Mapping of the Maritime Cybersecurity Rules and Regulations and their Implementation on Thruster Systems

The accelerating digitalization of the maritime industry has introduced crucial cybersecurity risks to vessel operational technology, where a successful cyber-attack can produce direct physical effect, including collision, grounding or loss of propulsion. The Thruster Control System, one of the safety critical systems that govern vessel propulsion and manuvering, is the System Under Consideration (SUC) in this thesis. To protect vessels from rising cyberattacks, the maritime industry has introduced strict new cybersecurity regulations, however, a persistent gap remains between high-level regulatory requirements and their practical implementation on a specific operational system such as a thruster. This thesis addresses that gap.

The study assesses the maritime cybersecurity regulatory landscape and selects three standards based on their technical detail, applicability to operational technology, and operational implementation within the maritime classification framework: IEC 62443-3-3, IACS UR E27, and DNV-RU-SHIP Pt.6 Ch.5. The hierarchical relationship between these standards is established, in which IEC 62443 defines the technical capability, IACS UR E27 mandates its adoption, and DNV provides the verification mechanism.

Using the Steerprop thruster control system as a case study, the system architecture is defined and divided into five security zones: external interfaces, main control, backup control, electrical, and mechanical components. The applicable security requirements are then identified and systematically mapped to individual thruster components through a top-down process in which the IEC 62443-3-3 baseline is gradually refined through the maritime obligations of IACS UR E27 and DNV Pt.6 Ch.5. A cross-standard analysis identifies areas of convergence, regulatory expansion, and regulatory gaps across the three standards.

Building on this mapping, the thesis applies attack tree methodology to identify two primary attack trajectories against the thruster system: command injection via network infiltration, and spoofed commands via upstream system compromise. For each trajectory, prevention methods, implementation practices, and recommended security tools are proposed, covering network segmentation, access control, intrusion detection, input and command validation, and fail-safe behaviour. Finally, the thesis presents testing, verification, and validation techniques aligned with the DNV certification process, including static and dynamic analysis, OT-specific penetration testing, and Cyber Hardware-in-the-Loop testing.

The thesis provides a practical bridge between regulatory policy and engineering implementation and explains how theoretical regulatory requirements can be translated into concrete, traceable, and verifiable security controls for a real maritime thruster control system.