Blog

Coast Guard Cybersecurity Training Requirements

This past January the U.S. Coast Guard published its “Final Rule” concerning cybersecurity plans for vessels and facilities, completing a multi-year effort to establish cybersecurity regulations for the maritime industry.

The regulations require vessel and facility operators to designate a Cybersecurity Officer (CySO) and develop written cybersecurity plans (CSP). Those requirements become effective in July 2027, so we have some time to prepare.

However, the regulations also include a cybersecurity training requirement that becomes effective January 12, 2026. This training requirement applies to all vessel and facility personnel who have access to IT or OT systems. It is focused on educating users to detect and avoid common cyber threats, such as phishing scams. Many organizations already have programs that likely satisfy the intent of the regulation.

We have spoken with officials at Coast Guard Headquarters on this matter. Their guidance is that vessel and facility operators should be prepared to provide training records that document the specific topics listed in the regulation. The person or organization providing the training should have the knowledge required of Cybersecurity Officers. We have also drafted FSP amendments that reflect these requirements for several clients. Including this requirement in the FSP, although not mandatory, is another way of demonstrating compliance and will eventually be required, once the entire CSP requirement becomes effective in 2027.

We continue to work with Coast Guard personnel at the national and local level. We expect that the Coast Guard will issue formal guidance on training and other cybersecurity requirements in the coming months. We will work with all of you to implement the requirements at that time. Until then, we should recognize that malicious cyber actors are some of the most serious threats we all face. Cybersecurity training for your crew is one of the best ways to address these risks.

Fair Winds, Homeport: A Digital Eulogy for a Quirky Old Friend

Well folks, it’s official. After years of loyal (if occasionally glitchy) service, the Coast Guard’s Homeport website has sailed off into the sunset. Love it or curse it, we all had a relationship with Homeport – and now it’s time to say goodbye.

Originally launched to centralize security regulations, port condition updates, NVICs, policy letters, and FSO resources, Homeport was built with the right intent. It gave us a one-stop shop for all things 33 CFR 105, and when it worked, it worked pretty well. Need to check MARSEC levels? Download an MSIB? Look up cybersecurity guidance? Homeport had your back – eventually. Usually. After a few refreshes.

Sure, Homeport had its quirks. The interface aged like an old tugboat, and don’t get us started on the login process. But still, it was ours. It saw us through drills, FSP updates, and yes, even the rollout leading to the Coast Guard’s Cybersecurity Final Rule.

So, what now? Most Homeport content has migrated to CG portals and other official Coast Guard channels – and let’s be honest, it’s a much-needed upgrade. But with information more decentralized, staying current takes more initiative.

That’s why now, more than ever, a solid Coast Guard-approved FSO course matters. The good ones keep up with the latest regs, cyber rules, and tools replacing Homeport’s functions – without making you log in three times.

Rest easy, Homeport. You tried your best. We’ll take it from here.

Meet the Front Line: Personnel with Security Duties Under 33 CFR 105

When you think of maritime security, you might picture high-speed boats and dramatic movie scenes – but the real heroes? They’re the personnel with security duties (PSD), the boots-on-the-dock ensuring your facility or terminal isn’t the next action movie set.

Under 33 CFR 105, which governs maritime facility security in the U.S., these individuals are the facility’s first line of defense. Think of them as part bouncer, part detective, and part diplomat. Their job isn’t just to scan badges or monitor a gate – they’re trained in access control, screening, and responding to threats ranging from suspicious packages to unauthorized drone flyovers (yep, that’s a thing now).

According to Coast Guard guidance, PSDs must know their Facility Security Plan (FSP) like the back of their hand. They receive specific training outlined in 33 CFR 105.210: recognizing dangerous substances, emergency procedures, using surveillance equipment, and yes—even how to communicate with the Coast Guard if things go sideways.

But it’s not all regulations and rulebooks. The job requires sharp instincts, calm under pressure, and a healthy dose of common sense. After all, no two days at a port facility are the same – one day you’re checking IDs, the next you’re coordinating a response to a security drill (or real-world incident).

So next time you see someone in a high-vis vest checking TWICs with a focused look, give ’em a nod. They’re not just doing their job – they’re guarding a gateway to global commerce. And that’s no small task.

