting of 295 cyber incidents [7]. The other one is called the Advanced Dataset of Maritime Cyber Incidents Released for Literature (ADMIRAL) project [8], managed by the non-profit organization France Cyber Maritime [9]. This database lists cyber incidents from 1980 to 2024 in the maritime ecosystem [10]. According to ADMIRAL, as of 10 October 2024, the maritime industry had experienced 473 publicly disclosed cyber incidents [10]. These incidents include a variety of threats, including GNSS attacks, AIS attacks, data leaks, website compromises, and breaches of remote access systems [11].

In February 2017, for 10 hours, malicious actors successfully assumed complete control over the navigation system of an 8250 TEU container vessel while en route from Cyprus to Djibouti [12]. Two years later, in 2019, a tanker near the Naantali Port in Finland fell victim to ransomware [13]. In the same year, an AIS base station in Italy was exposed to an AIS ship-spoofing incident near Elba Island, revealing the creation of 3742 ghost ships [14]. In 2020, three ships experienced their administrative systems being infected by the ransomware Sodinokibi [13]. In the same year, an advanced cyber attack disrupted the public website and several online services of the International Maritime Organization (IMO) [15]. In 2021, cyber attacks targeting military vessels were observed, including AIS spoofing against HMS Defender [16] and GPS jamming against HNLMS Evertsen [16]. The increasing number of cyber incidents has led to rising cybersecurity concerns in the industry [19].

The perception of cyber risks and their mitigation measures is not uniform and depends on various factors, such as professional experience and domain-specific knowledge. Therefore, diversity between the perspectives of the academic and professional communities is frequently observed. The objective of this paper is to understand the perspectives of the research and professional communities on INS cybersecurity, particularly regarding threats, vulnerabilities, mitigation measures, and the practical effectiveness of these measures. The paper analyzes both perspectives and identifies similarities and differences by comparing them. Artificial intelligence writing assistants ProWritingAid [20] and Grammarly Pro [21] were used to enhance clarity and academic readability. This study unveiled that both communities have concerns about the cyber vulnerabilities of INS components, such as AIS, GNSS, and outdated operating systems of OT components. However, notable differences were identified between the mitigation measures applied. To the best of our knowledge, this is the first analysis of this kind.

2. Related Work

The Related Work section summarizes various academic and industrial publications about maritime cybersecurity. Ben Farah et al. [22] conducted an SLR for cybersecurity in the maritime industry, including smart ports and autonomous ships. Bolbot et al. [23] performed an SLR and bibliometric analysis of maritime cyber studies, reviewing 144 Scopus-indexed papers using the PRISMA methodology. Erbas et al. [24] conducted an SLR on cyber risk assessment and threat modeling for ships. Clavijo Mesa et al. [25] investigated the impacts of cyber attacks and mitigation measures for maritime supply chains. Dimakopoulou and Rantos [26] analyzed maritime cybersecurity from the perspective of the NIST Cybersecurity Framework (CSF) v2.0.

Scientific studies published by researchers provide theoretical insights and methodological contributions about maritime cybersecurity. On the other hand, reports published by renowned organizations offer a practical perspective on real-world challenges in the sector. Maritime Cyber Priority 2024/2025 [27], published by DNV, offers a global survey with 489 maritime professionals. Maritime Cyber Threat Overview 2023 [28], published by M-CERT, highlights the impact of state-sponsored cyber attacks. Annual Threat Assessment 2025 [29], published by NORMA Cyber, presents an analysis of the maritime cyber threat landscape. Our study presents a novel synthesis by comparing the perspectives of both scientists and maritime professionals on INS cybersecurity. To the best of our knowledge, this is the first work to explicitly contrast and integrate these two perspectives in the field of maritime cybersecurity.

3. Research Community Perspective

The perspective of the research community on potential cyber risks in the INS was identified through an SLR. The method described by Okoli and Schabram [31] was used to conduct the SLR, consisting of eight steps: identifying the purpose of the review, practical screening, drafting the protocol, searching the literature, quality appraisal, data extraction, synthesizing studies, and writing the review. The appropriate keywords "maritime", "ship", and "cybersecurity" with their synonyms were identified. A total of 4520 publications were identified in the initial stage. After screening and quality appraisal, 57 publications focusing on the cybersecurity of the INS and/or its components were selected. IEEE became the most prominent publisher with 20 publications, followed by Springer Link with 8, and MDPI and TransNav with 6 each. GNSS and AIS were the most frequently studied components, while RADAR and bridge network systems gained attention in recent years.

