Transport cybersecurity: when an attack stops cargo rather than data

The attack surface is operational, not just corporate

Logistics organisations run two estates that are increasingly connected. The corporate estate holds bookings, transport management, customs filing, invoicing and customer data. The operational estate runs terminal operating systems, crane and yard automation, gate and access control, warehouse control systems, telematics, and shipboard navigation and cargo systems. Attacks that begin in email and identity systems move into the second estate because the two are linked by integrations built for convenience. The consequence is that impact is measured in stopped movements rather than lost records. Where a terminal operating system is unavailable, a port cannot plan stows or release boxes, and the queue outside grows faster than any manual workaround can clear it.

How the duty is framed in maritime and EU rules

In shipping, the maritime organisation has directed that cyber risks be addressed within existing safety management arrangements, so that a company's safety management system identifies cyber risks to the ship and its systems and puts safeguards in place. That places cyber alongside other operational risks subject to audit rather than treating it as an information technology matter. In the European Union, network and information security legislation designates transport among the sectors whose essential and important entities must manage cyber risk, adopt defined measures and report significant incidents to authorities within short deadlines, with responsibilities attaching to management. Port facility security rules and aviation security requirements add their own expectations. Whether an individual company is in scope depends on its sector role and size, which is a question for local advice.

Controls that matter most in this sector

The high-value controls are unglamorous: multi-factor authentication on remote access and administrative accounts, tight segmentation between corporate and operational networks, controlled and monitored remote access for equipment vendors, patching or compensating controls for systems that cannot be patched, privileged access management, and offline, tested backups of the systems that actually run operations. Third-party connectivity deserves particular attention. Electronic data interchange links, customer portals, customs filing interfaces, telematics providers and equipment maintenance connections all create paths into the estate that were justified operationally and rarely reviewed since. An inventory of those connections, with an owner and a review date for each, is often the most revealing exercise a logistics security team can run.

Continuity planning that assumes the systems are gone

The distinguishing feature of transport continuity planning is that the physical work continues while the systems do not. Plans should therefore define how to accept, move and release cargo on paper, how to authenticate release instructions without the usual system checks, how to keep a manual record that can later be reconciled, and how to communicate with customers and authorities when normal channels are unavailable. These procedures need to be exercised, printed and stored where they can be reached without the network. Companies that have run the drill recover in a materially different way from those discovering during an incident that their manual process depends on a template on the file server.

Incident response, notification and the contract layer

Response planning should cover technical containment, the decision-making authority for stopping operations, legal and regulatory notification duties, communication with customers whose cargo is affected, and evidence preservation. Where personal data is involved, separate notification obligations may run in parallel on their own timetable. Contracts complete the picture. Customer agreements increasingly require security measures, incident notification within defined periods and audit rights, while supplier agreements should impose the same on providers with system access. Insurance for cyber events is a distinct product with its own conditions, and it should be reviewed against the operational loss scenarios that matter here rather than assumed to follow from general cover.

Frequently asked questions

Why do cyber incidents stop physical cargo movement?

Because terminal operating, gate, yard and warehouse control systems are what authorise and direct physical work. Without them, containers cannot be located, released or planned into a stow, and manual workarounds handle a fraction of normal throughput.

Is cyber risk part of a ship's safety management system?

The maritime organisation has directed that cyber risks be addressed within existing safety management arrangements, which brings them into the same documented, audited framework as other operational risks rather than leaving them to information technology teams alone.

What should a manual fallback procedure cover?

How cargo is accepted, moved and released without systems, how release instructions are authenticated, how a reconcilable manual record is kept, and how customers and authorities are contacted. It also has to be available offline, which is where many plans quietly fail.