Free Foundation

Cyber Security & Autonomous Ships

How ships became attackable, what the IACS cyber resilience rules actually require of owners and suppliers, how to run cyber security as a shipboard discipline rather than a paperwork exercise, and where the same wave of digitalisation is taking the industry next: remote operation, autonomy, and new cargo risks.

Lessons
6
Quiz questions
48
Time
About 40 min
Who it's for
Deck and engine officers, superintendents, DPAs, fleet IT/OT staff: anyone who has to sign for a newbuilding specification, an SMS amendment, or an incident report that now includes the word cyber.
Assumed knowledge
None. No IT or security background is assumed: the course starts from the machinery and works toward the network, not the other way around.
Taught by

Christos Papandreou

CEO & Founder, Blue Autonomy

  • Naval architect and marine engineer, National Technical University of Athens
  • 15 years of experience in fleet performance and operational data
  • Chief Scientific Officer, NEMO, previously DeepSea Technologies, StormGeo, Athenian Sea Carriers, PwC

What you will be able to do

By the end of the course. Each outcome names the lessons that deliver it, and each lesson's quiz checks it.

  1. Explain how the convergence of IT and OT made ships attackable — what distinguishes the two (confidentiality versus availability and physical safety), the real incident pattern (untargeted malware, portable media, NotPetya stopping a carrier's business ashore while its ships stayed manoeuvrable) — and how IMO resolution MSC.428(98) pulled cyber risk inside the ISM safety management system from the first DoC verification after 1 January 2021. Lesson 1
  2. Describe what IACS UR E26 requires of a newbuilding: the five functional elements (Identify, Protect, Detect, Respond, Recover), security zones and network segmentation as containment, and its application to ships contracted for construction on or after 1 July 2024. Lesson 2
  3. Explain UR E27's equipment-level requirements and why responsibility splits between ship and system: the security capabilities a supplier's product must bring (drawn from the IEC 62443 family), secure-by-default delivery, documentation and test evidence, and the integrator's job of proving the assembled zones still hold. Lesson 3
  4. Run cyber security as a shipboard discipline: contain-fall-back-report incident response, OT patching managed as a machinery modification rather than an auto-update, vendor remote access run like a gangway watch (approve, supervise, log, close), drills in the same family as fire and steering failure, and the class notations (BV NR659's CYBER MANAGED / RESILIENT / SECURE) that let an owner prove the work. Lesson 4
  5. Map the IMO degrees of autonomy (crewed decision support through uncrewed remote control), the role and limits of remote operation centres, the MASS Code trajectory (voluntary code in effect 1 July 2026, mandatory targeted for 1 January 2032), and explain why the control link becomes as safety-critical as steering gear — the joint between the course's two halves. Lesson 5
  6. Apply the technology-first, rules-later pattern to electric vehicles on ro-ro decks — thermal runaway behaviour, cooling with large quantities of water, state-of-charge as a risk lever, reignition watch, the ABS best-practice levers of stowage, detection and training — and read the IMO forward work plans (batteries as ship's power ≈ 2028, wind ≈ 2029, nuclear later) to anticipate where regulation goes next. Lesson 6

Cyber security arrived in shipping the way water arrives in a hold: quietly, through openings nobody was watching. Navigation became software, engine rooms became networks, and the satellite dish turned every vessel into a reachable address. The rules then followed the risk: IMO made cyber a safety management matter, and the IACS unified requirements made cyber resilience a condition of class for new tonnage.

This course walks that arc in six lessons. The first explains how ships became hackable and why the IMO answer lives inside the ISM Code. Two lessons then unpack the IACS unified requirements, E26 for the ship as a whole, E27 for the systems and suppliers inside it, because those two documents now shape newbuilding contracts, maker's documentation, and class surveys. The fourth lesson brings it on board: crew awareness, drills, remote-access discipline, and the class notations that let an owner prove the work. The last two lessons look forward: autonomous ships and remote operation centres, then the special topics riding the same wave of change, from electric vehicles on ro-ro decks to the regulatory work plans that will define the next decade.

No prior security knowledge is needed. What is needed is the operator's habit of asking, for every system on board: what happens when this misbehaves?

What the course covers

  1. Why Ships Became Hackable 7 min
  2. IACS UR E26: The Cyber-Resilient Ship 7 min
  3. IACS UR E27: Systems and Suppliers 6 min
  4. Running Cyber Security On Board 7 min
  5. Autonomous Ships and the MASS Code 7 min
  6. Special Topics Riding the Same Wave 6 min

Start the first lesson →

Enroll free

Saves your lesson progress across devices. No password: we email you a sign-in link, and the first sign-in creates your account.