BLOG POST ON INCLUDING LOCAL LE, FIRE/EMS IN ANNUAL EXERCISES

Recently, while in the process of conducting a 33 CFR 105 required annual facility audit, we observed an outstanding Best Practice! The facility, Graymont Superior Limestone, in Superior. Wisconsin, partnered with local law enforcement, fire and EMS services to complete a live action active shooter exercise. Under the regulations, each facility is required to conduct an exercise of all its Facility Security Plan (FSP) each calendar year, not to exceed 18 months. We included cybersecurity, access control and monitoring, MARSEC Level changes and reporting, and emergency procedures aspects of the FSP in this combined, live action and tabletop exercise.

Law Enforcement arriving at the facility

Law Enforcement agencies from local Superior PD, several surrounding counties and the Wisconsin State Patrol participated in the initial phases of the exercise as they worked to secure the scene and control the shooter.

Police Back-up

Local PD quickly responded to secure the scene and the shooter. Subsequent law enforcement formed Response Task Force elements with EMS to assist the wounded.

Response Task Force elements

While this activity was ongoing, cybersecurity elements were inserted into the scenario, properly addressed by the Facility Security Officer (FSO) through a corporate cybersecurity staff and reported to the National Response Center and the Captain of the Port (COTP), causing an elevation in the local MARSEC Level.

Additionally, an unattended small boat was noticed at one of the facility docks with a tarp covering several boxes in it. This reporting caused another elevation in MARSEC Level and appropriate facility security measures.

In short, the FSO took the opportunity to partner with local officials and fulfill the exercise requirement from the regulations. Seebald & Associates recommend this practice for all facilities. It fulfills your exercise needs and helps local authorities understand your facility, its layout, and your requirements as an FSO.

Bravo Zulu to Lacie Glaeser and her team at Graymont for outstanding initiative and performance in this exercise!

US Coast Guard Cyber Command

Maritime Cyber Alert

March 24, 2025

Information Sharing Protocol: TLP-CLEAR (https://www.us-cert.gov/tlp)

Ghost (Cring) Ransomware Group Targeting Critical Infrastructure

Summary:

Government agencies are observing ransomware attacks on critical infrastructure by Ghost (Cring) ransomware group that exploit vulnerabilities and use tactics similar to those seen in the Marine Transportation System (MTS) by Coast Guard Cyber Command (CGCYBER). Furthermore, CGCYBER has observed malicious actors continuing to execute ransomware attacks on the MTS with more devastating effects. Maritime companies and vessels commonly have Operational Technology (OT) systems that are segmented improperly and equipped with outdated software, posing a higher risk to the MTS. Awareness and implementation of mitigation recommendations can help maritime companies thwart the threat from Ghost actors.

Background:

Ghost ransomware group, located in China, has compromised organizations across more than 70 countries since 2021. Financial gain is their primary motivation for the widespread ransomware attacks on various industries including critical infrastructure, schools, healthcare, government, technology, manufacturing, and businesses.

Ghost actors often target internet facing servers by exploiting Common Vulnerabilities and Exposures (CVEs) that are unpatched. There are various payloads, file extensions, ransom notes, and email addresses used by Ghost actors causing inconsistent attribution of this group. Names associated with this group include Ghost, Cring, Crypt3r, Phantom, Strike, Hello, Wickrme, HsHarada, and Rapture.

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released a

joint cybersecurity advisory on February 19^th, 2025, warning of Ghost Ransomware and providing recommended mitigations for companies.¹

Targeted Applications &Systems

Ghost actors gain initial access to networks by exploiting CVEs on publicfacing applications. In2024, while conducting Incident Response for MTS partners, CGCYBER Cyber Protection Teams (CPTs) observed malicious actors typically exploiting public facing systems through unpatched vulnerabilities. Furthermore, the second most common CVEthat CGCYBER CPTsdetectedin 2023 was often found on internetfacing servers.² Thesefindings highlightanincreasedthreat to the marine environment due tosimilarvulnerabilitiesbetween MTScompanies and victims of the Ghostransomware group.

