Maritime Cybersecurity Reading List
105 essential books for maritime cybersecurity professionals — from shipboard OT security to satellite threats, carefully curated by industry practitioners.
Featured Books
Our top picks for maritime cybersecurity professionals
Digital Transformation in Maritime Transportation and Logistics
Disclosure: chapter 14 (pp. 397-419) was written by Andrzej Gab, who curates this catalogue.
Cyber Wargaming: Research and Education for Security in a Dangerous Digital World
Maritime Cybersecurity — Core Titles
21 books
Maritime Cybersecurity: A Guide for Leaders and Managers
The definitive guide to maritime cybersecurity. Covers the intersection of the maritime transportation system and information security, including maritime cyber risk management, cyberattacks on shipping lines, port cybersecurity, threats against shipboard networks, GPS/AIS spoofing, threats against industrial control systems and autonomous vessels, and strategies for maritime cyberdefense. The authors maintain the text and a companion site of updated references; per that site the current text is the Second Edition (v2.3, dated 01/2025), published under the same Amazon listing as the 2022 first printing.
Digital Transformation in Maritime Transportation and Logistics
An IET edited volume on digital transformation in maritime transportation and logistics (720 pages, 2026), edited by Michele Fiorini and Dorota Książkiewicz. Disclosure: chapter 14, 'Maritime security and cybersecurity' (pp. 397-419), was written by Andrzej Gab, who curates this catalogue and earns an affiliate commission on Amazon links here. That chapter is 23 pages of a 720-page collection; the volume as a whole is the editors' work and that of the other contributors. Officially published 1 October 2026, available from IET since 15 September 2026.
Issues in Maritime Cyber Security
Pioneering academic work from CCICADA (DHS Center of Excellence at Rutgers). Addresses how cyber networks are a major component of the Maritime Transportation System. Beneficial as a textbook for courses on risk analysis, national security, cyber threats, or maritime policy.
Cyber Security Workbook for On Board Ship Use (7th Edition)
The industry-standard practical workbook for Masters and senior officers, updated annually; this is the 7th edition (262 pages, November 2025), produced by Witherbys with BIMCO and ICS. Aligned with IMO Resolution MSC.428(98), it contains checklists and annexes covering cyber security risk assessment and building a cyber security plan, and is written for ISM Code compliance work on board. Sold directly by the publisher rather than through Amazon.
Port Cybersecurity: Securing Critical Information Infrastructures and Supply Chains
Examines how ports assess cyber risks and vulnerabilities, with focus on Critical Information Infrastructure (CII) ecosystems. Author worked for European Commission and managed security projects for NSA, NATO, Greek Ministry of Defense, and European Commission.
Maritime Security: An Introduction (2nd Edition)
Comprehensive introduction to maritime security including cybersecurity. Explains how commercial seaports and vessels function, current threats, and security policies needed. New chapters on transnational crime, migration, and legal/cybersecurity issues.
Understanding Maritime Security
Latest academic perspective from Oxford University Press. Co-author advised UK Cabinet Office, Ministry of Defence, and Department for Transport on the 2022 UK National Strategy for Maritime Security. Covers evolving maritime security landscape including cyber threats.
Maritime Security: A Practical Guide for Mariners
Written by the Maritime Director of SAMI (Security Association for the Maritime Industry). Covers evolution of maritime security, ISPS Code compliance, and the rapidly developing area of cybersecurity.
2025 Maritime Security: A Comprehensive Guide for Shipowners, Seafarers and Administrations (2nd Edition)
Official ICS guidance covering all aspects of maritime security including cyber risk management. Essential reference for shipowners, operators, and maritime administrations implementing security programs.
Guide to Maritime Security & The ISPS Code (2021 Edition)
Official IMO publication incorporating guidance on maritime cyber risk management. Second edition includes updated sources supporting ISPS Code implementation. Essential for understanding the regulatory framework that governs maritime cybersecurity requirements.
Unmanned and Autonomous Ships
Explores automated shipping including cybersecurity implications. Covers ship design, command and control, navigation, communications, and security for autonomous vessels. Essential reading as MASS (Maritime Autonomous Surface Ships) become reality.
A Practitioner's Guide to Effective Maritime and Port Security
International perspective on port operations security covering ISPS Code implementation, facility security plans, port access control, and coordination challenges between vessel operators, port authorities, and national agencies.
BIMCO Guidelines on Cyber Security Onboard Ships (5th Ed.)
The authoritative industry guidance document co-authored by all major maritime associations and P&I clubs. Defines the framework for cyber risk assessment, crew training, incident response planning, and recovery procedures onboard. Aligned with IMO MSC-FAL.1/Circ.3 and the ISM Code.
Bridge Team Management (2nd Ed.)
Foundational text on bridge resource management (BRM) — the human factors framework governing how vessel bridge teams communicate, share situational awareness, and make decisions under pressure. Essential for maritime cyber scenarios affecting navigation systems.
Cyber-worthiness in Shipping: Law, Regulation and Practice
Examines how traditional maritime legal doctrines (seaworthiness, due diligence, liability) must adapt to cyber risk, introducing 'cyber-worthiness' as a legal standard for Maritime Autonomous Surface Ships and digitally-dependent conventional vessels. Written for maritime lawyers, P&I professionals, and compliance officers who need to understand the legal exposure created by IACS UR E26/E27 and IMO cyber risk requirements, rather than the technical controls themselves.
Ship Cyber Security Management Plan (1st Edition)
Witherbys' first standalone publication dedicated entirely to the Ship Cyber Security Management Plan, a topic previously covered only as a chapter within the Cyber Security Workbook for On Board Ship Use. Published in August 2026, this 112-page guide is built specifically to support the plan required under SMS/ISM cyber risk management. Produced jointly with BIMCO and the International Chamber of Shipping, and sold directly by the publisher rather than through Amazon.
