Cyber–Physical Security Assessment for Maritime Vessels: Study on Drillship DP System Using American Petroleum Institute Security Risk Analysis and Bow-Tie Analysis

Abstract

The maritime industry's increasing integration of IT/OT systems into vessel operations has significantly elevated its exposure to cyber–physical threats, making the development of effective cyber risk management strategies a necessity. This paper provides an outlook of the current landscape of cyber security threats and vulnerabilities for the maritime sector and vessels. An outline of the relevant governmental and industry directives, standards, and guidelines for cyber security in maritime vessels is given. Considering maritime vessels as critical elements of the maritime critical infrastructure sector, a number of relevant cyber–physical security assessment methods are presented. Bridging cyber–physical security, process safety, and security, API SRA (American Petroleum Institute Security Risk Analysis) and BTA (Bow-Tie Analysis) are presented as the most applicable cyber–physical security assessment methods for complex maritime vessels, such as an offshore oil and gas drillship. The scenario of a cyber-attack on the Dynamic Positioning (DP) system of a drillship is presented with the use of API SRA and BTA. The difficulties in the implementation of NIST CSF v2.0 and IACS UR E26 and UR E27 in the maritime sector are also discussed. The need for intensified research on and the formulation of bespoke cyber security measures to mitigate the evolving cyber threats within the maritime domain is highlighted. The need for the allocation of training and resources for the reinforcement of the capacity of a maritime vessel's crew in the mitigation of cyber threats and safe maritime operations is emphasized.

1. Introduction

In the contemporary maritime industry, the integration of digital systems that control vessel operations has significantly increased the susceptibility of ships to cyber threats. International Maritime Organization (IMO) Resolution MSC.428(98) underscores the importance of heightened cyber risk awareness and the incorporation of cyber risk management into Safety Management Systems (SMSs), as stipulated by the International Safety Management (ISM) Code. This resolution matters for all maritime stakeholders, obliging them to manage cyber risks alongside traditional safety risks, while cyber threats keep evolving in sophistication and frequency across both IT and OT domains.

Maritime vessels are maritime industrial assets comprising industrial control systems (ICSs), IT and OT systems, equipment and components enabling maritime operations at a technical level. Given their complexity and interconnectivity, these vessels need assessment methods addressing both their maritime dimension and their industrial critical-infrastructure characteristics. Despite abundant critical-infrastructure security assessment frameworks, few have been field-applied to specialized vessels such as offshore drillships, which combine maritime with upstream oil and gas operations through complex interconnected IT/OT systems.

This paper bridges that gap by presenting a cyber–physical security assessment of an offshore drillship, focusing on the Dynamic Positioning (DP) system as a high-value target. The API 780 Security Risk Analysis (SRA) standard assesses cyber vulnerabilities, target attractiveness and security posture, while Bow-Tie Analysis (BTA) — a process safety management tool — evaluates and visualizes the security barriers deployed before and after a potential breach. The work closes by discussing NIST CSF v2.0 and IACS UR E26/UR E27 implementation difficulties and by recommending training and resources to strengthen crew capacity.

2. Cyber Security in the Maritime Domain

The maritime industry is increasingly interconnected and reliant on digital systems and industrial control systems (ICSs) [19], making it a prime target for cyber threats. The European Union Agency for Cybersecurity (ENISA) [20, 21] reported a significant shift in the maritime sector's cyber risk profile, with rising cybersecurity incidents at ports and on vessels. The United States Coast Guard (USCG) [22] and ENISA [20] reported growth in diverse threats — including advanced persistent threats, phishing attacks and ransomware cases affecting the maritime transportation sector, shipping companies and assets — with major consequences for global trade and security. Politically and financially motivated attacks on vessel and company IT/OT systems also expose state actors' involvement [21], creating a composite, continually evolving threat landscape where covert military operations blend with cyber-criminal operations.