Regarding hardware, components onboard ships in service such as tankers, research vessels, and passenger ships may be used as test environments. However, finding a vessel in service could be difficult for research purposes. Accordingly, individual components such as AIS, GPS, RADAR, MFD, or ECDIS may be tested in a controlled environment. For software, vulnerability scanners such as Nessus Professional can detect vulnerabilities. Tools like hping3 can be utilized to test DoS attacks, and Scapy for MITM attack simulations. Software such as OpenCPN and Marine Traffic can help understand the effect of a potential attack. Wireshark can capture NMEA messages from the network. VMWare ESXi can create virtual machines simulating a ship's network environment.

4. Cyber Threats and Vulnerabilities

Several cyber threats and vulnerabilities of the INS have been analyzed in the literature. The AIS lacks any authentication mechanism for the transmitted data [75]. This weakness makes AIS vulnerable to software-based and RF-based threats, classified in three classes: spoofing, hijacking, and availability disruption [4]. Threats such as ship spoofing, AIS-SART spoofing, weather forecasting spoofing, AIS hijacking, and availability disruption threats (slot starvation, frequency hopping, and timing attack) have been reported [4]. The MMSI number could be forged and tampered with [77]. It is also possible to indicate fake vessels in AIS ship tracking services [4].

The ECDIS can represent the position of its own vessel by receiving data from an EPFS such as GNSS. A cyber risk assessment process for ECDIS is proposed in [35,43]. Malware may manipulate the ship position on the ECDIS [6]. Mission-specific malware introduced through the USB interface of ECDIS could manipulate rudder angle [79]. The ECDIS inherits vulnerabilities from middleware such as Apache Web Server [39,43]. The onboard network is vulnerable to person-on-the-side and man-in-the-middle attacks [61].

GNSS provides vessels with critical positioning, speed, and time information [80]. The signal strength of GNSS for civilian applications is approximately −160 dBW at sea level [80], making it inherently vulnerable to cyber threats. Consequently, GNSS receivers are susceptible to both jamming and spoofing attacks [5,40,45,48,51]. Spoofing attacks are generally considered more dangerous than jamming attacks due to their stealthy nature and detection challenges [83]. GNSS technology encompasses various regional systems including the U.S.'s GPS, Russia's GLONASS, China's BeiDou, and the EU's Galileo [84]. According to experimental data from northern Norway, the GLONASS G1 frequency band demonstrates greater resistance to jamming compared to the GPS L1 band [40].

The cyber risk assessment process and results for two RADAR sets are presented in [36]. Longo et al. [69] highlight critical cyber vulnerabilities in maritime RADAR systems by demonstrating the exploitation of unencrypted communication protocols such as NMEA and ASTERIX. These vulnerabilities allow attackers to inject false RADAR echoes or manipulate existing ones. Wolsing et al. [62] reveal similar vulnerabilities focusing on unprotected UDP transmissions in the Navico BR24 protocol.

Several systems including ECDIS, RADAR, and MFD are supported by various operating systems such as Microsoft Windows 7 Professional, Windows XP, Windows Embedded Standard 7, and Linux [35,36,52,85]. The diversity of operating systems increases the vulnerabilities and attack surface. Some operating systems are no longer supported by the vendor [35]. Moreover, even if supported, updates may not be timely installed by the ship operator. For instance, SMBv1 in the OS might not be up-to-date, so a marine system could be attacked by NotPetya ransomware [36].

5. Risk Mitigation Measures

Several encryption methods have been proposed to enhance AIS message security [46,65,75,90–92]. A digital certificate-based identity authentication scheme (IAS) is introduced by Su et al. [77]. Shyshkin [66] presents methods using message authentication codes (MACs) and digital watermarking. Silonosov and Henesey [93] propose attribute-based encryption (ABE) for AIS data confidentiality. AIS information reliability can be enhanced by correlating RADAR imagery with AIS data [87].