Maritime Cybersecurity
An edited academic volume (248 pages, published open access in June 2025) bringing together 27 contributors from 13 countries as part of the MariCybERA project at TalTech. Chapters cover attack detection, vulnerabilities in electronic navigation including AIS spoofing, crew training, and simulator testbeds. Published by Springer Nature in the Signals and Communication Technology series, and freely available as an open-access PDF.
Marine Technology, Ocean Development and the Law of the Sea
A 430-page law-of-the-sea volume from Cambridge University Press, with editors affiliated with the World Maritime University and the US Naval War College, and available open access. Part III, 'Maritime Cyber Safety and Security' (pages 161-218), contains two full chapters directly relevant here: Chapter 6, 'Maritime Cyber Threats: Jamming and Spoofing of Commercial Vessels,' and Chapter 7, 'Vessel-Tracking Innovations: Promise and Peril.' The remainder of the book covers unrelated maritime law topics such as seabed mining and decarbonization.
Piracy, Armed Robbery and Conflict at Sea (2026-27 Edition)
This new edition (244 pages, published January 2026 by Witherbys with the International Chamber of Shipping) adds dedicated subsections on GNSS/AIS jamming and spoofing alongside its traditional coverage of piracy and armed robbery at sea. Cybersecurity readers gain operational context on how spoofing is used together with physical threats in high-risk zones. The book is not primarily a cybersecurity title — most of its content addresses conventional piracy and armed-robbery risk.
Guidelines for Collecting Maritime Evidence, Volume 2 (2nd Edition)
A 162-page Nautical Institute guide to collecting and preserving electronic evidence after a maritime incident, treating ECDIS, VDR, and AIS data as evidentiary material. This second edition adds a new chapter on the uses and risks of artificial intelligence in incident reconstruction. It is not a cyber-defense manual, but a companion to the post-incident side of the work — how onboard system data becomes evidence in a dispute or admiralty court — useful for practitioners handling incident response at sea.
Managing Legal Risks in Voyage Charterparties for Autonomous Ships
A legal monograph on owner-charterer liability in voyage charterparties for autonomous ships (MASS), published by Informa Law from Routledge, redefining seaworthiness for vessels operating without a crew. The subject borders on cybersecurity through autonomous systems and the concept of cyber-worthiness, but the book's focus is charterparty contract law rather than technical cyber defense.
Industrial Control Systems & OT Security
13 books
Industrial Cybersecurity: Efficiently monitor the cybersecurity posture of your ICS environment (2nd Edition)
Author has 20+ years of experience in industrial network design, pentesting, and threat hunting, currently Manager at Ernst and Young. Covers ICS technology, architectures, communication media, and protocols. Directly applicable to shipboard OT systems.
Hacking Exposed Industrial Control Systems: ICS and SCADA Security Secrets & Solutions
From the trusted Hacking Exposed series. Shows how to assess ICS exposure and develop risk management plans, use threat modeling, implement ICS penetration testing, and understand how attackers exploit industrial protocols.
Industrial Network Security: Securing Critical Infrastructure Networks for Smart Grid, SCADA, and Other Industrial Control Systems
Comprehensive guide to securing industrial networks. Covers unique protocols and applications that are foundation of ICS. Applicable to maritime SCADA systems.
Cybersecurity for Industrial Control Systems: SCADA, DCS, PLC, HMI, and SIS
Foundational text explaining how to develop and implement cybersecurity programs for ICS. Examines potential threats including malware, botnets, and outlines inherent ICS vulnerabilities. Essential for understanding shipboard control system security.
Cyber-security of SCADA and Other Industrial Control Systems
Part of Springer's Advances in Information Security series. Covers ICS cyber threats, attacks, metrics, risk, situational awareness, intrusion detection, and security testing. Tutorial chapters plus advanced topics on ICS governance and responses to attacks.
Handbook of SCADA/Control Systems Security
Fundamental outline of security concepts and methodologies pertaining to SCADA systems in critical utility and industrial systems. Essential reference for securing industrial automation and process control systems.
Cyber Security Operational Technology Best Practice
Practical guide to OT security in manufacturing, power generation, and transportation sectors. Addresses growing concerns about cyber attacks that can cause physical damage to equipment or disrupt essential services. Directly relevant to maritime OT environments.
Pentesting Industrial Control Systems
Hands-on guide to analyzing and navigating ICS intricacies. Covers setting up ICS lab, open source intel-gathering, SOPs for ICS penetration testing, and connecting OT to engineering workstations. Essential for maritime security assessors.
Engineering-Grade OT Security: A Manager's Guide
Written for non-technical managers who own OT security decisions. Cuts through compliance checkbox thinking to explain what actually reduces risk in industrial environments — with particular attention to the gap between IT security controls and what works in OT.
Securing Industrial Control Systems: Advanced Strategies and Technologies
A 544-page academic deep-dive into ICS/SCADA architecture, evolution, and security challenges, from field devices through supervisory systems. Covers controller-level APT mitigation, authentication hardening, AI/ML-based cyber resilience strategies, incident response, and threat intelligence for cyber-physical systems, with real-world case studies. Aimed at researchers, engineers, and advanced practitioners rather than newcomers to OT security.
Practical Industrial Cybersecurity: ICS, Industry 4.0, and IIoT
A practical, up-to-date guide from Wiley connecting classic ICS with Industry 4.0 and IIoT — exactly where ports and ships are being modernized today, from predictive sensors to remote engine diagnostics. Container-terminal automation such as STS cranes and IIoT sensors in a ship's engine room sit directly on the ICS/IIoT boundary the book teaches readers to secure and audit. It aligns with the SANS GICSP certification syllabus, giving readers a path to verify the resulting skills.