The systems and the associated CVEsexploited by Ghost actors include:

• Fortinet FortiOS appliances (CVE-2018-13379)
• Servers running Adobe ColdFusion (CVE-2010-2861, CVE-2009-3960)
• Microsoft SharePoint (CVE-2019-0604)•Microsoft Exchange (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207)

Fortinet, which has been targeted by Ghost actors, provides various security products forManaged Security Services Providers (MSSPs).³In 2024, CGCYBERCPTsfound that 73% ofMTSmissionpartnersusedMSSPs.Similarly, Ghost actorsare targetingapplications within theMicrosoft 365 application suite. In 2024, CGCYBER CPTsfound that 80% ofMTSmissionpartners relied upon theMicrosoft 365 application suite for business operations.

Threat Actor Tactics:

Below are the tactics referenced by MITRE ATT&CK techniques, whichare linked to these attacks (Techniques -Enterprise| MITRE ATT&CK®).

• T1190:Exploit Public-Facing Application

oThreat actors obtain initial access via unpatched public facing web applications by exploiting CVEs.

oCGCYBER has increasingly been able to exploit public facing applications in thelast three years of assessing MTS partners networks including 12 instances in 2024.

• T1505.003:Server Software Component – WebShell

oThreat actorsupload web scripts to compromised servers to establish persistence.

• T1059.003 & T1059.001:Command and Scripting Interpreter– WindowsCommand Shell and PowerShell

¹“#StopRansomware: Ghost (Cring) Ransomware” February 19,2025.#StopRansomware: Ghost (Cring)Ransomware | CISA²“2023 Cyber Trends and Insights in the MarineEnvironment”2023 Cyber Trends and Insights in the MarineEnvironment³“Managed Security ServicesProviders” ManagedSecurity Services-MSSP |Fortinet

o Ghost actors use Command Prompt and PowerShell to download and execute Cobalt Strike Beacon malware.

• T1105: Ingress Tool Transfer o Used by actors to transfer tools and files from Cobalt Strike to be executed on target systems.
• T1136.001, T1136.002 & T1098: Create Local Account, Create Domain Account & Account Manipulation o Ghost actors occasionally create new local and domain accounts and changed existing account passwords.
• T1505.003: Server Software Component – Web Shell o Ghost actors deployed web shells on target web servers in 2024.
• T1134.001: Access Token Manipulation – Token Impersonation/Theft o Ghost actors impersonate the SYSTEM user by stealing process tokens using Cobalt Strike functions in order to run Beacon again with elevated privileges.
• T1068: Exploitation for Privilege Escalation o Ghost actors escalate privileges using open source tools.
• T1003: OS Credential Dumping o Ghost actors use “hashdump” or Mimikatz through Cobalt Strike to collect passwords and hashes for unauthorized logins and privilege escalation.
• T1057, T1518.001 & T1562.001: Process Discovery, Security Software Discovery & Disable or Modify Tools o Ghost actors use Cobalt Strike to list running process, determine the antivirus software, and then disable it to evade detection in victim networks.
• T1087.002, T1135 & T1018: Domain Account Discovery, Network Share Discovery & Remote System Discovery o Ghost Actors utilize Cobalt Strike commands for domain account discovery and open-source tools to discover network shares and remote systems.
• T1047, T1132.001 & T1564.003: Windows Management Instrumentation, Standard Data Encoding & Hidden Window o Ghost actors move laterally by using Windows Management Instrumentation command line for running commands on systems in the victim network. They then use Cobalt Strike to encode subsequent Beacon infections.
• T1071.001: Application Layer Protocol – Web Protocols o Ghost actors conduct command and control using Cobalt Strike malware and servers that function using HTTP and HTTPS.
• T1573: Encrypted Channel o While communicating via email with victims, Ghost actors use legitimate email services with encryption.
• T1486, T1070.001 & T1490: Data Encrypted for Impact, Clear Windows Event Logs, Inhibit System Recovery o Ghost Actors encrypt victim data using ransomware executables that clear Windows Event Logs and inhibit system recovery. They then hold the encrypted data for ransom in exchange for cryptocurrency.

Mitigation Measures:

CGCYBER recommends MTS partners implement the mitigations below which align with the joint cybersecurity advisory mitigations from the FBI, CISA, and MS-ISAC.