For GNSS spoofing attacks, the Nomoto model for steering dynamics and linear control theory tools is proposed in [94]. A PRN code construction method based on a chaotic-form logistic map is proposed in [95]. A set of mitigation algorithms against GNSS spoofing, multipath, and RFI are introduced in [49]. Integration of GNSS with inertial navigation facilitates position anomaly detection [96,97]. Machine learning techniques can detect GPS anomalies [41]. A low-cost GPS spoofing detection framework called MANA has been proposed [98].

It is crucial to secure communication protocols used within the INS such as NMEA and ASTERIX by implementing cryptographic protections [69]. Network-based anomaly detection tools can be utilized [103]. Intrusion detection systems such as Kitsune, SteadyTime, and Snort can be employed [104]. Updating operating systems and patching security vulnerabilities provides significant protection [36,37]. Lockdown software is used to restrict sensitive functions [36,59]. Several authentication techniques have been proposed to protect ship networks [70,110]. Physical network isolation is important as a proactive solution [37]. A software-defined network (SDN) has been proposed for more secure onboard networks [111].

6. Professional Community Perspective

The professional community perspective was established through interviews with maritime professionals. We contacted 20 different ship operators to gather information about their cybersecurity practices. We conducted online interviews with a total of 10 individuals, including 8 ship operators and 2 research fellows. The discussions focused on cybersecurity awareness of personnel onboard, technical and procedural measures implemented to mitigate cyber risks, and general observations regarding cybersecurity in the maritime sector. A semi-systematic interview approach was employed to explore the perspectives of professionals.

Ship Cybersecurity Officer (SCySO) and Company Cybersecurity Officer (CCySO) are the main cybersecurity roles adopted by the maritime industry. Chief mates, second officers, or third officers are generally assigned as SCySOs. A DPA in the ship operator is typically nominated as CCySO. Many shipping companies have identified training as a core factor in preventing cyber threats. Training can be delivered in person or through video training. Technical measures include installing antivirus and firewall software, using dedicated memory sticks for ENC updates, physically blocking USB and ethernet ports, and locking computer cases of OT systems. Procedural measures include establishing plans, policies, and risk assessments for cybersecurity.

7. Discussion

Although numerous articles discuss the potential cyber risks faced by the maritime industry, studies based on experimental results remain limited. There seems to be a stronger focus on the AIS and GNSS systems compared to other INS components. However, in recent years, research on the INS network and RADAR systems has also been increasing. By employing empirical methods, cyber vulnerabilities have been identified in the AIS, ECDIS, GNSS, RADAR, MFD, and INS networks. However, an INS is not limited to only these components—it consists of 25 different components. A cyber risk assessment of the INS revealed that 22 out of 25 of these components are subject to cyber risks [121].

From the professional community perspective, given that each vessel does not have continuous broadband internet access such as VSAT, operating systems and antivirus software are not updated regularly. OT components running on outdated operating systems such as Windows XP are still available onboard ships. Training is provided either by office staff or an officer onboard, but the quality and level of knowledge are questionable. Cybersecurity plans of five out of six ship operators were developed by copying information from IMO-recommended guidelines. Comparing and merging perspectives reveals that ship operators may not be able to implement many technical measures recommended in the literature due to unavailability of end products, need for third-party infrastructure, or requirements for changing performance standards.

8. Conclusions

This article looked at cyber risks to the INS from both scientific and professional perspectives. It provides a comprehensive analysis of the potential cyber risks and mitigation measures of the INS by performing the SLR methodology. Moreover, this study investigates cybersecurity practices of the maritime industry by interviewing maritime professionals. With the support of this combined approach, various recommendations in scientific papers were verified by industry practices. This study contributes to closing the gap between the literature and industry practices. It helps researchers recognize industry practices that have not yet been scientifically validated, and enables manufacturers to assess the practicality of proposed scientific solutions.

Cybersecurity is not only substantial for protecting ship systems but also supports sustainable development. Maritime cybersecurity efforts are linked to specific Sustainable Development Goals (SDGs) [143]. Maritime education and training (MET) institutions should urgently incorporate maritime cybersecurity courses into their educational curricula. Communication between scientists and professionals should be strengthened; according to our observations, the interaction between these two communities is quite weak. To bridge this gap, MET institutes and maritime associations should organize events to bring researchers and professionals together. Currently, several initiatives list maritime cyber incidents based on open sources [8,146]. A collaborative threat intelligence database for sharing incident details and potential mitigation measures could be established by renowned maritime stakeholders.