Detect: Continuous Monitoring & Anomaly Discovery
IACS UR E26 Control 4.3: Real-time Security Event Detection
The “Eyes and Ears” of the vessel. Hardened firewalls are only effective if you know when they are being attacked. This phase establishes the monitoring infrastructure required to identify unauthorized access, hardware failures, and malicious patterns within the OT network.
Detection in maritime OT — working with the constraints
Detection in a maritime OT environment is fundamentally different from detection in a shore-side IT network. Most bridge and engine room systems were designed for reliability and deterministic behaviour — not for security logging. NMEA 0183 is a one-way serial protocol with no concept of authentication. Modbus has no built-in access control. Many PLCs produce no meaningful event logs at all. A detection strategy for a vessel has to be built around what is actually achievable with the equipment fitted, not what a shore-side SOC would specify.
The playbooks in this phase take that reality as the starting point. They cover syslog aggregation from the systems that can produce logs, network traffic baselining to establish what normal looks like on the OT network, and periodic CBS verification checks that confirm the controls put in place during the Protect phase are still working. Together these create a detection capability that works even when VSAT is down and there is no connection to a shore-side security team.
Detection is also relevant well below the threshold of a formal cyber incident. Baseline drift — gradual changes in network behaviour, unexpected new connections, services running on ports that should be closed — are often the first indicators that something has changed on a system. Catching these early, through routine monitoring, is significantly better than discovering them during a survey or after an operational failure.
Effective detection in Maritime OT requires a move from Passive Asset Lists to Active Behavioral Analysis. By monitoring network flows and centralizing system logs, we can identify a cyber incident before it affects the ship’s maneuverability or safety systems.
Core Concept: The SOC-on-a-Ship Model
Implementing local syslog aggregation and anomaly detection that works even when the VSAT link is down.
Monitoring & Health
Asset availability and performance baseline monitoring to detect hardware tampering or failure.
Logging & SIEM
Centralizing event logs from all Category II and III systems for forensic readiness and audit proof.
Intrusion Detection
Identifying unauthorized connections and physical cabinet breaches in real-time.
Control Verification
Actively confirming that segmentation, access controls, firewall rules and physical hardening are still enforced — not just monitoring passively.
Detection Tip for ETOs:
Detection isn’t just about hackers; it’s about Baseline Drift. If your Engine Control network usually has 500kbps of traffic and suddenly jumps to 10Mbps, something is wrong—even if no “alarm” has gone off yet.
