Publication details
Design and exploratory evaluation of a digital tabletop exercise for maritime cybersecurity
| Authors | |
|---|---|
| Year of publication | 2026 |
| Type | Peer-reviewed scientific article |
| Magazine / Source | Computers and Security |
| MU Faculty or unit | |
| Citation | |
| web | https://doi.org/10.1016/j.cose.2026.105039 |
| Doi | https://doi.org/10.1016/j.cose.2026.105039 |
| Keywords | Maritime cybersecurity; Threat modeling; Cybersecurity education; Tabletop exercise; INJECT |
| Attached files | |
| Description | The increasing digitalization of maritime navigation systems has exposed cyber-physical ship operations to data manipulation attacks such as Automatic Identification System (AIS) spoofing. This creates a need for structured and digitally supported approaches to maritime cyber incident investigation. This paper presents the design and exploratory evaluation of a digital tabletop exercise delivered through the INJECT exercise platform (IXP) and structured around the Process for Attack Simulation and Threat Analysis (PASTA) methodology. The exercise simulates an AIS spoofing incident and guides participants through system interpretation, adversarial reasoning, log analysis, and structured incident reporting. The scenario was deployed in two educational settings: an in-person session with 40 Bachelor-level cybersecurity students and an online session with 16 Master-level students. Pre-and post-exercise questionnaires and platform interaction logs were analyzed to examine participant-rated outcomes, scenario progression, investigation workflows, and collaboration patterns. The results show statistically significant pre-post increases in questionnaire-based measures of self-reported incident-analysis confidence and self-assessed understanding of threat modeling. Both cohorts reported increases in these measures, while collaboration patterns differed descriptively across the two deployments. The findings suggest that IXP can be used to structure scenario-bounded maritime cyber-physical incident analysis in educational settings. |
| Related projects: |