OT Security in Transportation and Logistics

How Do Port Automation Systems Create OT Security Risk?

Modern container ports are among the most complex OT environments in any sector. Automated quay cranes, automated guided vehicles (AGVs), automated stacking cranes in container yards, and terminal operating systems that coordinate all of these assets form an interconnected OT environment of extraordinary complexity. The disruption of any major component can halt container handling for an entire terminal. The 2017 NotPetya attack disrupted Maersk's terminal operations globally for two weeks, with an estimated $300 million cost, demonstrating the supply chain consequence of port OT disruption.

Port OT environments face particular challenges from IT-OT connectivity. Terminal operating systems that optimize berth planning, crane scheduling, and truck gate operations must communicate with shipping line systems, customs platforms, and logistics providers' IT networks. Each integration is a potential attack path. Port authorities that have invested in digital integration for operational efficiency must now address the security implications of those integrations systematically.

GPS spoofing is an emerging threat to port operations and maritime navigation. Ships approaching ports rely on GPS for positioning; automated port cranes increasingly use GPS or laser-based positioning for container handling accuracy. Attackers have demonstrated the ability to spoof GPS signals in maritime environments, causing navigation systems to report incorrect positions. While GPS spoofing has not yet been used to cause a port security incident of consequence, it represents an attack vector that port security programs must address as automation increases reliance on GPS-dependent systems.

OT threat landscape 2026 - ransomware and supply chain attacks

What Are the OT Security Challenges in Airport Infrastructure?

Airport OT encompasses systems whose failure ranges from passenger inconvenience to aviation safety incidents. Runway and taxiway lighting systems are safety-critical: incorrect lighting states can cause runway incursions during low-visibility operations. Instrument Landing System (ILS) ground equipment and approach lighting are safety-critical aviation infrastructure. Baggage handling systems are operationally critical; their disruption causes cascading delays and significant passenger experience impacts. Building automation systems controlling HVAC, fire suppression, and access control are also part of the airport OT environment, though with lower immediate safety consequence.

Airport OT security is complicated by multi-tenancy. An international airport hosts the airport authority's OT systems alongside airline systems, government agency systems including border control and customs, concession operators, and ground handling companies. Each operator has their own OT and IT infrastructure, their own security postures, and their own connectivity requirements. Coordinating security across this multi-organization environment requires governance structures that airports are still building in most cases.

Aviation cybersecurity regulation is developing rapidly. The European Union Aviation Safety Agency (EASA) has issued cybersecurity regulations for airspace management and aviation infrastructure that explicitly address ground-based OT systems. The US Federal Aviation Administration (FAA) has issued cybersecurity requirements for avionics and is developing further guidance for ground infrastructure. Airport operators must navigate an evolving multi-regulator landscape while managing OT security across a complex multi-tenant environment.

[IMAGE: Photo of airport tarmac operations with ground handling vehicles and aircraft - search terms: airport operations ground handling apron aircraft tarmac]

How Does Fleet Telematics Create OT-Scale Security Risk?

Modern commercial fleets connect thousands of vehicles through telematics systems that report location, engine diagnostics, fuel consumption, and driver behavior in real time. These systems use cellular or satellite connectivity to transmit data from vehicle OT systems to fleet management platforms. The vehicle OT systems, including engine control units (ECUs), transmission controllers, and increasingly advanced driver assistance systems (ADAS), are accessible through cellular-connected telematics units installed in the vehicle.

Security research has demonstrated that telematics unit vulnerabilities can provide attackers with access to vehicle control systems. While mass remote vehicle manipulation remains a theoretical threat rather than a documented real-world attack, the attack surface created by millions of connected commercial vehicles is significant. Fleet operators must assess the security of telematics hardware, the security of the cloud platforms those units connect to, and the network separation between telematics data networks and vehicle control networks.

