Cyber Risk Perception in Offshore Operations: An Exploratory Study of Deck Officers’ Perceptions of Cyber Risks in Norwegian Shipping Companies

Abstract

The digital evolution of the maritime industry has given rise to new cybersecurity challenges and increased cyber risks for shipping companies and their vessels. At sea, losses from cyberattacks are not just monetary but can include human lives and damage to the environment. Deck officers are part of the frontline mitigating and handling cyber risks on vessels, and understanding how they perceive such risks is crucial for developing targeted cyber risk management strategies and enhancing vessel security and safety. The overall objective of this thesis was to explore deck officers’ perceptions of cyber risks in offshore operations. This research project was grounded in risk perception theories from the psychology field and utilised a mixed methods exploratory sequential design. The approach ensured that each research phase in this thesis informed the subsequent one, providing a comprehensive understanding of factors influencing deck officers’ cyber risk perceptions within the context of Norwegian shipping companies. The research was conducted in four subsequent phases. The first phase involved a systematic literature review, which aimed to capture the current state of research on cyber risk perception and present an approach for investigating factors influencing people’s perception of cyber risks using psychological models. The review identified 24 dimensions of cyber risk perception, demonstrated how these dimensions could be applied in a maritime context, and highlighted research gaps in the existing literature. Informed by the literature review, the second phase employed in-depth interviews to explore deck officers’ perceptions of cyber risks in offshore operations. A contextual model was developed with thick descriptions of dimensions influencing these perceptions. Key findings included the deck officers’ perceived distance from cyber risks, their inherent trust in cyberphysical systems, more restricted work flexibility because of digitalisation, and their dependence on others for cyber defence. Building on insights from the qualitative phase, the third research phase utilised a selfadministrative questionnaire to investigate factors shaping deck officers’ cyber risk perceptions towards information technology (IT) and operational technology (OT) systems. Variables such as perceived benefit, trust, cybersecurity training, and prior experiences with cyber-attacks were analysed, revealing distinct risk perceptions towards IT versus OT systems. The synthesis in the fourth phase, comprising this thesis, led to the development of a characteristics model that serves as a roadmap for obtaining contextual knowledge that is essential for developing targeted cyber risk management strategies. The model illustrates how the working environment on offshore vessels (the context), combined with deck officers’ personal experiences and biases (the risk perceiver), the intangible nature of cyber risks (the risks), and the on-board system categories (IT and OT), forms distinct perceptions of cyber risks. As the maritime industry becomes increasingly interconnected and reliant on digital systems, understanding how cyber risk perceptions are shaped among operational decisionmakers is crucial. This research provides foundational insights that can guide future efforts to enhance maritime cybersecurity practices.