OT Segmentation and Secure Cloud Connectivity for a Container Terminal Operator
Crane and gate control separated from the business network, terminal by terminal, without a single missed vessel window.
Client name withheld by agreement- Client
- Marine container terminal operator, 3 terminals
- Region
- Elizabeth, New Jersey and Charleston, South Carolina
- Year
- 2026 · Ongoing
- Duration
- 32 weeks
- Scope
- 3 terminals · 41 ship-to-shore and yard cranes · automated gates · AWS
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
A marine container terminal operator runs three terminals with ship-to-shore cranes, automated yard cranes and optical-recognition truck gates. Its terminal operating system had moved to AWS, and crane and gate controllers now reached it over the same network as office laptops and vendor connections.
The U.S. Coast Guard’s maritime cybersecurity rule now requires a cybersecurity plan, network segmentation and incident reporting at facilities like these. Terminals work around the clock to vessel schedules, and a change that stopped a crane during a vessel window would cost the operator and its shipping line customers.
What we did
The approach, step by step.
- 01
Controllers and flows inventoried
Passive monitoring identified every crane PLC and gate system and the connections each genuinely needs, including the few that must reach the terminal operating system in AWS.
- 02
Zones cut between vessel calls
Business, terminal operations and crane control were separated into enforced zones, with each cutover scheduled between vessel calls and a tested rollback ready.
- 03
Cloud links through enforcement points
Connections to AWS run over private links through inspection points, and only the flows the terminal operating system needs are allowed.
- 04
Vendor access recorded
Crane and gate vendors now connect through identity-based, recorded sessions limited to the equipment they support, replacing always-on remote tools.
- 05
Penetration tests after every phase
Network penetration tests from the business network and from a vendor connection confirm after each phase that crane control can no longer be reached.
Outcomes
What changed, in numbers.
- 41
- cranes in the segmentation program
- 0
- vessel windows missed during cutovers
- 14
- always-on vendor remote tools removed
- 3
- terminals under one cybersecurity plan
The Coast Guard asked for a plan. We were able to show them a network that already matched it.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
Boston, Massachusetts · 16 weeks
AI, Cloud & Digital Trust · 2024SOC 2 Type II with Evidence Built into ServiceNow Change RecordsAn unqualified Type II report with zero exceptions, and change-management evidence that now collects itself.
-
New York, New York · 20 weeks
AI, Cloud & Digital Trust · 2026 · OngoingISO/IEC 42001 and Adversarial Testing for a Commercial Underwriting AI PlatformDoctored broker submissions no longer steer risk rankings, and an AI management system is on track for its certification audit.
-
Pittsburgh, Pennsylvania · 22 weeks
AI, Cloud & Digital Trust · 2025Multi-Cloud Security Guardrails for a Regional Health SystemClinical imaging and analytics in two clouds under one set of guardrails, with no change to how radiologists read studies.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.