BIMCO [23] categorized maritime cyber threats as shown in Table 1: untargeted attacks — malware (trojans, ransomware, spyware, viruses, worms), water holing exploiting crew internet use at sea, random vulnerability scanning, typosquatting — and targeted attacks — social engineering, brute force password guessing, credential stuffing, DoS/DDoS, spear phishing, and supply chain attacks via equipment or software delivered to the vessel. From known maritime and critical-sector incidents, adversary classes emerge: cybercriminals, state adversaries, insiders (disgruntled or careless), cyber terrorists, and cyber activists [23, 24].

These escalating threats demand stakeholder vigilance and robust measures accounting for assets and operational/technical characteristics, acknowledging the maritime transportation sector's overlap with other critical infrastructure sectors. Current maritime cybersecurity initiatives — standards, regulations, guidelines and directives from industry and governmental organizations — were extensively reviewed in prior literature [25–29]; this paper identifies the most prominent in Table 2, derived via a review using the IHS Markit database and governmental webpages. They include: NIST standards (Special Publications 800-30, 800-37, 800-82 and CSF 2.0), ASTM F3286-17 and F3449-20, ISO/IEC 27001 [30], IEC-62443-4-2 [31], IEC 62443-3-3 [32], ISO/IEC 21827 [33], ISO/IEC 15408-1 [34], ISO/IEC 18045 [35] and ISO/IEC 27032 [36]; and industry bodies: IMO Resolution MSC.428(98) and guidance MSC-FAL.1/Circ.3, the BIMCO Guidelines on Cyber Security Onboard Ships, and IACS UR E26 and E27.

Yet most of these directives remain generic documents recommending improved practices for IT/OT security posture without specifying systems, processes or components deemed operationally or technically critical for specialized vessels. Implementation of existing maritime cybersecurity directives, policies and standards also needs reinforcement by industry stakeholders to sustain compliance and posture. Documented incidents — from Meland et al.'s retrospective analysis of maritime cyber incidents [1] to recent systematic surveys [2, 3], GPS spoofing cases [4, 5], naval sensor targeting mechanisms [6], dual-fuel engine scenarios [7], documented Coast Guard cases [8], tanker attacks near Fujairah [9, 10], Red Sea cyber operations [11, 12], integrated navigational system threats [13], port-and-ship cyber–physical attacks [14], hardware-in-the-loop environments [15], navigation-system control-perspective issues [16], warnings that ships are wide open to cyber attack [17, 18], and national assessments [19–22] — show the threat surface is real and growing.

3. Cyber–Physical Security Assessment in the Maritime Domain

Cyber–physical systems are generally defined as those combining IT (Information Technology), OT (Operational Technology) and human operations [25]. A security assessment is generally the evaluation of an asset's characteristics through the security parameters of threat, risk and vulnerabilities, while a cyber–physical security assessment evaluates the cybersecurity risks of OT systems and components plus connected IT systems as they relate to process safety and security. Such assessment is especially relevant to industrial and critical infrastructure assets given their complex multidisciplinary technical and operational parameters. With ships as elements of the maritime transportation sector, they must be seen as maritime industrial assets comprising ICSs and OT/IT systems, requiring methodologies relevant both to ships' maritime dimension and their industrial critical-infrastructure characteristics.

Based on a literature review across ScienceDirect, Google Scholar, Wiley, IEEE Xplore, ProQuest, ResearchGate, Academia.edu and common web search engines — with keyword combinations such as "maritime security", "oil and gas + maritime + cyber security", "offshore maritime security", "CIP and cyber security + oil and gas", "CIP + maritime + oil and gas" and "offshore oil and gas security" — Table 3 presents relevant qualitative and quantitative cyber–physical security assessment methods for critical infrastructure, including: commercial supply chain risk management [48], Fuzzy RAMCAP [49], all-hazards catastrophe frameworks [50–52], attack-modelling methods [53], generic risk-based criticality analysis [54], LIMOD Bayesian networks [55], PCS security for SCADA in CIP [56], bilevel/trilevel attacker–defender models [57, 58], matrix-based vulnerability methodologies [59, 60], energy criticality assessment [61], game-theoretic deterrence quantification [62], the CYSM collaborative system [63], model-based risk/vulnerability analysis MBRA/MBVA [64–67], attack-strength-degradation models [68], CRASH qualitative ship risk analysis [69], CYRA-MS adapted from CPHA to IEC 62433 parameters [46], quantitative CRAMMTS adapted from ISRAM [70], ship-OT risk-matrix methods [71], MV-HARM graphical models [72], port-and-ship ecosystem assessment [73], SVAPP barrier methodology [74], Cyber PHA, and others.

