Digitization is reshaping the maritime industry which is under increasing pressure to transform. Technology is more common as it offers improvements and carves out early adapters as more competitive. COVID-19 hastens digitization and creates new digital opportunity structures which increase cyber risks. Cyber attacks, which can cripple critical systems and services at significant cost, motivate stakeholders to engage with these risks. This paper reviews current events and introduces an exercise where participants at a NATO Centre of Excellency were shown scenarios involving maritime cyber incidents and evaluated on cyber risk perception. Our findings lend insight on how to assess group cyber risk perception—and how this impacts response. They highlight the need to plan for cyberspace operations and ground cyber risks as a intricate governing factor in maritime.

No abstract

This document is the author's post-print version, incorporating any revisions agreed during the peer-review process. Some differences between the published version and this version may remain and you are advised to consult the published version if you wish to cite from it.

No abstract

Decision-makers are often confronted with cybersecurity challenges, which they may not fully comprehend but nonetheless need to critically address. Efficient preparation through cybersecurity games has become an invaluable tool to better prepare strategy and response to cyber incidents. Such games offer the potential for capacity building of decision-makers through a controlled environment, often presenting hypothetical scenarios that are designed to invoke discussion, while decision-making skills are put to the test. While games are acknowledged to be an effective method for such situations, many rely on technical capabilities to address these challenges. However, a key challenge is to understand the factors that influence cybersecurity decision-making. Further, game effectiveness for developing these skills is often not validated. This paper surveys cybersecurity games and compiles a data-set of 46 games to investigate how effective cybersecurity games are for assessing decision-making skills, and determines the state-of-the-art game. Through critical review and analysis of the data-set, a criteria to assess games for decision-making skills is presented. Furthermore, the criteria is applied to ten games, which determined Cyber 9/12 to be the state-of-the-art cybersecurity game for decision-making. The paper concludes with insights into how the assessment criteria can support the development of better decision-making skills through games.