Defining the Maritime Cyber Adversarial Taxonomy of Tactics and Techniques

The maritime industry by design has unknowingly embarked on a digital transformation whereby vessels at sea are an extension of shoreside infrastructure presenting a significant threat of a cyber-attack occurring at sea. The remote nature of the industry has created an undertone of immunity towards a cyber-attack despite common attack vectors being prevalent onboard. The use of specific maritime technologies has created a meshed network whereby a cyber adversary can impact a vessel via multimodal methods of communication, whether this be via satellite communication or ship to ship transmissions. The global nature of the maritime domain is more likely to be impacted by the geopolitical landscape as vessels cross geographic boundaries predominately unhindered, this factor is unique to the maritime industry and should be considered during the development of a maritime threat model. The mapping of adversarial behaviours against the MITRE ATT&CK® taxonomy present a unique perspective of the maritime cyber adversary and the resultant data presents a tangible alignment and overlap with other industries. The outcome demonstrates that the maritime industry is not unique when faced with a cyber threat actor and can draw on similarities to documented taxonomies from the cyber community.