Ports are critical infrastructure, and especially heterogeneous
A port is a hub of the supply chain. If it goes down, the flow of goods for an entire region stalls. This is why larger sea and inland ports belong to the KRITIS sector transport and traffic and, depending on the threshold, fall under KRITIS obligations or NIS-2.
The particular challenge: here, classic IT (terminal operating systems, booking and customs systems, administration) meets extensive operational technology (OT):
- terminal operating systems and handling control
- crane and loading technology, automated transport vehicles
- lock, weir and bridge control in the inland sector
- traffic and vessel control systems, shore power facilities
- SCADA systems, programmable logic controllers (PLC) and field buses
Why OT needs different priorities than IT
OT security is not an IT pentest on different hardware. The priorities are shifted: in OT, availability comes first; a control system must not simply restart while a crane is holding a load. Plants often run for decades, cannot be patched at will, and an error has physical consequences for people and material.
That is why we proceed differently here: we coordinate the approach, time window and test depth closely with your operations and deliberately work cautiously in sensitive areas, for example with passive analysis and tests in maintenance windows or on test rigs. Methodologically, we follow BSI IT-Grundschutz, which with its layer for industrial IT (IND) provides dedicated building blocks for operational and control technology. The goal is insight without operational interruption.
What we do for you
- Penetration tests for IT and OT: from office and terminal IT through the IT/OT boundaries to control components, tuned to the sensitivity of each zone.
- Architecture reviews of network segmentation: the clean separation of IT and OT is the most important protective measure. We check whether it holds.
- KRITIS and NIS-2 support: Section 8a-usable evidence and ISMS build-up that takes OT into account.
- Attack simulations with OT-relevant scenarios, when you want to know how far an attacker would get from IT into OT.
Why zentrust for ports
- OT from hands-on training: our co-founder and managing director Sven Faßbender is a trained electronics technician for industrial engineering and a state-certified technician in electrical engineering. We know control and plant technology not only from pentesting but from practice.
- We know critical infrastructure and its evidence obligations, as a BSI-certified IS penetration testing service provider (evidence about us).
- Operations before academics: our recommendations take into account that a plant must keep running. We do not deliver a list of findings that cannot be implemented in port operations.
- One hand for both worlds: the same people test and advise on IT and OT, without a handover between teams.