Wireless & Bluetooth Hardening
This guide covers the security controls required for all wireless communication on board — from Wi-Fi access points to Bluetooth sensors — ensuring encrypted, authenticated, and segmented wireless networks. Under IACS UR E26 §4.2.5, wireless interfaces must be managed as conduits and subject to the same zone boundary controls as wired network connections.
Wireless technology on ships — from Bluetooth vibration sensors to Wi-Fi tablets for engine rounds — offers operational efficiency but expands the attack surface. Unlike a physical cable, wireless signals travel through bulkheads, meaning an attacker in a pilot boat, on the quayside, or in a passing vessel could potentially access your OT backbone without ever stepping on deck. Distance is not a security control.
The invisible threat — shadow wireless
Rogue access points
Crew members often install travel routers in the ECR or accommodation to extend Wi-Fi coverage. These devices create an unmonitored back-door with no VLAN segmentation, no firewall, and no logging — directly bridging the crew network into whatever switch port they plug into.
Default Bluetooth pairing
Industrial sensors and HMI devices often ship with default Bluetooth pairing codes (0000 or 1234) and discoverable mode enabled. Without hardening, an attacker within 10–100 metres can spoof sensor data, hijack the connection, or use the device as a pivot point into the vessel network.
Signal bleed beyond the hull
Access points at default transmission power broadcast well beyond the vessel’s hull. In port — where the vessel is stationary and surrounded by quayside workers, contractors, and adjacent vessels — an attacker within range can conduct a passive survey of all vessel SSIDs, capture handshake traffic, and run offline cracking without any active connection attempt triggering your IDS. The risk is highest during port calls and maintenance periods when the vessel is accessible and third parties are on board.
Step 1 — Protocol hardening standards
Securing wireless OT requires encryption, authentication, and signal management applied consistently across all wireless protocols in use on the vessel.
Step 2 — Rogue access point detection
Physical RF surveys must be conducted at every port call and after any maintenance period. A rogue AP installed during a port call can be operating silently for weeks before it is detected by network monitoring alone.
show mac address-table on the core switch. Any MAC address not in the CBS Register is an unauthorised device connected to the vessel network.Step 3 — Configuration hardening checklist
Audit evidence requirements
Class surveyors reviewing the PROTECT phase will ask to see documented evidence that wireless interfaces are managed as conduits under E26 §4.2.5. The following records must be maintained.
The specific regulatory requirements this playbook satisfies. Use these references when preparing for Class survey or responding to a surveyor's checklist.