IoT and OT Security Handbook
This Packt Publishing handbook covers the Purdue model, OT threat hunting, and zero trust for OT, along with Microsoft Defender for IoT — a tool already deployed in a number of port environments. It provides a ready-made blueprint for segmenting and monitoring the OT network of a port terminal or engine control room along the same Purdue-model zones that BIMCO and IMO guidance already assumes.
Industrial Automation and Control System Security Principles (2nd Edition)
Despite the '2nd edition' label, this is a 2016 title, not a fresh 2024-2025 publication — but it remains the standard ISA reference textbook on IACS security principles, a gap in this catalog until now. It covers the fundamentals of IACS security, including PLC/DCS architecture and safety instrumented systems, that underlie any ship's ballast, cargo, or engine-room control automation.
Cyber-Physical Security & Critical Infrastructure
5 books
Cyber-Physical Attacks: A Growing Invisible Threat
How computers can disable systems and affect the physical world. Covers embedded systems, SCADA, and more. Written for non-experts and physical security professionals.
Critical Infrastructure Security: Cybersecurity Lessons Learned from Real-World Breaches
From introduction to critical infrastructure concepts through the vulnerability lifecycle. Covers real-world breaches and examines threats from DDoS to APTs. Essential for understanding how critical infrastructure attacks apply to maritime sector.
Maritime Critical Infrastructure Protection: DHS Need to Better Address Port Cybersecurity
Official GAO report on port cybersecurity vulnerabilities. Documents how US ports handle $1.3 trillion in cargo annually and how maritime stakeholders rely on ICT to manage cargo movement. Essential policy document for understanding regulatory landscape.
Countering Cyber Sabotage: Introducing Consequence-Driven, Cyber-Informed Engineering (CCE)
Presents Idaho National Laboratory's CCE methodology — a consequence-first approach to critical infrastructure security that starts by identifying worst possible outcomes and works backward to determine what an adversary must compromise.
The Fifth Domain: Defending Our Country, Our Companies, and Ourselves in the Age of Cyber Threats
Former White House cybersecurity coordinator provides a policy-level analysis of the cyber threat landscape, bridging national security policy and corporate cybersecurity with specific attention to critical infrastructure and regulatory frameworks.
Supply Chain Security
7 books
Supply Chain Security: A Comprehensive Approach
Tools for ensuring supply chain security including rapid response protocols. Author has 27+ years of experience in domestic and international logistics, trade, and transportation security.
Cyber Security and Supply Chain Management: Risks, Challenges, and Solutions
How firms can manage cyber risk in procurement, manufacturing, and logistics. Supply chain is often the core area of cyber vulnerability and first line of defense. Essential for understanding third-party risk in maritime operations.
Securing the Digital Supply Chain: Advances, Challenges, and Solutions
A roadmap for securing modern digital supply chains that combines foundational theory, organizational strategy, and emerging technologies. Covers attack-vector taxonomy specific to supply chains, critical infrastructure protection angles, blockchain and AI applications for supply chain security, and educational initiatives for building organizational capability. Part of Springer's Signals and Communication Technology series.
Digital Resilience in Supply Chains: Security, Governance, and AI Innovation
An edited academic volume exploring how digitalization reshapes supply chains through the lens of cybersecurity, data governance, and AI integration. Chapters address resilience strategies against digital disruption, governance frameworks for third-party risk, and practical AI applications in supply chain protection. Aimed at business professionals, engineers, and researchers rather than hands-on practitioners.
Software Supply Chain Security: Securing the End-to-End Supply Chain for Software, Firmware, and Hardware
The author co-chairs CISA working groups on SBOM, and this O'Reilly book systematically covers the IT, development, operations, manufacturing, and procurement roles in a software supply chain — the same problem shipping faces with the suppliers of onboard systems. Ships and ports run on OEM firmware, licensed software, and subcontracted OT components, and this book provides the SBOM practices and end-to-end controls needed just to know what is actually running on a vessel's or terminal's systems.
Software Transparency: Supply Chain Security in an Era of a Software-Driven Society
Written by Chris Hughes and Tony Turner, with technical contributions from CycloneDX co-creator Steve Springett and a foreword by former NTIA/CISA SBOM policy lead Allan Friedman, this is a reference treatment of software transparency. It goes deeper into SBOM practice than Crossley's book, which matters because classification societies and flag administrations are beginning to require an inventory of onboard and port software components before accepting cyber-resilience declarations.
Zero Trust and Third-Party Risk: Reduce the Blast Radius
A concrete, implementation-focused book, built around a fictional company case study, on applying zero trust to third-party risk, published by Wiley. It complements the SBOM-focused titles by Crossley and Hughes with the vendor-access-control layer that shipping still treats as an afterthought. Maritime operators depend on remote vendor access — OEM remote engine diagnostics, terminal OS support — and this book lays out a zero-trust architecture to constrain exactly the kind of access that has caused several real ransomware attacks on ports and shipowners.
Frameworks & Risk Management
6 books
Cybersecurity Risk Management: Mastering the Fundamentals Using the NIST Cybersecurity Framework
Fundamentals of cybersecurity risk planning using NIST Framework. Covers user and network infrastructure planning, plus detection tools and techniques. Perfect for maritime organizations implementing risk-based cybersecurity per IMO guidelines.
ISO 27001 Controls: A Guide to Implementing and Auditing (2nd Edition)
Implementing and auditing 93 controls to reduce information security risks. ISO 27001 is increasingly referenced in maritime cybersecurity requirements, including IACS E26/E27. Essential for compliance officers.
Cyberinsurance Policy: Rethinking Risk in an Age of Ransomware
Rigorous analysis of how cyber insurance has evolved — from early policies through NotPetya 'act of war' exclusion controversies to current coverage debates. Indispensable for ransom payment and insurance notification decisions.
