Maritime Cybersecurity in the South Baltic Sea

Compensating controls are increasingly required when production runs and/or a lack of
institutional knowledge require keeping outdated code in play.
Ships are complex meta systems with 20-30 year (or more) lifespans that can be conceptualized in
numerous ways: As a floating well or pipeline (oil & gas tankers), as a floating parking lot or bridge
(especially in the case for ro-ro (roll-on roll-off) vessels), floating cities, hotels, or amusement parks
(in the case of cruise ships), and more. No two ships, even of similar class owned by the same
operator, are ever identical: System configurations and operational software packages are unique
to a particular vessel because construction of a complex vessel takes years to complete and many
lessons are often learned along the process. Given the unique profile of every ship, local,
customized, and costly cybersecurity protections are required, many of which the non-standard
are limited to basic, quick-fix solutions at the expense of quality protection. Or left undone.
4