OT security for ports
Protect the port, from the gate to the quay
A port has control systems, engineering workstations and many cameras. Vendors need to reach their equipment, sometimes in the middle of the night. XoT hides the equipment and decides who can reach it, without you replacing anything.
The situation
Why ports are especially exposed
Long-lived equipment
Cranes, gates, lighting, shore power and reefer outlets are run by PLCs and SCADA. Much of the equipment rarely gets security updates.
Many vendors
Every vendor wants to reach its own equipment. The result is 4G modems, TeamViewer and accounts in the port's VPN.
Shared quays
The port company, terminal operators and other companies often share the area and the network.
Around-the-clock operations
The port never closes. A fault in the middle of the night can keep a ship at the quay.
Start by finding out which equipment is connected and what it talks to. Traffic Discovery shows which traffic passes through the Locks.
Laws
Several sets of rules apply to the same port
The examples below come from Sweden. Other EU countries have similar laws, because NIS2 and CER are EU directives.
NIS2
Water transport is part of the transport sector in NIS2. It covers ports and companies that operate equipment in ports, among others. In Sweden the Swedish Transport Agency supervises the transport sector.
Port security
The Swedish Port Security Act and the ISPS Code require protection against terrorism and other deliberate attacks. The Swedish Transport Agency supervises this too. Cameras and access control are often part of the protection.
CER
Transport is also part of CER, which is about resilience. Sweden is introducing CER through a new law.
Protective Security Act
Many ports matter to Sweden's national security. Then the Swedish Protective Security Act also applies.
In Sweden, a significant incident is reported to the NCSC in three steps: within 24 hours, within 72 hours and with a final report within one month. The logs in the XMS show who connected to what and when. That gives you input for the report.
Read about NIS2Read about CERRead about the Protective Security Act
Where to start
Start with engineering workstations and SCADA
An engineering workstation (EWS) and a SCADA system reach many machines. That makes them a good place to start. We have protected both EWS and SCADA in port operations with Hide and Protect.
Engineering workstations
The workstation becomes invisible to anyone without an authorisation. Only the people allowed to use it can reach it, and every connection is logged.
SCADA
A Lock sits in front of the SCADA server. Only the traffic that is needed may pass between SCADA and the equipment on the quay.
Read about Hide and ProtectSee the engineering workstation example
Cameras
Cameras at quays and gates
A port often has many cameras. They sit in places that are easy to reach, and many are rarely updated.
No outbound traffic
A Lock in front of the cameras can stop all traffic out of them, including to the manufacturer. A policy decides which traffic may pass, for example only to your VMS.
802.1X
The Lock can sign in to the switch on behalf of cameras that cannot do 802.1X themselves.
Axis
In Axis cameras the Lock is also available as an ACAP app, for remote access to the camera.
Vendors
Vendors who want to keep their own access
TeamViewer
The vendor can keep using it, but through XoT-WebAccess. The port then sees who connects and when.
Their own modem
The vendor's modem can stay. The port puts an XoT-S1 between the modem and the equipment. The port then decides who may connect, sees what they connect to and gets a log of every connection.
Approval of every connection
The vendor requests access, and someone at the port approves it. The person who requests access cannot approve their own request. The access ends by itself.
Shared quays
Several companies in the same XMS
The port company and the terminal operators can use the same XMS and still be kept fully apart. Each company sees only its own equipment and approves its own requests.
Around the clock
When something happens at three in the morning
24/7 support
It is offered through our partner Telia Cygate. Our own support is open on working days, 08–17 Swedish time.
Emergency access
If nobody can approve a request, a hardware key is used. The key can be kept by the guard or in a safe. It also needs a PIN, which the technician gets from the control room. Everything is logged.
If a Lock fails
It then lets no traffic through. The same applies during a power cut. With two Locks for the same equipment, the second takes over after about two minutes. A restart takes less than 33 seconds.
Where the Lock should not sit
Do not put a Lock in front of emergency stops or other safety functions. They must work even when the network does not.
Where XoT runs
All of XoT can run on your premises, without internet
XoT can run in your own data centre, fully separated from the internet. Updates are then installed offline. The only part you always need is the XMS. You choose the rest based on what you need to solve, for example the XoT-S1, Virtual XoT or XoT-WebAccess.
XoT is developed in Sweden, and the XoT-S1 hardware is designed and manufactured in Sweden.
Next steps
From the first question to a pilot
1. Send your questions in writing
Send us your questions. We are happy to send a quality description, an SBOM and other input for your supplier assessment. You get penetration test reports under a non-disclosure agreement.
2. Talk to a reference
We can put you in touch with a customer in port operations. The customer decides whether to take part.
3. Workshop on site
We are happy to visit you. There we map the site together with you and your vendors.
4. Pilot
We have no ready-made pilot package. A pilot could look like the example below.
Example of a pilot
- One case, for example a vendor's remote access to an engineering workstation or a SCADA system.
- Two to three months.
- Success criteria that we agree on together before the pilot starts.
- Your own test. Your penetration testing partner is welcome to try to get past the Lock.
In Sweden, a pilot with a few machines usually fits within a direct award. If you are a member of the purchasing body Sinfra, you can buy through our partners Plantvision and Telia Cygate.
Common questions
Does XoT work with our industrial protocols?
Yes, for protocols over TCP and UDP, such as Modbus TCP, OPC UA, S7 and IEC 60870-5-104. Layer 2 protocols do not pass the Lock as they are. Equipment that talks to each other on layer 2 therefore sits behind the same Lock.
Do we have to rebuild the network?
No. The Lock sits in front of the equipment, and the equipment does not need to change.
What happens if the XMS cannot be reached?
Connections that are already open keep working as long as the access tickets are valid. New policies and changes require the XMS.
Is there a partner near us?
See which partners we have, or ask us. We will then suggest the one that suits you best.
Is XoT enough to comply with NIS2?
No. XoT helps with several of the measures, but the law requires more. We have gone through which ones.
What we write about laws is our interpretation. It is not legal advice.
Start with one vendor
Choose the vendor access that worries you most today.