How to Measure Anything in Cybersecurity Risk
Rigorous application of decision analysis to cybersecurity risk quantification. Challenges qualitative risk matrices and replaces them with calibrated probability estimates and Monte Carlo methods.
IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (8th Edition)
This eighth edition is fully updated to the ISO 27001/27002:2022 control set and is used as a recommended textbook on Open University and IBITGQ courses. Most port and shipowner boards pursuing ISO 27001 certification — often required by charterers or terminal operators — need a version aligned to the 2022 controls, since older editions still circulating in maritime are now outdated; it complements this catalog's existing ISO 27001 Controls title by covering ISMS governance rather than just the control list.
Effective Vulnerability Management: Managing Risk in the Vulnerable Digital Ecosystem
Published by Wiley in 2024, with co-author Nikki Robinson bringing critical-infrastructure security experience, this book treats vulnerability prioritization as a business risk process rather than a checklist. Ships and terminals carry OT/IT assets that cannot be patched on a normal cycle, and the risk-based approach here is exactly what a maritime CISO needs in place of the unworkable-at-sea advice to 'patch everything.'
Incident Response & Threat Hunting
9 books
Digital Forensics and Incident Response (3rd Edition)
Cutting-edge digital forensic activities and incident response with focus on ransomware attacks. Covers incident response frameworks and how to proactively use forensic skills in threat hunting. Essential for maritime incident responders.
Practical Threat Intelligence and Data-Driven Threat Hunting: A Hands-On Guide to Threat Hunting with the ATT&CK Framework and Open Source Tools
Roadmap to becoming a proficient threat hunter using MITRE ATT&CK Framework and open source tools. Learn to set up environment to centralize data, master data collection and analysis. Applicable to maritime SOC operations.
Ransomware and Cyber Extortion: Response and Prevention
The go-to practitioner reference on ransomware. Covers the full lifecycle: initial access vectors, dwell time, data exfiltration before encryption, ransom negotiation, payment mechanics, recovery, and post-incident hardening. One of the few books to treat negotiation as a technical discipline with its own methodology.
The Ransomware Book: Understand. Prevent. Recover. (2nd Ed.)
Notable for its explicit chapter dedicated to tabletop exercises. Takes a real-world operational approach: ransomware actor economics, affiliate models, negotiation case studies, and recovery playbooks drawn from hundreds of actual incidents.
Ransomware Protection Playbook
An actionable blueprint for detection, containment, and recovery. The playbook format makes it directly usable during and after incidents — sections can be printed and distributed as checklists. Useful for organizations building their first ransomware response procedure.
Incident Response Techniques for Ransomware Attacks
A forensics-focused guide that dissects the full kill chain — initial compromise, lateral movement, data staging, deployment — and explains how forensic investigators reconstruct timelines after the fact.
Intelligence-Driven Incident Response: Outwitting the Adversary
A methodological framework for integrating threat intelligence into incident response operations. Draws on the Diamond Model and F3EAD cycle to show how IR teams can pivot from reactive firefighting to adversary-led hunting.
Blue Team Handbook: Incident Response Edition (2nd Ed.)
A dense, practical quick-reference guide for incident responders — covering triage, evidence collection, network forensics, log analysis, malware identification, and communication protocols. Known as the 'Blue Team Bible'.
Incident Management for Industrial Control Systems
Published in 2024 by Packt, this is the only title found specifically on incident management for ICS rather than general IT — covering threat intelligence, monitoring, IR planning for IACS, and forensic methods across network, endpoint, log, and controller/firmware layers. It directly fills the OT incident-response gap: an incident in a ship's engine room or on a terminal crane cannot be handled with an IT playbook, and this book is written specifically for ICS/IACS forensics and response.
Cybersecurity Leadership & Crisis Management
4 books
CISO Compass: Navigating Cybersecurity Leadership Challenges with Insights from Pioneers
Comprehensive leadership reference drawing on insights from 75+ CISO practitioners. Covers building security programs, managing boards, handling incidents, navigating regulatory requirements, and leading during crises.
The CISO Mentor: Pragmatic Advice for Emerging Risk Management Leaders
Practical, direct advice for security leaders navigating the political and organizational realities of the CISO role. Focused on conversations, decisions, and trade-offs that define security leadership under pressure.
The CISO 3.0: A Guide to Next-Generation Cybersecurity Leadership
Argues that the CISO role has expanded beyond technical control into strategic business leadership, and shows how to translate risk into terms a board understands. Covers strategic planning, executive communication, and embedding security into organizational objectives, with concrete examples rather than abstract theory. Part of the Security, Audit and Leadership Series.
Lessons from the Frontlines: Insights from a Cybersecurity Career
A people-first leadership playbook distilled from 25+ years as a five-time CISO (currently CSO at Qualtrics), covering crisis response, building teams that perform without burning out, and honest accounts of professional failures alongside successes. Aimed at practicing and aspiring security leaders who want the human side of the job, not another controls framework.
Tabletop Exercises & Wargaming
9 books
Cybersecurity Tabletop Exercises: From Planning to Execution
The definitive practitioner guide to running cybersecurity tabletop exercises. Covers objective setting, scenario design, participant selection, facilitation techniques, inject management, and post-exercise reporting. Praised by IBM X-Force, Secureworks, FortiGuard.
The Craft of Wargaming: A Detailed Planning Guide for Defense Planners and Analysts
Written by three Naval Postgraduate School instructors, this Naval Institute Press guide lays out defense wargaming methodology step by step: initiation, design, development, play, and analysis. It supplies the sequence often missing from cyber exercise design for a shipowner or port — how to define decision objectives, select participants and opposing players, and build round-based mechanics instead of a loose script.