• Maintain regular system backups o CGCYBER observed a company with insufficient backups causing inability to recover data after a ransomware attack.
• Patch known vulnerabilities o CGCYBER has regularly found CVEs on partner networks, demonstrating lack of regular software updates. Most OT networks assessed by CGCYBER in 2024 ran unsupported software and legacy hardware including End of Life Operating Systems.
• Ensure proper network segmentation o Improper network segmentation was CGCYBER’s top finding in OT assessments from 2024.

o Modern vessels and port OT systems are at greater risk of impact from cyber incidents due to increasing interconnectivity. This is evidenced by a ransomware attack taking place on a vessel due to connection to the company network. However, this attack did not impact OT onboard the vessel because of proper segmentation of IT and OT, demonstrating the significance of proper segmentation.

• Require phishing-resistant Multi-Factor Authentication (MFA) o Only 37% of partners assessed by CGCYBER in 2024 used MFA and for around half of these, MFA was bypassed through phishing campaigns.
• Enhance email security o Implement advanced filtering, block malicious attachments, and prevent spoofing
• Disable unused ports o Such as RDP 3398, FTP 21, and SMB 45
• Utilize endpoint and detection response (EDR) on systems o This will alert network defenders of possible malicious activity
• Monitor unauthorized use of PowerShell and implement allowlisting o This will prevent unauthorized access and execution of scripts, applications, and network traffic.
• Conduct user training to help identify phishing attempts

Resources:

If your organization has any questions related to this alert, please contact the U.S. Coast Guard at: maritimecyber@uscg.mil, or for immediate assistance call the Coast Guard Cyber Command 24×7 Watch at 202-372-2904.

Appendix A: IOCs

Ghost Actor Tool IOCs Tool	Source
Cobalt Strike	N/A
I0X	github[.]com/EddieIvan01/iox
SharpShares.exe	github[.]com/mitchmoser/SharpShares
SharpZeroLogon.exe	github[.]com/leitosama/SharpZeroLogon
SharpGPPPass.exe	N/A
SpnDump.exe	N/A
NBT.exe	github[.]com/BronzeTicket/SharpNBTScan
BadPotato.exe	github[.]com/BeichenDream/BadPotato
God.exe	github[.]com/BeichenDream/GodPotato
HFS (HTTP File Server	rejitto[.]com/hfs
Ladon 911	github[.]com/k8gege/Ladon
Web Shell	Slight variation of github[.]com/BeichenDream/ChunkProxy/blob/main/proxy.aspx

The 2025 Security Symposium kicked off in Savannah on Wednesday with opening remarks from CDR Nathaniel Robinson, Commanding Officer of Coast Guard Marine Safety Unit Savannah, followed by Mr. Charles Blackmore, the Coast Guard Cybersecurity Policy expert at Coast Guard Headquarters. Together they gave us a great perspective on local and national level security risks, including cybersecurity challenges. In the afternoon, John Halinski, of SRI Group, provided a fascinating, if troubling, account of emerging drone threats.

Thursday began with Captain Andy Meyers, Chief of the Coast Guard’s Office of Port and Facility Compliance, which has primary responsibility for Maritime Transportation Security Act requirements for port facilities across the country. And before lunch, Mr. Billy Gouveia, CEO & Founder Surefire Cyber helped us understand ransomware and similar cyber threats.

Some key takeaways from all these speakers:

Partnerships, cooperation, and information sharing can build a strong community. Participate in your Area Maritime Security Committee, get to know your fellow FSOs and the Captain of the Port.

The Coast Guard provides significant help to FSOs and others to address cyber threats. These include port cybersecurity specialists at every Coast Guard Sector, and the Coast Guard’s Cyber Protection Teams, which are available to help facility operators assess vulnerabilities to their networks, and to provide help in the event of an attack.

Drone capabilities and threats are growing, and while government and industry are struggling to create a legal and effective way of managing this risk, companies can reduce their risk by training personnel to be alert for drones, establish relationships with local FAA and other authorities, and make plans on where and how counter drone systems could be deployed in the future.

The Coast Guard is working on new guidance to help the industry implement the recently published cybersecurity regulations. They do not have an anticipated date, but it is clear they are working hard on that guidance. Captain Meyers took several questions from the audience which he and his crew can use as they finalize that guidance.

