Systematic Cyber Threat Modeling for Maritime Operations: Attack Trees for Shipboard Systems

Abstract

The increasing reliance on digital and automated systems in the maritime industry has introduced significant cybersecurity risks to ship operations. While prior research has examined cyber risk management, systematic modeling of attack scenarios remains limited. This study addresses this gap by employing attack trees to systematically analyze potential cyberattack pathways against modern ships. Drawing insights from the literature and interviews with 10 experts, this research identifies key vulnerabilities in navigation, operational, and communication systems. The study outlines 20 attack scenarios across three primary objectives: crashing, capsizing, and immobilizing a ship. Expert validation emphasizes the real-world feasibility of these threats, with cyberattack scenarios involving crashing and immobilization deemed the most plausible, while capsizing was considered unlikely due to robust ship designs. The findings highlight the importance of strengthening network security, implementing redundancy measures, and enhancing crew training to mitigate cyber risks. This research presents a systematic threat modeling framework that supports effective risk assessment and cybersecurity strategy development, offering a valuable contribution to the advancement of maritime cybersecurity practices.

I. Introduction

The maritime transportation sector plays a vital role in the global economy, facilitating over 80% of global trade, as estimated by the United Nations [1]. This sector encompasses ships, ports, operating companies, and all infrastructure necessary for transporting goods and passengers via waterways. Given its critical importance, disruptions can lead to substantial financial losses and social ramifications. The 2017 Maersk cyberattack, for instance, resulted in damages amounting to nearly 300 million USD [2], demonstrating the far-reaching consequences of cyber incidents. Beyond financial impacts, disruptions in maritime operations can have severe humanitarian consequences, particularly in regions where ships serve as the primary means of connectivity.

Despite the increasing integration of Information Technology (IT) and Operational Technology (OT) in the maritime sector, cybersecurity adoption has lagged behind compared to other industries. As Erbas et al. [3] indicate, the interconnection and automation of ship subsystems introduce new cybersecurity threats, necessitating stronger cybersecurity frameworks. Onishchenko et al. [4] emphasize that most modern ships lack dedicated cybersecurity specialists, structured incident response mechanisms, and robust encryption protocols, leaving them highly susceptible to sophisticated cyberattacks. The lifecycle of ships, typically spanning 25–30 years, inherently slows the implementation of new technological advancements and security best practices [5]. The International Maritime Organization (IMO) adopted a resolution requiring cyber risks to be incorporated into safety management systems by 2021 [6], and the International Association of Classification Societies (IACS) introduced requirements for cyber resilience of ships and on-board systems and equipment, which took effect for new ships on 1 January 2024 [7-9].

Unlike IT systems, which focus on data processing, communication, and administrative functions, OT systems control and monitor physical processes essential to ship operations, including navigation, propulsion, and power management. The integration of IT and OT has improved efficiency but has also introduced new cybersecurity vulnerabilities, as OT systems, originally designed for reliability and safety, often lack robust security mechanisms found in modern IT networks. The lack of systematic methodologies for identifying, modeling, and validating maritime cyber threats further exacerbates this challenge. To mitigate these risks, structured threat modeling approaches are necessary to account for real-world attack scenarios and their potential consequences. This study aims to answer the following research question: What are the possible attack scenarios against a ship?

To systematically explore maritime cyber threats, this study employs attack trees, a structured threat modeling methodology widely used in cybersecurity analysis. An attack tree is a hierarchical diagram that systematically represents potential cyberattack scenarios, with the main objective at the root and various attack paths branching out to show different ways an attacker could achieve that objective [22, 26]. This study builds upon a comprehensive literature review to extract and analyze cyberattack scenarios in maritime operations, then synthesizes insights from expert interviews to construct attack trees representing realistic cyber threats. A total of 10 experts participated in structured interviews, providing diverse insights on attack feasibility, system vulnerabilities, and real-world operational challenges. The remainder of this paper is organized as follows: Section 2 provides background on maritime systems and relevant literature, Section 3 presents the methodology, Section 4 presents the generated attack trees, Section 5 validates these scenarios with expert feedback, and Section 6 concludes.

