Skip to content
Free lab · no signup · Maritime log triage

Maritime & Shipping Log Triage

You are the fleet security analyst for a small fictional shipping line. Logs come from the bridge, the engine room, the satcom terminals, crew Wi-Fi, the port community system and the shore office. Most are routine watchkeeping; find the ones that point to spoofing, tampering or broken separation between networks.

Tiers
Trainee · Analyst · Lead
Logs per shift
400–1000
Attack types
6

Your journey → certificate

BronzeSilverGold

Loading your progress…

All log triage tracks and the capstone · practice certificates, not accredited credentials.

1 in 5 logs hides an attack. 400 logs in the practice set.
10 logs ≈ 3 minutes → a graded shift scorecard you can share.

How to play: a 20-second start

  1. Pick a log in the inbox. Most are normal operations; a few are attacks.
  2. In the detail pane, click any field value that looks wrong.
  3. Hit Check: green = a real flag caught, amber = a flag missed, red = false alarm, each with a “why”.
  4. Stuck? Press Reveal to learn the answer (not scored). Use End shift for your report.
0Reviewedof 400
0Signals caught
0Missed
0False alarms
0%Recallof red flags
0Streak
0/10 logs to your shift scorecard
Inbox400 logs
AISinfoL100084 · 23:51:44 UTC

Own-ship AIS voyage data updated — MV Coral Tern

MV Coral Tern

Click any field value you think is a red flag (or press 1–9), then Check.

0/10 logs to your shift scorecard

How scoring works

Your shift score (0–100) is 60% red-flag recall (the suspicious fields you caught) plus 40% flag precision (how many of your flags were real). Only logs you check without pressing Reveal count. Check 10 logs, at least one of them an attack, and you get a graded scorecard with a share link. The score is recomputed on the server from the same deterministic log set, so a saved card always matches what you flagged. The daily shift is the same set for everyone that UTC day. Every log is synthetic: no real devices, people or networks.

Attack types in this track

Navigation & position spoofing

GNSS fixes that jump or disagree with dead reckoning, ghost AIS targets, or own-ship AIS identity changes.

  1. Tell the bridge to navigate by radar, visual and dead-reckoning fixes.
  2. Record the affected time, area and receivers.
  3. Report the interference to the flag state and the company security officer.

Removable media & chart updates

Unregistered or unscanned USB media used on bridge systems, or charts without a valid permit.

  1. Stop using the media and keep it for analysis.
  2. Check the ECDIS against the backup unit and the last good chart set.
  3. Reload charts from the chart agent through the approved route.

Satcom & remote access

Satcom terminals reachable from the internet, unsigned firmware, or remote sessions without a ticket or jump host.

  1. Close the exposed service or end the session.
  2. Confirm with the vendor or NOC on a known number.
  3. Patch or re-flash with signed firmware and review what was reached.

Network separation breaches

Traffic from crew or guest networks reaching bridge or engine control networks.

  1. Block the path at the firewall and find the missing rule.
  2. Identify and disconnect the source device.
  3. Check the controllers it reached for changes.

Control setpoint & mode tampering

Setpoint, mode or log changes on engine or ballast control with no watch, order or plan behind them.

  1. Have the watch take local manual control and restore safe values.
  2. End any remote session and isolate the source.
  3. Preserve controller logs and notify the master and company.

Port & shore credential abuse

Default passwords, credential stuffing, phishing or bulk data pulls with valid accounts.

  1. Reset the affected accounts and end their sessions.
  2. Check what each account accessed or exported.
  3. Turn on MFA everywhere, including legacy APIs.

FAQ

What is ECDIS?

The Electronic Chart Display and Information System is the bridge computer that shows electronic navigational charts and the ship's position. It is safety critical, so chart updates and media going into it are tightly controlled.

How can you tell GNSS spoofing from a bad receiver?

A faulty receiver usually loses signal or shows poor accuracy. Spoofing tends to show a strong, clean signal with a position that jumps or disagrees with radar and dead reckoning, often affecting several ships in the same area.

Why is AIS easy to fake?

AIS messages are broadcast by radio without authentication, so anyone with a transmitter can create targets that do not exist. Cross-checking AIS targets against radar is the basic defence.

Why should crew Wi-Fi never reach engine control?

Crew devices are personal and unmanaged. Engine and ballast controllers often accept commands without authentication, so any path from crew Wi-Fi to them could let a compromised phone change a live setpoint.

What do IMO cyber risk rules expect?

IMO Resolution MSC.428(98) requires cyber risks to be addressed in a ship's safety management system. In practice that means knowing your systems, separating networks, controlling remote access and having a response plan.

The tools people use most on PlayCISO.

All tools
🖤 Black Friday: new customers get 3 months of Pro for $5, then $5/month. Ends 30 Nov. See the deal