Peter Perla's The Art of Wargaming: A Guide for Professionals and Hobbyists
A canonical text in the field, written by a longtime Center for Naval Analyses analyst, examining why wargaming is done at all: the role of the player-decisionmaker, the role of the umpire or controller, and the boundary between simulation and game. It supplies a conceptual vocabulary — adjudication, umpire, free-form versus rigid — that transfers directly to designing a cyber exercise built around white cells and injects.
Successful Professional Wargames: A Practitioner's Handbook
A 518-page handbook on designing professional wargames outside the narrow military context, covering business, emergency services, and public administration applications. Its chapters on scenario selection, managing game time, and common facilitator mistakes translate directly into designing a cyber tabletop exercise for a terminal or shipowner.
Wargaming for Leaders: Strategic Decision Making from the Battlefield to the Boardroom
A bridge between military wargaming and decision-making games for the boardroom, written by the designer of the well-known board game Vietnam together with corporate advisers. It teaches how to translate a tabletop exercise into terms — risk, decision cost, time pressure — that will bring a shipowner's or port's board into the room, not just the IT/OT team.
Red Team: How to Succeed by Thinking Like the Enemy
A survey of red-teaming practice across the military, intelligence, aviation, and business, examining when a simulated adversary genuinely improves decisions and when it becomes theater — including organizational resistance and the 'captured' red team. Critical reading for anyone designing the attacker role in a cyber exercise so that it stays credible rather than cosmetic.
The Matrix Games Handbook: Professional Applications from Education to Analysis and Wargaming
Matrix games, a format devised by co-author Chris Engle, are the lightest, purely discursive form of wargaming — no board, dice, or computer — where players argue the consequences of their actions and an umpire judges the probability. This handbook amounts to a near-ready template for a cyber tabletop exercise at a port or shipowner: cheap to prepare, requiring no IT/OT simulator, yet still enforcing decision-making rigor. It walks through educational, analytical, and training applications step by step.
Cyber Wargaming: Research and Education for Security in a Dangerous Digital World
Edited by instructors at the Naval War College and the US Air War College, this Georgetown University Press volume is the only title here whose subject is literally cyber wargaming. It combines wargaming theory with examples specific to cyberspace: information effects, group decision-making under time pressure, the relationship between a cyber incident and nuclear escalation, and business resilience — the closest existing bridge between the military wargaming canon and designing an exercise for a shipowner or port.
The Crisis Simulation Handbook
A 433-page handbook devoted entirely to designing and running crisis simulations. Its chapter on building a scenario, storyboard, and exercise script is the most detailed treatment of the craft on this list, closer to practice than the academic wargaming volumes. The author runs crisis exercises commercially, so the material is written from a corporate-client perspective rather than a military one — a good fit for a shipowner's or port's board.
Cyber Attack Case Studies
18 books
The Art of Attack: Attacker Mindset for Security Professionals
Teaches security professionals to think like attackers — covering social engineering, physical penetration, and the psychology of manipulation. Directly applicable to insider threat scenarios.
Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers
The essential maritime cybersecurity case study — includes the most detailed published reconstruction of Maersk's catastrophic NotPetya infection: $300M in losses, 45,000 PCs wiped, 4,000 servers destroyed. Winner of the Cornelius Ryan Award.
Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon
Definitive account of Stuxnet — the first publicly acknowledged state-developed cyberweapon designed to cause physical destruction. The ICS attack methodology directly informs OT threat scenarios.
This Is How They Tell Me the World Ends: The Cyberweapons Arms Race
A New York Times journalist's decade-long investigation into the global zero-day market — governments paying millions for undisclosed vulnerabilities, a shadow economy that has made the world measurably less secure.
Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency
Focuses on blockchain forensics — how investigators trace cryptocurrency transactions that ransomware gangs assumed were untraceable. Directly relevant to ransom payment decision points.
The Art of Cyberwarfare: An Investigator's Guide to Espionage, Ransomware, and Organized Cybercrime
Structured analytical methodology for understanding adversary operations. Includes detailed analysis of the Colonial Pipeline attack: how DarkSide operated, detection opportunities missed, and how the response unfolded.
The Ransomware Hunting Team: A Band of Misfits' Improbable Crusade to Save the World from Cybercrime
Narrative non-fiction following volunteer researchers who reverse-engineer ransomware to create free decryptors. Provides unique insight into how ransomware works at the code level and the ecosystem of victims, responders, and criminals.
Fancy Bear Goes Phishing: The Dark History of the Information Age, in Five Extraordinary Hacks
A Yale law professor reconstructs five landmark hacks — from the Morris Worm to Fancy Bear's DNC intrusion — combining legal analysis, technical accuracy, and philosophical depth.
Chasing Shadows: Cyber Espionage, Subversion, and the Global Fight for Democracy
Ronald Deibert directs Citizen Lab, which has tracked dozens of deployments of Pegasus and other commercial spyware against journalists, lawyers, and activists worldwide. This Simon & Schuster book lays out the supply chain of cyber-mercenary firms — manufacturer, broker, government client — and argues that attribution requires legal and journalistic investigation, not malware analysis alone.
Ransom War: How Cyber Crime Became a Threat to National Security
Max Smeets, a cyber-conflict researcher at ETH Zurich and Stanford CISAC, uses concrete cases — including the state of emergency Costa Rica declared after the 2022 Conti attack — to trace how ransomware moved from ordinary crime to a national-security threat. Published by Hurst, the book's lesson is that a ransom paid in another country or sector shapes policy responses that later reach ports and shipowners as well.
Dark Screens: Hackers and Heroes in the Shadowy World of Ransomware
Anja Shortland, author of Kidnap: Inc. on the kidnap-for-ransom market, analyzes NotPetya, WannaCry, and other major ransomware campaigns through the economics of illicit markets — who pays, who negotiates, and how ransom infrastructure functions. Published by PublicAffairs, it frames ransomware as a market with rules rather than a series of isolated technical incidents, and was longlisted for the FT/Schroders Business Book of the Year 2026.
