New NATO brief highlights evolving cyber threats to ports
The NATO Cooperative Cyber Defense Center of Excellence (CCDCOE) has issued a brief addressing the risk of cyber threats to critical maritime port infrastructure.
According to the report “Addressing State-Linked Cyber Threats to Critical Maritime Port Infrastructure” recent intelligence shows a high frequency of cyber attacks affecting port facilities across Europe and the Mediterranean, with a significant proportion of these attacks traced back to threat actors originating from Russia, Iran, and China.
This trend highlights the pressing need for coordinated policy and security responses. The analysis reveals that nearly all surveyed countries have experienced cyber attacks within the past five years, with access control systems and vessel traffic management systems identified as the main reported risks.
Threat landscape
Maritime port facilities face a range of threats from state-sponsored advanced persistent threats (APTs), financially motivated cybercriminals, and politically driven hacktivists.
Moreover, these threats are remarkably consistent regardless of geographical location, and the tactics, techniques, and procedures (TTPs) are the same if not identical across Europe, the Americas, and the Asia Pacific regions.
The CCDCOE survey that was conducted with member and partner countries demonstrates that the most common attacks against maritime facilities include denial-of-service attacks and significant data breaches, followed by phishing or malware delivery and ransomware.
Policy gaps in current frameworks
NATO Alliance Maritime Strategy limitations
The NATO Alliance Maritime Strategy from 2011 identifies maritime security as a core pillar but needs updating to address emerging threats, especially cyber threats to maritime infrastructure. It lacks formal frameworks for engaging commercial port operators, who play a critical role in maritime security and NATO logistics. The blurring of civilian and military roles in ports complicates NATO’s civil-military coordination.
Furthermore, hybrid warfare combining cyber and physical attacks reveals gaps in the current strategy, which predates sophisticated state-linked cyber campaigns against allied ports. The strategy must expand beyond traditional threats to cover the full spectrum of modern risks.
Ports, as critical infrastructure, depend heavily on energy systems, making them vulnerable to cyberattacks that can disrupt both military and civilian logistics. Port cybersecurity requires a multi-layered approach, including resilience of supporting energy infrastructure, and demands dedicated strategic focus within NATO’s maritime posture.
Existing cybersecurity framework limitations
Port operators face unique cybersecurity challenges due to limited expertise, organizational structures and resources. Most surveyed by NATO CCDCOE assess their cybersecurity risk as moderate, showing awareness but also shared challenges globally.
Existing frameworks like the International Ship and Port Facility Security Code focus mainly on physical security and lack comprehensive cybersecurity measures. The International Association of Ports and Harbors provides cybersecurity guidelines, but implementation varies widely across jurisdictions and ports.
Recommendations:
- Revision of the NATO Alliance Maritime Strategy
- Establish and actively participate in structured threat intelligence-sharing networks
- Establish dedicated liaison roles and coordination mechanisms
- Develop maritime cybersecurity working groups
Content Original Link:
" target="_blank">