II. Background: Prior Work and Ship Systems

Cyber risk management in the maritime domain has received increasing attention, yet no work has utilized attack trees to systematically represent attack paths to ships. Awan and Al Ghamdi [10] conducted an early review of 59 historical incidents involving ship OT, particularly the integrated bridge system. Similarly, Tam and Jones [11] introduced the Maritime Cyber-Risk Assessment (MaCRA) framework, a cyber risk assessment approach tailored to operational risks in advanced maritime systems. These works contributed foundational knowledge but are limited in scope, as they do not systematically model attack scenarios or validate them with industry experts.

More recent studies explored cyber risk management methodologies: Sahay et al. [12] compared STPA-Sec, STRIDE, and CORAS applied to CyberShip systems; Tatar et al. [13] proposed the survey-driven CRAMMTS risk analysis method; Soner et al. [14] conducted risk sensitivity analysis of AIS, one of the most vulnerable ship systems [15]; Tatar and Gheorghe [16] provided a risk-based perspective; and Dimakopoulou and Rantos [17] used the NIST Cybersecurity Framework to review maritime vulnerabilities. Systematic literature reviews examined cyber risk perception [18], supply-chain attack impacts such as DDoS attacks and malware [19], key challenges and future directions [20], and ship systems and vulnerabilities [21]. Threat modeling studies for industrial control systems [22, 23], human factors among deck officers [24], and legal frameworks [25] added further perspectives. A systematic approach using attack trees to map out potential attack paths and validate them with expert input remains absent in the literature.

Attack graphs identify attack paths within a target system [26], but they are limited to predefined vulnerabilities or network access weaknesses, require detailed target-specific information such as OS and protocol vulnerabilities, and generalize poorly to other systems. STRIDE, developed by Microsoft [27], starts with a data flow diagram (DFD) and elicits threats per component, but it lacks notation for detailed attack steps and operational data and does not specify dependencies among threats. Attack trees instead provide free-form nodes that integrate detailed operational information [22], allow tracing dependencies from any leaf to the root, and align with frameworks such as the MITRE ATT&CK Framework for Industrial Control Systems.

Navigation systems are critical for safe routing and integrate several interconnected technologies. ECDIS serves as the primary navigation tool, mandated by the IMO for larger vessels since 2009, merging input from AIS [29], GPS [29], radar [29], gyroscopes [30], and weather stations [31]. However, chart updates via USB memory sticks expose ECDIS to malware [32], and research demonstrated that IEC61162-450-based ECDIS is susceptible to replay, injection, and modification attacks [33]. AIS is essential for collision avoidance but vulnerable to spoofing and data manipulation [34], while GPS systems are vulnerable to jamming and spoofing that can disrupt navigation [35].

OT systems form the backbone of physical operations: the Power Management System (PMS) oversees generation and distribution, where cyberattacks could cause blackouts or propulsion loss [20]; thrusters and steering receive wheel input, with Electronic Control Unit (ECU) vulnerabilities compromising handling [36]; the Integrated Automation System (IAS) centralizes sensor input and manages alarms [37]; autopilots rely on ECDIS and GPS inputs and can be manipulated via MITRE ATT&CK techniques [38]; and the Voyage Data Recorder (VDR) logs commands and sensor inputs. Many other OT systems exist, including fire suppression, ballast water management, and dynamic positioning systems, which play essential roles in maritime safety and operational efficiency [28]. Ship networks use segregated OT, guest, and office networks with VLANs and firewalls per BIMCO guidance, though implementation varies (Int3, Int4). Communication infrastructure such as VSAT, VHF, and satellite links can expose the OT network, motivating layered defenses [39], encryption for ship–shore communications [40], and comprehensive threat models [20, 41].

III. Methodology

This study employs a multi-phase methodology: data collection integrating a comprehensive literature review and unstructured expert interviews, synthesis of scenarios into attack trees, and validation of the generated trees through structured interviews with industry experts. The literature review consolidated knowledge on maritime cybersecurity, vulnerabilities, and documented attack scenarios using keyword groups (general cyber terms, attack terms, and maritime-specific terms such as ECDIS, GPS, AIS, VDR, and GMDSS) applied in Web of Science.