The OT security challenge in fleet environments is scale. A manufacturing plant may have dozens of PLCs; a large logistics fleet may have tens of thousands of connected vehicles. Applying OT security monitoring, configuration management, and incident response processes at this scale requires automation and centralized management capability that is different from traditional plant-floor OT security approaches. Fleet telematics security is an emerging discipline that is still developing dedicated tooling and best practices.

What Regulations Govern Transportation OT Security?

Transportation OT security regulation is developing sector by sector across multiple jurisdictions. The US Transportation Security Administration (TSA) has issued security directives for surface transportation, including rail and pipeline operators, that include OT-specific requirements for network segmentation, access controls, and incident reporting. These directives followed the Colonial Pipeline ransomware attack and represent a significant acceleration of federal engagement with transportation OT security.

European transport operators are subject to NIS2 as operators of essential services, including requirements that explicitly address OT security controls, incident reporting, and supply chain security. Rail operators, airports, and port authorities meeting the relevant size thresholds are all within NIS2 scope. Member state implementations are being finalized, with enforcement escalating through 2026 and 2027. For transportation organizations building OT security programs that address regulatory requirements, Opsio's OT security services provide compliance-aligned assessment and implementation support.

Frequently Asked Questions

What is positive train control (PTC) and how does it relate to cybersecurity?

Positive train control is a safety system mandated in the US by the Rail Safety Improvement Act of 2008. It automatically stops trains to prevent accidents from speeding, signal violations, and unauthorized track occupancy. PTC systems use GPS, radio communications, and back-office servers to enforce safe train operations. These systems are networked, and their cybersecurity is safety-critical: unauthorized commands to PTC infrastructure could disable the safety function or generate false commands. PTC cybersecurity is an active area of attention for the Federal Railroad Administration and the Association of American Railroads.

How should ports respond to a terminal operating system ransomware attack?

Pre-planned response is essential. Ports should maintain manual backup procedures for critical cargo operations that can be activated immediately if the TOS becomes unavailable. Incident response plans should define clear authority for deciding when to take systems offline versus attempting continued operation. Backup and recovery procedures must be tested regularly, including the time required to restore TOS from backup. Communication plans for shipping lines, customs authorities, and trucking companies must be activated quickly, as TOS disruptions affect dozens of external stakeholders simultaneously.

Are connected commercial vehicles subject to OT security regulations?

Regulation for connected vehicle OT security is emerging. The US National Highway Traffic Safety Administration (NHTSA) has issued voluntary cybersecurity guidance for vehicle manufacturers. The EU's UNECE WP.29 regulation requires automotive manufacturers to implement cybersecurity management systems for vehicles, which extends to commercial vehicles. Fleet operators are not directly regulated in most jurisdictions, but vehicle manufacturers must increasingly demonstrate that vehicle OT systems meet cybersecurity requirements throughout the product lifecycle.

What is the biggest OT security risk in airport operations?

Safety-critical systems, particularly runway lighting and ILS ground equipment, carry the highest consequence. However, the most likely impactful attack in probability-adjusted terms may be against baggage handling systems or passenger processing systems, given their connectivity, complexity, and the significant operational disruption their failure causes. Attackers seeking leverage are more likely to target high-disruption, lower-protection assets than to attempt attacks on well-protected aviation safety systems. A holistic airport OT risk assessment must address both consequence and likelihood across all system categories.

Conclusion

Transportation OT security spans a uniquely diverse range of systems: safety-critical railway signaling, operationally critical port automation, multi-tenant airport infrastructure, and fleet-scale connected vehicle OT. Each presents distinct challenges, but all share the common thread of OT systems that were designed for reliability and availability without the cybersecurity protections that modern threat actors now demand.

The 40% annual growth in ransomware targeting OT, the TSA's security directives for surface transportation, and NIS2's coverage of transport operators all signal that the regulatory and threat environment is escalating simultaneously. Transportation organizations that invest in OT security now are building resilience against threats that are only going to intensify.

---

Author: Opsio Security Practice | Published: April 2026 | Last updated: April 2026