Most of these methods are used in "laboratory-" or "classroom-" based environments to present technical features, feasibility and capabilities, and do not adequately tackle field validation and industry implementation under technical and resource constraints. By comparison, the API 780 Security Risk Analysis (SRA) was found widely recognized and used in the oil and gas and maritime industry [25, 26, 91], providing detailed analysis of vessels, identified cyber vulnerabilities and proposed countermeasures while accounting for target attractiveness. The Bow-Tie Analysis (BTA) process safety method effectively assesses cybersecurity barriers deployed before and after a potential breach scenario, with visual presentation and detailed analysis of all threat consequences and incidents. The API SRA plus BTA combination was therefore selected as the most applicable assessment approach for complex vessels such as an offshore drillship.

4. Cyber–Physical Security Assessment for an Offshore Drillship

The examined cyber–physical security scenario is a cyber breach incident in the Dynamic Positioning system of an offshore drillship, selected after reviewing other potential vessel targets and publications on such breach possibilities [93–99]. This drillship is a self-propelled floating offshore drilling unit with a ship hull capable of drilling exploratory wells in deep remote waters [100], combining industrial equipment and processes supported by sophisticated complex IT/OT systems for upstream (oil and gas exploratory) and maritime operations. The DP system lets a floating vessel hold position over a location by varying propulsion power along the hull without conventional mooring or anchoring; propulsion power is directed by telemetry signals from sensors including seafloor beacons, satellite information (GPS, GNSS, GLONASS), wind sensors, gyro compasses, motion and vertical reference units, hydro-acoustic sensors, or taut-wire angular movement [100]. DP systems are categorized (DPS 0, DPS 1, DPS2, DPS3) per IMO Guidelines MSC.1/Circ.1580 [101] and MSC/Circ.645 [102] with different station-keeping, reliability and redundancy capacities. The analysis aims to: identify asset systems and locations vulnerable to cyber breach; validate target attractiveness and vulnerabilities for the drillship's DP system; apply API SRA to assess vulnerabilities, attractiveness and posture through established barriers; apply BTA to visualize and assess pre- and post-event barriers; and validate the integrated SRA–BTA use for proactive and reactive protection analysis.

The analysis accounts for maritime and industrial asset features and engineering/operational parameters, using the vessel's technical design drawings made available to the authors [104] plus an author-created DP system and IT network diagram showing logical connectivity between the vessel server, IT equipment and DP components (Figure 2). The selected DP system is DPS 2 with three bridge DP workstations and one portable unit (Figure 2). Validating API SRA meant following the API STD 780 five-step process: in Step 01, asset classification — identifying drillship cyber components, interdependencies, existing safeguards (internal/external), human-life/environment/business-continuity consequences, and criticality graded on worst-case consequences — was carried out through macroscopic evaluation of the hazardous areas' classification drawing (Figure 3) derived from IEC 60079-10-1 engineering analysis, identifying cyber-critical areas and assets (Table 4) across (a) industrial (oil and gas) process, (b) maritime process, and (c) IT systems — including engine control rooms, transformer rooms, rudders, pump rooms, VDR, SATCOM/TELECOM, DP system and more — then severity-ranked on casualties, environment, replacement, business and reputation consequences. Assessing the identified assets, locations, systems and breach scenarios validated and selected the DP system for deeper analysis: interfering with or incapacitating the DP system during well drilling can cause loss of station keeping and possibly propulsion and power, disrupting or halting drilling operations entirely.

