Bridging the Gap: Enhancing Maritime Vessel Cyber Resilience through Security Operation Centers

Area of Science:

• Maritime Cybersecurity
• Information Security Management
• Operational Resilience

Background:

• Rising cyber threats in the maritime sector necessitate enhanced cyber resilience.
• Regulatory requirements drive the adoption of Maritime Security Operation Centers (M-SOCs) for cyber event detection.
• Emerging Remote Operation Centers (ROCs) for autonomous systems increase the maritime attack surface.

Purpose of the Study:

• To investigate enabling factors and challenges affecting Maritime Security Operation Center (M-SOC) effectiveness.
• To understand the unique aspects of M-SOC operations within the maritime context.

Main Methods:

• Conducted semi-structured interviews with nine Maritime Security Operation Center (M-SOC) experts.
• Employed grounded theory to analyze interview data and identify core themes.
• Focused on factors influencing incident management within M-SOC operations.

Main Results:

• Incident management was identified as the core operational category for M-SOCs.
• Maritime connectivity challenges significantly impact the M-SOC incident management process.
• Insufficient maritime domain knowledge presents a key challenge for M-SOC effectiveness.

Conclusions:

• Effective M-SOC operations are critically dependent on addressing maritime connectivity issues.
• Deep domain knowledge is essential for successful incident management in M-SOCs.
• Findings provide insights for the potential convergence of M-SOC and Remote Operation Center (ROC) operations.