While waiting for that guidance, Billy Gouveia gave us some great advice on how to protect ourselves from ransomware and other threats: Use long passwords and multi-factor authentication, make backups of critical data, and test them regularly. Beware of phishing and other scams, use strong endpoint detection and response protocols, and develop – and rigorously exercise – a cybersecurity response plan.

We will be reaching back to Captain Meyers on a few issues he didn’t have time to cover. We’ll get his response and any other information back to you all soon.

Always a highpoint at the Facility Security Symposium is the Awards Reception, when we recognize exceptional facility security performance. Here are some highlights:

Niels Veenema (l) of Tradepoint Terminals and Chuck Santerre (r) of Maryland Port Administration receive Maritime Security Excellence awards.

Eric Soler of Red Hook Terminals receives the Most Improved Facility award.

Symposium attendees observing the Facility Security awards.

Here is a list of cybersecurity final rule requirements and when they are required.

Cybersecurity Plan Requirements: Required by July 2027

1. Develop and maintain:
   • Cybersecurity Plan including seven account security measures.
   • Cyber Incident Response Plan with instructions and roles for responding to incidents.
2. Account Security Measures:
   • Enable automatic account lockout after repeated failed logins.
   • Change default passwords or implement compensating security controls.
   • Maintain minimum password strength.
   • Implement multifactor authentication for IT and remotely accessible OT systems.
   • Apply least privilege principle to administrator accounts.
   • Use separate user credentials for critical IT and OT systems.
   • Remove/revoke credentials when personnel leave the organization.
3. Device Security Measures:
   • Maintain a list of approved hardware, firmware, and software.
   • Disable executable code on critical IT and OT systems by default.
   • Keep an accurate inventory of network-connected systems.
   • Develop and document network maps and OT device configurations.
4. Data Security Measures:
   • Securely capture, store, and protect logs.
   • Deploy encryption for sensitive data and IT/OT traffic.

Personnel and Training:

1. Appoint a Cybersecurity Officer (CySO) to: Required by July 2027
   • Oversee plan implementation.
   • Conduct audits and updates of the Cybersecurity Plan.
   • Arrange for cybersecurity inspections and training.
   • Record and report incidents.
2. Training Requirements: Required by January 17, 2026
   • Complete cybersecurity training for all personnel within 6 months and annually thereafter.
   • Provide specific OT training for relevant personnel.

Drills and Exercises: Required by July 2027

1. Conduct two cybersecurity drills annually.
2. Conduct at least one cybersecurity exercise every calendar year.

Assessments and Documentation: Required by July 2027

1. Conduct a Cybersecurity Assessment within 24 months and annually thereafter.
2. Submit the Cybersecurity Plan to the Coast Guard for approval within 24 months.
3. Maintain penetration test results and ensure their availability to the Coast Guard.

Compliance and Reporting: Required by July 2027

1. Report all cybersecurity incidents to the National Response Center (NRC) immediately.
2. Request waivers or equivalency determinations for specific requirements if needed.

Coast Guard Cybersecurity Final Rule

Many of you have heard that the Coast Guard has released a new regulation concerning cybersecurity plans for vessels and facilities last week. The rumors are true. This is the “Final Rule”, which completes the process that started last February as a “Notice of Proposed Rulemaking”.

Seebald & Associates has taken a close look at this regulation and what it means for you as the Facility Security Officer. For all our clients, we can help you meet these requirements, which will help protect our nation and maritime industry from emerging cyber threats. The regulation focuses on well-recognized best practices but does not take a prescriptive approach or require specific technical solutions. In this way it follows the performance-based approach of existing Coast Guard security regulations but leaves questions to how these requirements will be enforced. We are working closely with the Coast Guard policy makers to determine what the compliance criteria is for these new requirements.

Coast Guard officials, including Captain Andrew Meyers, chief of the Coast Guard’s Port and Facility Compliance office, will be at our FSO Academy & Facility Security Symposium in Savannah February 24-27. This will be an ideal time to learn how the Coast Guard will interpret and enforce these regulations. I strongly encourage you to make every effort to attend this event. Of course, you can also reach out to any of us here at Seebald & Associates and we’ll do our best to answer your questions, or to pass them on to the Coast Guard.