Papers were included if they addressed vulnerabilities, exploits, attacks, human behavior, or practical maritime cybersecurity examples, and excluded if unrelated to maritime transportation, focused solely on autonomous ships or frameworks and legislation, or inaccessible in English. After screening, 58 articles were identified as most relevant and analyzed for recurring themes including attack vectors, network architectures, vulnerabilities, and risk management practices, providing a baseline and revealing literature gaps that informed the interview phase.

To complement the literature, 13 interviews with 10 different experts were conducted, spanning cybersecurity and IT specialists, maritime operators and captains, technical consultants and researchers, and harbor pilots and regulatory advisors. The interviews ran in two phases: five unstructured interviews gathering background on operations, risks, and technological dependencies, and eight structured interviews validating the developed attack scenarios for feasibility, consequences, and mitigations. All responses are anonymized as Int1, Int2, and so on. Expert interviews are a rigorous validation method when live testing is infeasible [42, 43], and the structured questions are listed in Appendix A.

Attack trees hierarchically decompose goals into sub-goals and actions: the root node is the attacker objective, OR nodes (green) mean any child suffices, AND nodes (orange) require all children, and leaf rectangles are basic attack steps. The trees in this study are modular, with shared subtrees reused across goals, and cyber risks grouped by attack vectors, affected systems, and cascading failures [44]. Their visual structure aids communication even with non-technical audiences, and compatibility with frameworks such as MITRE ATT&CK for ICS lets results feed future work. Attack graphs were rejected for their lack of standardization [26] and poor adaptability to dynamic maritime threats.

IV. Results: Common Attack-Tree Components

The three high-level goals — crashing, capsizing, and immobilizing the ship — share recurring components modeled once as standalone subtrees: infiltrating the network, taking control of ECDIS, loss of operational view, and evasion. This modularity avoids repetition, simplifies interpretation, and lets refinements propagate from a single place. A total of 20 high-level scenarios were identified: 9 for crashing, 7 for immobilizing, and 4 for capsizing, with the actual number of attack paths significantly larger due to shared elements. Auxiliary systems such as cruise-ship entertainment were excluded, and single points of failure were assumed where redundancy may be improperly implemented (Int1) [30].

Infiltrating the ship network proceeds via two approaches. First, attaching a malicious device: physical intrusion (sneaking aboard, blending in on passenger ships, disguising as maintenance), insider threats (bribing crew, pilots, or maintenance workers), social engineering (impersonating maintenance using schedule knowledge from phishing or social media), and compromising intermediate devices such as maintenance laptops or USB drives used for ECDIS updates — a vector confirmed by real incidents where a maintenance worker device delayed a ship release from dry dock [30, 45]. Second, exploiting external interfaces: default VSAT configurations correlatable with AIS data [46], and outdated operating systems such as unsupported Windows versions [30, 46-50]. Once inside, attackers can manipulate data such as GPS coordinates or deploy malware to critical systems.

Taking control of ECDIS is pursued by attaching a malicious device directly (e.g., a USB drive uploading corrupted charts) or by compromising the update supply chain [51]: via internet-based chart services (a risk where outdated software or insecure connections exist) or via removable media infected before connection. Malware embedded in chart files can distort geography or disable ECDIS entirely, and proper controls include pre-scanning external devices, restricting USB access, and cryptographic validation of updates [52]. A single compromised supply chain can affect multiple vessels, amplifying consequences.

Loss of operational view is achieved by modifying sensor data (GPS, radar, echo sounders, propulsion sensors), including at the Terminal Processing Unit (TPU) data converter (Int5); marine radars are vulnerable to network attacks injecting false echoes [53, 57], and radar hijacking alters perceived surroundings [54]. Attackers may also create diversions by gradually introducing inconsistencies to erode crew trust [55, 56]; disable ECDIS via ransomware encrypting essential files [58], hiding sensors through configuration edits, or denial-of-service overload [55] — noting ECDIS commonly runs outdated operating systems [46, 47, 49, 59]; hide sensors by corrupting configuration mappings; or time attacks with adverse weather when visual cross-checks fail.