Cyber Recon: My Life in Cyber Espionage and Ransomware Negotiation
Kurtis Minder founded GroupSense (later acquired by Cognyte), a firm that negotiates directly with ransomware groups, and this Wiley book gives a first-hand account of real ransom negotiations and attacker profiles. It is a rare view from the other side of the table — useful for anyone who may one day have to decide whether to pay.
Dark Wire: The Incredible True Story of the Largest Sting Operation Ever
Joseph Cox, co-founder of 404 Media, reconstructs Operation Anom, in which the FBI ran a fake encrypted-phone company for years to eavesdrop on organized crime worldwide. Published by PublicAffairs, the lesson is that the most effective attack can be compromising a trusted communications supplier rather than an exploit — a theme close to supply-chain risk in the maritime sector.
Hack to The Future: How World Governments Relentlessly Pursue and Domesticate Hackers
Emily Crose, a former CIA/NSA/INSCOM intelligence officer now at Sophos Labs, traces how governments have turned independent hackers into instruments of state policy, from the Morris Worm to today's APT groups. Published by Wiley, it maps the motivations and recruitment patterns on the other side of an attack.
Scam: Inside Southeast Asia's Cybercrime Compounds
Based on accounts from survivors of forced-labor compounds in Southeast Asia used to run mass online 'pig-butchering' scams, this Verso Books report documents an industrial scale of cybercrime built on human trafficking. It is a different mechanism than an APT campaign or ransomware, but part of the same threat ecosystem that the financial and logistics sectors encounter.
New Cold Wars: China's Rise, Russia's Invasion, and America's Struggle to Defend the West
David Sanger, a Pulitzer-winning New York Times correspondent, situates state cyber operations — Russian ransomware used as a tool of diplomacy, Chinese espionage campaigns — within the broader context of great-power rivalry. Published by Crown, it offers valuable geopolitical context, but it is fundamentally a foreign-policy book with a cyber thread rather than the reverse.
Means of Control: How the Hidden Alliance of Big Tech and Government Is Creating a New American Surveillance State
Byron Tau, a Pulitzer-winning investigative journalist, documents how government agencies bypass legal restrictions by purchasing location and behavioral data from data brokers and ad-tech firms. Published by Crown, it sits close to the surveillance and cyber-mercenary theme covered elsewhere on this list, but its focus is the data market rather than attacks or exploits.
Rinsed: From Cartels to Crypto - How the Tech Industry Washes Money for the World's Deadliest Crooks
Geoff White, author of The Lazarus Heist about North Korea's raid on Bangladesh Bank, describes how criminal groups such as Lazarus use cryptocurrency and technology platforms to launder stolen funds. Published by Penguin Books UK, it completes the attack narrative by showing what happens to ransom payments and stolen money after the breach.
Security Awareness & Culture
4 books
Cybersecurity ABCs: Delivering Awareness, Behaviours and Culture Change
Guide to creating enhanced security culture through improved understanding and practice at individual level. Key awareness, behaviour and culture concepts from the ground up. Essential for maritime organizations addressing the human factor in cybersecurity.
Cybersecurity Culture: Using Behavioural Science to Protect Your Organization
Applies behavioural science and change-management theory to build organizational cybersecurity culture, aimed at senior executives, CISOs, and directors rather than awareness-program operators. Provides strategic models for shaping culture, aligning governance, and measuring results across the organization rather than tactical training content.
Human Factors in Cybersecurity: Building Security Cultures That Put People at the Center
Argues that roughly 95% of incidents trace back to human factors rather than technical failure, and builds a practical framework covering cognitive biases, incident response, Zero Trust adoption, behavioural analytics, and security-team resilience. Written by the founder of Cyber Security Unity (now the AI and Cyber Security Association), an MBE recipient for services to cybersecurity and DEI — a recognizable, verifiable practitioner rather than an anonymous byline.
The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer
A practitioner treatment of measuring and building security culture, built around co-author Kai Roer's Security Culture Framework and published by Wiley. Crews and shore staff rotate, work shifts, and often have limited exposure to cybersecurity topics, and the measurable approach to culture-building here fits that structure better than generic office-style awareness training.
AI Systems Security
3 books
AI Security Engineering: Design, Build, and Secure Dependable AI Systems
A practical engineering guide to securing AI systems in production — threat models, secure pipelines, runtime detection and response, governance at scale, and agentic-system risk — written from the perspective of security applied to AI, not AI applied to security. Not maritime- or industrial-specific, but directly relevant to the AI-security gap in this catalog: readers assessing autonomous-shipping AI or industrial AI copilots will find the underlying engineering discipline here. Author is a practicing CISO advising Fortune 500 organizations on AI security.
Not with a Bug, But with a Sticker: Attacks on Machine Learning Systems and What to Do About Them
Published by Wiley with security researcher Bruce Schneier among its co-authors, this is a general-audience treatment of attacks against machine-learning systems. As ports and ships adopt ML-based anomaly detection and perception systems for autonomous navigation, it shows how those same models can be fooled or poisoned — an AI risk maritime is only beginning to prepare for.
The Developer's Playbook for Large Language Model Security: Building Secure AI Applications
The author co-leads the OWASP Gen AI Security Project and its OWASP Top 10 for LLM list, drawing on input from 400+ industry experts; this O'Reilly book won a 2024 Cyber Defense Magazine award and provides concrete engineering guidance rather than threat theory alone. Port and shipping companies are now deploying LLM assistants and chatbots in logistics and customer service, and this book supplies the OWASP Top 10-based threat model needed to secure that new class of attack surface.
