OT Cybersecurity

Port and Maritime OT Cybersecurity: Protecting Terminal Systems, Gate Operations and Industrial Networks

By Denrich Sananda 05-11-2026 6 min read

A container terminal is an industrial control environment that most OT security guidance ignores. It has heavy moving machinery under automated control, a dense sensor estate, safety-critical interlocks, and a tight coupling between physical operations and commercial data systems. It also has something a refinery does not: thousands of third parties driving through the gate every day, each expecting to be identified and routed automatically.

The security problem is not mainly about cranes. It is that terminal throughput depends on a chain of systems where the commercial and the operational are inseparable, and the weakest links are usually on the commercial side. Our analysis of how ransomware stops operations without touching control systems describes the same mechanism in other industries.

What the OT estate actually includes

System	Why it matters
Terminal operating system	The brain of the terminal. Assigns moves, tracks container positions, sequences work. Not a control system in the classic sense, but if it stops, the terminal stops.
OCR gates and portals	Optical recognition of container and truck identity at entry. A gate failure creates an immediate physical queue on public roads.
Cranes and automated stacking	Quay cranes, RTGs and automated stacking cranes. PLC-controlled with safety interlocks, increasingly remotely operated.
Access control and gate automation	Driver identity, appointment systems, barrier control. Physical security and operations in the same system.
EDI and port community systems	Electronic data interchange with carriers, customs and freight forwarders. External by design.
Reefer monitoring	Refrigerated container monitoring. A monitoring failure is a cargo loss with a short clock.

The dependency that closes a terminal

It is rarely the crane. In most terminal incidents the physical equipment is fine and the terminal still stops, because the terminal operating system cannot assign moves, or the gate cannot verify a truck, or customs data cannot be exchanged. Cranes can sometimes be driven manually. A terminal cannot be run manually at commercial throughput. That is why terminal continuity planning has to start from the data systems rather than the machinery.

Where the Purdue model holds and where it bends

The Purdue model maps onto a terminal reasonably well for the crane and equipment layers: controllers at Level 1 and 2, supervisory and equipment management at Level 2 and 3. Where it bends is the terminal operating system, which behaves like a Level 3 or 4 system but is operationally indispensable in a way an enterprise system normally is not.

The practical consequence is that you cannot treat the TOS as a business system to be protected by ordinary IT controls, and you cannot treat it as a controller either. It needs the availability treatment of an operational system with the patching and identity treatment of an IT system, and reconciling those two is the central architecture problem in a terminal.

Six priorities for a terminal

1. Segment the equipment networks from the commercial estate. Crane and stacking control should not share a broadcast domain with the office. Frequently they do. See our segmentation audit guide.
2. Map the throughput dependency chain. Which systems must work for a container to move from ship to gate. Include external parties.
3. Control remote access for equipment vendors. Crane OEMs typically hold remote access for diagnostics. Time-box it, broker it, log it.
4. Plan for gate degradation specifically. A manual gate fallback that has been practiced is worth more than any control, because gate failure has an immediate public consequence.
5. Monitor the equipment conduits. Passive detection between the equipment zones and everything else. Our guide to building an OT monitoring program covers the approach.
6. Treat EDI as an external trust boundary. It is a data path from outside your control into systems that move physical cargo.

Safety sits underneath all of it

Crane and automated stacking systems carry safety instrumented functions: anti-collision, load limits, zone protection for personnel. Any security change that touches those paths needs safety review, not just a change request. This is the point where security and functional safety stop being separate disciplines, and it is the reason we insist on functional safety competence on terminal engagements rather than network expertise alone. See our IEC 62443 guide for the zone and conduit structure we work to.

Regulatory context

Maritime facilities in North America sit under US Coast Guard cybersecurity expectations for regulated facilities alongside general critical infrastructure guidance, and Canadian ports operate under their own federal framework. The detail varies by facility type and jurisdiction, so treat applicability as a question for your compliance team rather than something to infer from a blog. What is consistent across regimes is the expectation of an assessment, a plan, and demonstrable incident response capability, which is the same groundwork good security requires anyway.

Why Choose Arista Cyber

We assess industrial control environments where heavy machinery, safety functions and commercial systems are tightly coupled, which is exactly the terminal problem. Our consultants hold functional safety credentials alongside OT security certification, so recommendations touching crane safety functions account for the safety case. See our OT cybersecurity services and our case studies.

Next Steps

Start with the throughput dependency chain and the gate degradation plan. Those two pieces of work need no procurement, they surface the exposures that would actually close the terminal, and they are the evidence base for whatever you do next.

Common Questions

Is a container terminal an OT environment?

Yes. It has PLC-controlled heavy machinery, safety instrumented functions, a dense sensor estate and automated control. It also has an unusually tight coupling to commercial data systems, which is what makes it distinctive.

What actually stops a terminal in a cyber incident?

Usually the data systems rather than the machinery. If the terminal operating system cannot assign moves or the gate cannot verify trucks, the terminal stops even with every crane healthy.

Can cranes be operated manually during an outage?

Often to some degree, but not at commercial throughput, and not with the sequencing a terminal operating system provides. Manual operation is a safety fallback, not a continuity plan.

Does the Purdue model apply to ports?

Reasonably well for equipment layers. It fits the terminal operating system poorly, because that system behaves like an enterprise application while being operationally indispensable.

What regulations apply to port cybersecurity?

In the US, Coast Guard expectations for regulated maritime facilities alongside general critical infrastructure guidance. Canada has its own federal framework. Applicability depends on facility type and jurisdiction, so confirm with your compliance team.

Could your terminal still move containers if the TOS went down?

Arista Cyber assesses port and terminal OT security: equipment network segmentation, throughput dependency mapping, vendor remote access, gate degradation planning and monitoring across the equipment conduits.

Request a terminal OT assessment