Evasion focuses on the Voyage Data Recorder (VDR), the ship logging system recording navigation commands, changes, alarms, and communications. Attackers stop compromised systems from sending logs to the VDR or corrupt the VDR itself — historically feasible, as when malware on a USB device fully corrupted VDR data [60]. General OS evasion techniques such as modifying system logs or disabling monitoring tools also apply to shipboard systems, hindering post-incident investigation and minimizing detection chances during operations.

V. Results: Crashing, Capsizing, and Immobilizing

Crashing a ship can cause monetary loss, environmental damage, and loss of life, as illustrated by the Costa Concordia disaster in 2012 [62]; cyber-physical vulnerabilities in surface ships can let attackers manipulate autopilot and navigation controls toward collisions or groundings [61]. Two approaches were modeled. First, colliding with an object: setting a collision course requires simultaneously manipulating navigation and rendering thruster and wheel commands inoperable for manual override, since internal attacks can feed falsified sensor data into automation [63]. Attackers then send malicious wheel or thruster commands (countered in principle by high-authority supervisory control [61]), force tracking autopilots off course via tampered GPS or route data and rogue NMEA 0183 inputs to the Steering Gear Control System [64], and execute denial of service on wheel commands so the crew cannot intervene.

Second, running aground: steering into shallow water by tricking the captain or autopilot through manipulated ECDIS charts (incorrect depths, or phantom obstacles forcing evasive grounding) or fake GPS data shifting perceived position [61]. Gradual manipulations may go unnoticed until too late, and narrow canals or unfamiliar routes limit visual landmarks. Effectiveness rises when timed with adverse weather or high crew workload, and when combined with denial-of-service techniques that further reduce response capacity.

Capsizing destabilizes physical balance until the vessel overturns: assuming control of ballast pumps to shift water to one side, engaging thrusters at full power in extreme turns, counteracting anti-rolling systems, and timing the attack to wave peaks using gyroscope data (storing 10 minutes of gyro history to derive wavelength and strike at the bottom or top of a wave). Practical challenges are severe: ship designs embed centuries of safety engineering, ballast pumps are slow and often have manual valves, success depends on uncontrollable severe weather, and applicability varies by ship type — making capsizing plausible only in specific scenarios such as cargo or cruise ships in rough seas.

Immobilizing strands the vessel via denial of service or induced mechanical failure [55, 56]. DoS pathways include disabling control automata with crafted TCP packets or direct memory writes ignoring user commands [56], deploying ransomware on control systems, modifying configuration files, disabling external communications so port documentation cannot be delivered, and causing blackout: overloading the Advanced Load-Shedding (ALS) controller with traffic [65], exploiting all-electric-ship Integrated Power Systems (IPS) weaknesses [67], with distributed control system (DCS) attacks shown to propagate across ship power networks [66], or man-in-the-middle manipulation of ALS sensor traffic via ARP poisoning [65]. Mechanical failure instead overloads engines beyond safe thresholds while suppressing alarms through falsified sensor telemetry. A stranded ship in stormy or remote waters faces sinking, loss of life, and major economic consequences.

Across goals, attacks exploit trust placed in sensors and automation; many rely on manipulating navigation data the crew implicitly trusts. Dependency chains matter: initial foothold enables deeper OT intrusion affecting steering and propulsion. While manual overrides and physical fail-safes exist for ballast pumps and thrusters, determined attackers with control of critical components can circumvent them, and the difficulty of detecting subtle manipulations increases severity. Timing with weather, traffic density, and crew workload consistently emerged as a force multiplier.

VI. Validation and Practical Challenges

Validation used structured interviews with 10 maritime professionals — captains, engineers, cybersecurity specialists, and operational managers — assessing feasibility, operational complexity, and real-world challenges of the 20 scenarios across gaining a foothold, crashing, capsizing, and immobilizing. Experts unanimously agreed on the plausibility of gaining initial access via physical means: impersonating maintenance workers was deemed highly feasible, port security varies with smaller ports at higher risk (Int3, Int7), removable media from port authorities is a concern (Int7), and a well-concealed device could persist undetected in rarely inspected areas.

