Διαχείριση κινδύνου ασφάλειας λιμενικών εγκαταστάσεων πληροφορικής
Cyber risk management of port facilities
View/
Keywords
Κυβερνοασφάλεια λιμένων ; Ανάλυση κινδύνου (ISO/IEC 27005) ; Σύγκλιση IT/OT ; MONARC ; Προστασία κρίσιμων υποδομώνAbstract
The rapid digitalization and convergence of Information Technology (IT) and Operational Technology (OT) in modern port infrastructures has significantly expanded the cyber-attack surface, rendering traditional, fragmented security management insufficient. This thesis develops and practically applies a comprehensive cyber risk analysis methodology for port facilities, adopting an explicit Dual Approach that examines both the information and industrial environments as a single, interdependent system.
Methodologically, the study combines the international standard ISO/IEC 27005, the IEC 62443 series, and guidance from the European Union Agency for Cybersecurity (ENISA), applied in practice through the open-source software MONARC on a hypothetical Container Terminal. Following theoretical mapping of assets, threats, and vulnerabilities, eight targeted attack scenarios were quantitatively assessed. Results empirically confirmed the differentiation of security priorities between IT (CIA model, maximum impact level 3) and OT (AIC/Safety model, maximum impact level 4, reflecting explicit human-life risk scenarios). Implementation of eight targeted countermeasures, based on ISO/IEC 27002 and IEC 62443, achieved an average risk reduction of approximately 70%. The study concludes with the establishment of security policies, operational procedures, and a Business Continuity Plan, with recovery indicators derived directly and traceably from the risk assessment data. The work contributes a reproducible methodology that addresses the standardization gap identified by ENISA for European ports.