In Step 02, adversaries were identified and threats ranked: cybercriminals and state adversaries targeting the drillship were both ranked high (4–5 on a 1–5 scale) — a credible threat based on capability and intent, frequently recurring against the asset or similar assets with very high attack frequency over asset life — while the insider threat actor was ranked medium: a possible threat with currently no specific verified threat, yet highly probable given the drillship's network interconnectivity and past insider-led incidents. For target attractiveness, the drillship's DP system holds potentially high interest for external actors (cybercriminals and state adversaries) with the highest preference value, given the onboard locations' and systems' vulnerabilities (Table 4) and the detrimental effects of a process safety incident from a cyber–physical event. Step 03 (vulnerability assessment) identified three breach scenarios: (1) external attack on DP systems via OT-external networks, remote software/firmware updates, or GPS/GLONASS interference, losing sea-keeping capability; (2) a similar state-adversary attack via propulsion systems' external communications; (3) a crew member accessing the drillship network and intentionally or unintentionally planting malware via portable USB, infecting PC stations then gradually other network systems, disrupting drilling and maritime operations with system failures. Proposed countermeasures include: stronger crew and DP operator security vetting and performance monitoring; physical separation of engine, propulsion and DP control systems; IT/OT, HMI and DP workstation firmware/software upgrades; firewalls and antivirus for all systems; onboard IT/OT experts; USB port access monitoring and control; upgraded engine-room and DP operator training; IT/OT failure emergency protocols; control/monitoring redundancy; secure remote monitoring, control and remediation; reinforced preventive-check SOPs; alternate propulsion/DP HMIs; event and alarm monitoring; performance data verification; network segmentation with multiple servers; multiple position reference systems; common-mode failure assertion across GPS systems; and regular motion/vertical reference calibration.

After vulnerability assessment, Step 04 (risk evaluation) assessed conditional likelihood of each breach scenario, assigned initial risk and prioritized: external cybercriminal and state-adversary attacks were ranked high risk and likelihood, while the insider-led breach was medium risk with high likelihood — attack success likelihood computed as a function of consequence and probability/frequency with an API STD 780 risk-ranking matrix, prioritized per countermeasure selection and technical, organizational and financial resource availability and effectiveness. Finally, Step 05 (risk treatment) evaluated and recommended countermeasures, re-calculated attack likelihood and consequence severity, computed residual risks and ranked proposed countermeasures — with Step 03 countermeasures remaining valid for vulnerability and residual-risk reduction, their selective use depending on available resources and technical feasibility per corporate management and technical stakeholders.

The breach scenarios — malware contamination and DP interference by external (cybercriminals and state adversaries) and internal (crew) actors — rest on the SRA performed and the DP/network diagram (Figure 2), with the combined Bow-Tie Analysis in Figure 4. Identified preventive (pre-event) barriers are: crew and DP operator security vetting and performance monitoring; IT/OT, HMI and DP system software and firmware; physical separation (segregation) of engine, propulsion and DP control systems; firewalls and antivirus for all critical systems; USB port usage monitoring across IT/OT; upgraded engine-room and DP operator training; preventive-check SOPs; network and server segmentation; onboard IT/OT expert team; multiple DP position reference systems; and motion/vertical reference calibration. Insider-threat mitigation (vetting and monitoring) deserves emphasis against disgruntled-employee sabotage; USB monitoring, control or blockage eliminates intentional or unintentional malware transfer; training and emergency procedures raise cyber awareness and hygiene; monitoring critical propulsion/DP parameters with intervention on excessive deviations strongly mitigates the scenarios; and antivirus/firewalls would eliminate malware installation — subject to technical and operational feasibility given onboard IT/OT type, age and software/firmware. Post-event mitigation barriers include: engine/propulsion/DP control and monitoring redundancy; remote IT/OT monitoring, control and remediation; alternate propulsion/DP HMIs; event and alarm monitoring and management; propulsion/DP performance data verification; onboard IT/OT expert team; environmental impact responses; and emergency management protocols.

