Maritime Situation Awareness in the Context of Cyber Events

The maritime sector has become increasingly dependent on interconnected digital systems for critical vessel functions. While this digital transformation enables safer and more sustainable operations, it has also introduced a new challenge in the form of digital security risks.

Communication between vessels and M-SOCs during cyber incident management

An emerging issue is the management of cyber incidents onboard vessels. This introduces specific challenges compared to land-based systems, particularly because it is difficult to monitor and manage incidents remotely when vessels are at sea.

As a result, shipping companies are increasingly relying on Maritime Security Operations Centres (M-SOCs) for continuous threat monitoring and support in incident response. This remote response often requires close coordination between the non-cyber-technical crew onboard and experts onshore (M-SOC analysts and vessel IT teams). The effectiveness of this coordination depends on all actors having sufficient situation awareness. Situation awareness refers to understanding what is happening around you and how the situation is developing.

This PhD study examines how concepts from situation awareness can be used to improve communication between vessels and M-SOCs during cyber incident management. A key concept explored in the study is the Common Operational Picture (COP), which makes it possible to maintain an overview of both past and emerging states of actors, events, and conditions relevant to a given situation.

Semi-structured interviews and case study

The study is based on a qualitative approach. Data were collected through semi-structured interviews with M-SOC experts and a case study involving four months of fieldwork within an M-SOC. During this period, first-hand data were gathered on processes and procedures for managing cyber incidents onboard vessels, and feedback was also collected.

A key finding of the study is that incident analysis processes and the operational context have a significant impact on the management of vessel cyber incidents. Requirements related to cyber onboarding and communication during incidents also play an important role in this process.

Furthermore, the implementation of an onboard dashboard is identified as an important factor in developing a shared Common Operational Picture (COP) between the M-SOC, the crew onboard, and vessel IT teams onshore.

The study proposes a situation awareness process framework for M-SOCs. In this framework, the Common Operational Picture is presented as a process tool, where information needs are linked to the different stages of situation awareness: perceiving, understanding, and anticipating developments during the management of cyber incidents onboard vessels.

Personnel

Allan Kevin Nganga holds a bachelor and Master of Science in Information Systems Technology from the United States International University in Kenya. He has several years’ industry experience in digital forensics. In 2022, Allan started his PhD in maritime cybersecurity under the national joint doctoral program in Nautical Operations between NTNU, UiT, HVL and USN. He is currently applying his knowledge and skills in industry as a senior project engineer.

Trial Lecture and public defence

Topic: "What does experience in industries with similar environments to maritime tell us about the success factors in an M-SOC? Is there research/data/anecdotal evidence that indicates an M-SOC would improve the cyber resilience of the sector?"

Assessment Committee

• Associate Professor Kimberly Tam, University of Plymouth, UK 
• Professor Stephen McCombie, NHL Stenden University of Applied Sciences Leeuwarden, Netherlands  
• Associate Professor Vedrana Jez, HVLas chair of the committee 

Chair

Vice-Dean Brit Julbø, HVL.

Supervisors

Associate Professor Joel Scanlan, HVL  
Professor Margareta Lützhöft, HVL and  
Associate Professor Steven Mallam, USN