Tabletop Exercises — Recommended Reading
Curated reading list for Ogmios Maritime Cybersecurity Tabletop Exercise participants
Maritime Cybersecurity: A Guide for Leaders and Managers
The definitive guide to maritime cybersecurity. Covers the intersection of the maritime transportation system and information security, including maritime cyber risk management, cyberattacks on shipping lines, port cybersecurity, threats against shipboard networks, GPS/AIS spoofing, threats against industrial control systems and autonomous vessels, and strategies for maritime cyberdefense. The authors maintain the text and a companion site of updated references; per that site the current text is the Second Edition (v2.3, dated 01/2025), published under the same Amazon listing as the 2022 first printing.
Issues in Maritime Cyber Security
Pioneering academic work from CCICADA (DHS Center of Excellence at Rutgers). Addresses how cyber networks are a major component of the Maritime Transportation System. Beneficial as a textbook for courses on risk analysis, national security, cyber threats, or maritime policy.
Maritime Security: An Introduction (2nd Edition)
Comprehensive introduction to maritime security including cybersecurity. Explains how commercial seaports and vessels function, current threats, and security policies needed. New chapters on transnational crime, migration, and legal/cybersecurity issues.
A Practitioner's Guide to Effective Maritime and Port Security
International perspective on port operations security covering ISPS Code implementation, facility security plans, port access control, and coordination challenges between vessel operators, port authorities, and national agencies.
BIMCO Guidelines on Cyber Security Onboard Ships (5th Ed.)
The authoritative industry guidance document co-authored by all major maritime associations and P&I clubs. Defines the framework for cyber risk assessment, crew training, incident response planning, and recovery procedures onboard. Aligned with IMO MSC-FAL.1/Circ.3 and the ISM Code.
Bridge Team Management (2nd Ed.)
Foundational text on bridge resource management (BRM) — the human factors framework governing how vessel bridge teams communicate, share situational awareness, and make decisions under pressure. Essential for maritime cyber scenarios affecting navigation systems.
Industrial Cybersecurity: Efficiently monitor the cybersecurity posture of your ICS environment (2nd Edition)
Author has 20+ years of experience in industrial network design, pentesting, and threat hunting, currently Manager at Ernst and Young. Covers ICS technology, architectures, communication media, and protocols. Directly applicable to shipboard OT systems.
Hacking Exposed Industrial Control Systems: ICS and SCADA Security Secrets & Solutions
From the trusted Hacking Exposed series. Shows how to assess ICS exposure and develop risk management plans, use threat modeling, implement ICS penetration testing, and understand how attackers exploit industrial protocols.
Industrial Network Security: Securing Critical Infrastructure Networks for Smart Grid, SCADA, and Other Industrial Control Systems
Comprehensive guide to securing industrial networks. Covers unique protocols and applications that are foundation of ICS. Applicable to maritime SCADA systems.
Engineering-Grade OT Security: A Manager's Guide
Written for non-technical managers who own OT security decisions. Cuts through compliance checkbox thinking to explain what actually reduces risk in industrial environments — with particular attention to the gap between IT security controls and what works in OT.
Countering Cyber Sabotage: Introducing Consequence-Driven, Cyber-Informed Engineering (CCE)
Presents Idaho National Laboratory's CCE methodology — a consequence-first approach to critical infrastructure security that starts by identifying worst possible outcomes and works backward to determine what an adversary must compromise.
The Fifth Domain: Defending Our Country, Our Companies, and Ourselves in the Age of Cyber Threats
Former White House cybersecurity coordinator provides a policy-level analysis of the cyber threat landscape, bridging national security policy and corporate cybersecurity with specific attention to critical infrastructure and regulatory frameworks.
Cyberinsurance Policy: Rethinking Risk in an Age of Ransomware
Rigorous analysis of how cyber insurance has evolved — from early policies through NotPetya 'act of war' exclusion controversies to current coverage debates. Indispensable for ransom payment and insurance notification decisions.
How to Measure Anything in Cybersecurity Risk
Rigorous application of decision analysis to cybersecurity risk quantification. Challenges qualitative risk matrices and replaces them with calibrated probability estimates and Monte Carlo methods.
Ransomware and Cyber Extortion: Response and Prevention
The go-to practitioner reference on ransomware. Covers the full lifecycle: initial access vectors, dwell time, data exfiltration before encryption, ransom negotiation, payment mechanics, recovery, and post-incident hardening. One of the few books to treat negotiation as a technical discipline with its own methodology.
The Ransomware Book: Understand. Prevent. Recover. (2nd Ed.)
Notable for its explicit chapter dedicated to tabletop exercises. Takes a real-world operational approach: ransomware actor economics, affiliate models, negotiation case studies, and recovery playbooks drawn from hundreds of actual incidents.
Ransomware Protection Playbook
An actionable blueprint for detection, containment, and recovery. The playbook format makes it directly usable during and after incidents — sections can be printed and distributed as checklists. Useful for organizations building their first ransomware response procedure.
Incident Response Techniques for Ransomware Attacks
A forensics-focused guide that dissects the full kill chain — initial compromise, lateral movement, data staging, deployment — and explains how forensic investigators reconstruct timelines after the fact.
Intelligence-Driven Incident Response: Outwitting the Adversary
A methodological framework for integrating threat intelligence into incident response operations. Draws on the Diamond Model and F3EAD cycle to show how IR teams can pivot from reactive firefighting to adversary-led hunting.
Blue Team Handbook: Incident Response Edition (2nd Ed.)
A dense, practical quick-reference guide for incident responders — covering triage, evidence collection, network forensics, log analysis, malware identification, and communication protocols. Known as the 'Blue Team Bible'.