5. Conclusions

The evolving threat landscape indicates the necessity of increasing or reinforcing the maritime transportation sector's cybersecurity posture and operational resilience, achievable only through adequate resource allocation by involved industry stakeholders and corporate entities. Reviewing available governmental and industry directives and standards (Table 2) showed most cover the subject but mainly through guidelines protecting or reinforcing existing IT/OT infrastructure, remaining generic documents recommending improved practices for IT/OT security posture without specifying systems, processes or components deemed operationally or technically critical for specialized vessels such as the selected drillship. Implementation of existing maritime cybersecurity directives, policies and standards also needs industry reinforcement to sustain compliance and posture.

The credibility of the drillship-network cyber breach scenario leading to remote DP incapacitation was validated through the API SRA and BTA cyber–physical security assessment. API SRA proved valuable for assessing maritime vessels' cyber–physical threats, vulnerabilities and target attractiveness as elements of the maritime transportation and oil and gas critical infrastructure sectors. Similarly, BTA proved useful for visualizing the threat scenario's event path, highlighting pre- and post-event stages and deployed preventive and mitigative barriers. The combined API SRA–BTA use validated the selected breach scenarios by confirming preventive and mitigative countermeasures before and after the drillship DP cybersecurity breach. Human factors — vessel crew members — play the most crucial role in cybersecurity directive compliance, posture maintenance and breach emergency procedures, balancing maritime operations, cyber hygiene and vessel-system usage; adequate training and resources must therefore be allocated to reinforce their cyber threat mitigation and safe operations capacity.

6. Discussion

Implementing the API SRA and BTA methods assumes use of a drillship's technical drawings, yet only a small number of the vessel's system drawings were made available to the authors for confidentiality reasons. Similarly, the authors' network and DP diagram is a typical configuration, partly based on publicly available data, so it may not capture all technical parameters or system architectures of existing DP and IT/OT network diagrams of maritime vessels. Industry or governmental maritime cybersecurity standards, directives, guidelines or policies may have been omitted during writing, as may academic publications on maritime cyber–physical security — unintentionally, since the subject extends beyond the authors' available resources and some standards or publications may have released after submission.

Regarding the latest NIST CSF v2.0 release, it holds significant implications for maritime OT professionals. While NIST CSF v2.0 provides comprehensive cyber risk management guidelines, its maritime application reveals a gap — particularly for Operational Technology (OT) cybersecurity: these systems, crucial for controlling physical operations on vessels and ports, are closely connected to the maritime supply chain, and their disruption carries major repercussions. A published study [105] revealed critical gaps in maritime industry implementation of NIST CSF v2.0, finding it not fully utilized for maritime cybersecurity, and stressing the urgent need for a maritime-adapted version of this framework that could significantly improve sector resilience. There is also a notable lack of research on maritime supply chain cybersecurity — a vital area tied to shipboard OT systems — underscoring the need for intensified research across all maritime activities. Moreover, NIST CSF v2.0 application does not account for engineering approaches to physical security management from OT/IT cyber threats in industrial and general critical infrastructure sectors [76], leading to ineffective cyber–physical security implementation for such assets.

The same applies to IACS Unified Requirements E26 (cyber resilience of ships) and E27 (cyber resilience of onboard systems and equipment), which face maritime implementation difficulties given their generic nature and recent application to newbuilds, plus the need to align them with specialized vessels' engineering and operational characteristics. Together these gaps confirm that generic frameworks alone are insufficient, and the maritime sector needs bespoke cybersecurity measures and intensified research — technical, regulatory and human — against evolving threats, prioritizing crew training and resource allocation to strengthen vessels' cyber–physical resilience.