A couple key requirements are vessel and facility operators must designate a Cybersecurity Officer (CySO) and it requires cybersecurity training for all personnel who use IT and OT systems and this training requirement becomes effective six months from now – July 17, 2025.

There are far too many regulations to cover in this blog, here is the link to the entire Final Rule. The executive summary highlights the deliverables well. For now, make sure that your senior leadership is aware of this new requirement, including the training requirement which is effective in only six months. In the meantime, we’ll send out more information as it becomes available, and we hope to see you in Savannah.

December 5, 2024

For more information contact: maritime@seebald.com / www.seebald.com

Seebald & Associates founder honored for contributions to nation’s homeland security

WASHINGTON DC – The Government Technology & Services Coalition (GTSC) recognized Ed Seebald, Founder and CEO of The Seebald Group Inc., for his contributions to America’s homeland and national security mission during its annual Homeland Security Holiday Hero Awards dinner in Occoquan, Virginia on December 5, 2024.

Seebald started Seebald & Associates International (S&A), following his retirement in 2003 after serving a distinguished 20-year Coast Guard career. Being at Ground Zero in Lower Manhattan on September 11, 2001 and witnessing firsthand the direct attack to America’s homeland, he decided to dedicate his second career channeling his focus toward serving this country in maritime security protecting America’s ports.

“I’m both humbled and honored to be recognized by GTSC,” remarked Seebald. “My team and I have always looked at those we work, consult and teach with as family, and delivering the absolute best possible product to them is my commitment in protecting America’s homeland.”

Employing an elite team largely consisting of retired Coast Guard senior officers, many of whom were former Captains of the Port, Seebald & Associates sets the industry standards as a full-service maritime security firm providing facility security plans, audits, assessments, cybersecurity analysis, consulting, classroom instruction and other products for commercial maritime facilities both in America and abroad.

“Seebald & Associates helped me transform my facilities – not only in plans, processes, and procedures – but in how we think about security,” said Matt Peeler, Security and Loss Supervisor for ExxonMobil Beaumont. “The Seebald team created a lasting impact on our security organization, our facilities, and our security culture overall.”

Seebald & Associates has written more than 200 Facility Security Plans, conducted more than 800 Facility Security Audits, and instructed more than 5,000 Facility Security Officer students over the years. Truly a national security asset, the team regularly travels throughout the country, conducting business on both the East and West Coasts, Gulf of Mexico, Great Lakes, Inland Rivers, as well as Hawaii and Alaska. No maritime facility is too big or small for S&A as some clients range from but a handful of employees to an entire port facility that employs thousands.

“With Seebald & Associates’ experience, responsiveness, and dependability, we know that our facility is best positioned against any threats that could potentially harm our assets and put us at risk,” commented Kathleen Pickett, Director of Security for the Maryland Port Authority.

GTSC is a non-profit organization working in homeland security and the owners of Homeland Security Today.

#30

The recently released Executive Order (EO) on Maritime Cybersecurity to quote SC Media “was long on lofty policy goals and short on specifics. For example, today’s release did not outline what the new cyber standards are and any specifics on the reporting time period.”

A key point for ALL maritime stakeholders is that the Coast Guard has announced proposed rulemaking that includes a public comment period as part of the standard rulemaking process. Stakeholders – especially FSO’s should absolutely get involved in this process with their IT/OT professionals.

This EO potentially revises Captain of the Port (COTP) authority that will give the COTP the ability to control vessel/facility operations for any clear cyber problem, no need to wait for the bad thing to happen. An analogy might be that in the physical world, if the inspector sees your steering linkage consists of twine, the COTP can say “do not operate” without waiting for the accident. Presumably a known cyber problem, like known malware in the system or a glaring vulnerability, would be the same.

Our advice is that large and medium sized facilities are, or should be doing most of these things (example: use Multi-Factor Authentication for remote access) already, so for them, it is more about putting that in a plan than reinventing their practices. Smaller facilities, where the “network” consists of a home wi-fi, 4 laptops, and a printer, and the consequences of the network going down are essentially zero? These facilities are going to need another option. If the cyber part of the FSA finds no consequences to hacks, then maybe the cyber plan for them could be minimal.

The Bottom Line – FSO’s need to get involved with their IT/OT staff and involve them in your feedback to the Coast Guard through the regulatory process!