CISO Compass: Navigating Cybersecurity Leadership Challenges with Insights from Pioneers
Comprehensive leadership reference drawing on insights from 75+ CISO practitioners. Covers building security programs, managing boards, handling incidents, navigating regulatory requirements, and leading during crises.
The CISO Mentor: Pragmatic Advice for Emerging Risk Management Leaders
Practical, direct advice for security leaders navigating the political and organizational realities of the CISO role. Focused on conversations, decisions, and trade-offs that define security leadership under pressure.
Cybersecurity Tabletop Exercises: From Planning to Execution
The definitive practitioner guide to running cybersecurity tabletop exercises. Covers objective setting, scenario design, participant selection, facilitation techniques, inject management, and post-exercise reporting. Praised by IBM X-Force, Secureworks, FortiGuard.
The Craft of Wargaming: A Detailed Planning Guide for Defense Planners and Analysts
Written by three Naval Postgraduate School instructors, this Naval Institute Press guide lays out defense wargaming methodology step by step: initiation, design, development, play, and analysis. It supplies the sequence often missing from cyber exercise design for a shipowner or port — how to define decision objectives, select participants and opposing players, and build round-based mechanics instead of a loose script.
Peter Perla's The Art of Wargaming: A Guide for Professionals and Hobbyists
A canonical text in the field, written by a longtime Center for Naval Analyses analyst, examining why wargaming is done at all: the role of the player-decisionmaker, the role of the umpire or controller, and the boundary between simulation and game. It supplies a conceptual vocabulary — adjudication, umpire, free-form versus rigid — that transfers directly to designing a cyber exercise built around white cells and injects.
Successful Professional Wargames: A Practitioner's Handbook
A 518-page handbook on designing professional wargames outside the narrow military context, covering business, emergency services, and public administration applications. Its chapters on scenario selection, managing game time, and common facilitator mistakes translate directly into designing a cyber tabletop exercise for a terminal or shipowner.
Wargaming for Leaders: Strategic Decision Making from the Battlefield to the Boardroom
A bridge between military wargaming and decision-making games for the boardroom, written by the designer of the well-known board game Vietnam together with corporate advisers. It teaches how to translate a tabletop exercise into terms — risk, decision cost, time pressure — that will bring a shipowner's or port's board into the room, not just the IT/OT team.
Red Team: How to Succeed by Thinking Like the Enemy
A survey of red-teaming practice across the military, intelligence, aviation, and business, examining when a simulated adversary genuinely improves decisions and when it becomes theater — including organizational resistance and the 'captured' red team. Critical reading for anyone designing the attacker role in a cyber exercise so that it stays credible rather than cosmetic.
The Matrix Games Handbook: Professional Applications from Education to Analysis and Wargaming
Matrix games, a format devised by co-author Chris Engle, are the lightest, purely discursive form of wargaming — no board, dice, or computer — where players argue the consequences of their actions and an umpire judges the probability. This handbook amounts to a near-ready template for a cyber tabletop exercise at a port or shipowner: cheap to prepare, requiring no IT/OT simulator, yet still enforcing decision-making rigor. It walks through educational, analytical, and training applications step by step.
Cyber Wargaming: Research and Education for Security in a Dangerous Digital World
Edited by instructors at the Naval War College and the US Air War College, this Georgetown University Press volume is the only title here whose subject is literally cyber wargaming. It combines wargaming theory with examples specific to cyberspace: information effects, group decision-making under time pressure, the relationship between a cyber incident and nuclear escalation, and business resilience — the closest existing bridge between the military wargaming canon and designing an exercise for a shipowner or port.
The Crisis Simulation Handbook
A 433-page handbook devoted entirely to designing and running crisis simulations. Its chapter on building a scenario, storyboard, and exercise script is the most detailed treatment of the craft on this list, closer to practice than the academic wargaming volumes. The author runs crisis exercises commercially, so the material is written from a corporate-client perspective rather than a military one — a good fit for a shipowner's or port's board.
The Art of Attack: Attacker Mindset for Security Professionals
Teaches security professionals to think like attackers — covering social engineering, physical penetration, and the psychology of manipulation. Directly applicable to insider threat scenarios.
Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers
The essential maritime cybersecurity case study — includes the most detailed published reconstruction of Maersk's catastrophic NotPetya infection: $300M in losses, 45,000 PCs wiped, 4,000 servers destroyed. Winner of the Cornelius Ryan Award.
Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon
Definitive account of Stuxnet — the first publicly acknowledged state-developed cyberweapon designed to cause physical destruction. The ICS attack methodology directly informs OT threat scenarios.
This Is How They Tell Me the World Ends: The Cyberweapons Arms Race
A New York Times journalist's decade-long investigation into the global zero-day market — governments paying millions for undisclosed vulnerabilities, a shadow economy that has made the world measurably less secure.
Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency
Focuses on blockchain forensics — how investigators trace cryptocurrency transactions that ransomware gangs assumed were untraceable. Directly relevant to ransom payment decision points.
The Art of Cyberwarfare: An Investigator's Guide to Espionage, Ransomware, and Organized Cybercrime
Structured analytical methodology for understanding adversary operations. Includes detailed analysis of the Colonial Pipeline attack: how DarkSide operated, detection opportunities missed, and how the response unfolded.
The Ransomware Hunting Team: A Band of Misfits' Improbable Crusade to Save the World from Cybercrime
Narrative non-fiction following volunteer researchers who reverse-engineer ransomware to create free decryptors. Provides unique insight into how ransomware works at the code level and the ecosystem of victims, responders, and criminals.
Fancy Bear Goes Phishing: The Dark History of the Information Age, in Five Extraordinary Hacks
A Yale law professor reconstructs five landmark hacks — from the Morris Worm to Fancy Bear's DNC intrusion — combining legal analysis, technical accuracy, and philosophical depth.