Manipulating thrusters or autopilot to crash was identified as the most likely crashing scenario, with narrow waterways, ports, and restricted-maneuverability areas as prime targets (Int1, Int7). GPS spoofing and malicious ECDIS charts were considered less likely, requiring advanced expertise and proximity — though interviewees stressed the high trust placed in ECDIS that attackers could exploit. Denial-of-service on wheel commands was judged a viable tactic to prevent crew intervention. Capsizing was viewed as the least feasible goal given extensive fail-safes (Int9, Int10), though anti-rolling manipulation, shifting unsecured cargo, or flooding upper decks via the anti-fire system (Int9) were plausible under extreme conditions with stormy seas as an enabler.

Disabling communications emerged as a practical immobilization strategy, since failing to transmit mandatory port documentation incurs delays and penalties (Int7); disabling ECDIS or deploying ransomware on automation were also effective, while induced mechanical failure was doubted because engine stress noise and vibration would alert the crew (Int8) — with severe weather compounding any stranding. System-specific weaknesses center on ECDIS and AIS reliance on external data, with AIS lacking encryption. Human factors proved critical: one minor navigation error caused a 60-nautical-mile deviation (Int7), fatigue during 02:00–04:00 watches reduces alertness, and over-reliance on interface data hides discrepancies [55, 56].

Feasibility varies by operational context (high-traffic zones, weather), ship type (passenger vessels better redunded than older cargo ships), network segmentation (VLAN and firewall misconfigurations and absent network access control, Int5, Int6), physical security at ports and aboard smaller vessels (Int7, Int9), and attacker motivation — resource-intensive ship attacks offer limited financial reward except to nation-state or ideological actors (Int2). Table 3 summarizes feasibility and consequences per goal. Limitations include dependence on specific conditions and human factors; the findings advocate layered defenses combining segmentation, encrypted communications, crew training, and protocol adherence, plus research on emerging technologies and regulatory impacts.

VII. Conclusions

This study identifies critical vulnerabilities and 20 cyberattack paths categorized under crashing, capsizing, and immobilizing a ship, bridging theoretical knowledge with real-world operational insights from an extensive literature review and expert interviews. Crashing and immobilizing scenarios were deemed highly plausible, particularly in constrained environments like ports and narrow waterways, while capsizing was assessed as least feasible due to modern designs and safety measures. The key contribution is structured attack trees that hierarchically capture complex attack paths, serving risk assessment, mitigation planning, and communication with non-technical stakeholders.

The findings carry significant implications: navigation systems such as ECDIS and autopilot present serious risks if compromised, and human factors — errors, oversights, inadequate awareness — can amplify attack success. Strengthening network segmentation, enforcing strict removable-media controls, and improving crew training are key mitigations. The research was conducted defensively to improve resilience, acknowledges dual-use potential, and restricts findings to ethical, lawful application safeguarding critical maritime infrastructure [6, 7-9].

Limitations include the need to adapt scenarios to specific ship configurations, exclusion of autonomous ships, unquantified probabilities and impacts, and a homogeneous expert pool. Future research should incorporate designers, engineers, and crews of varied vessel types such as cruise liners and tankers; investigate autonomous ships, AI-driven navigation, and blockchain cargo management; integrate attack trees into evolving cybersecurity frameworks and incident response planning; and add scoring-based quantitative modeling and simulations to translate findings into actionable strategies.

Appendix A: Structured Interview Questions

Table A1 lists the questions asked during the structured validation interviews, grouped by goal. Gaining a foothold: likelihood of sneaking aboard to install a device, alternative foothold proposals, sea-versus-port procedural differences, and device detectability during maintenance. Crashing: thoughts on timed thruster commands, success amplifiers, and additional crashing ideas. Capsizing: attacker considerations and preventive factors. Immobilizing: most vulnerable mechanical components, repairable components, course of action when IT navigation aids fail, and conditions for calling a tug or declaring loss of control.

Operational view: main crew awareness tools, malfunctions forcing operational stops, weather effects, and sensor-manipulation detection. Network separation: OT versus office network segregation and additional segmentation methods. General: memorable accident kinds, unmentioned ideas, and sensor-data manipulation detection by the crew.