Port Cyber AlliancePort Cyber Alliance
Maritime Cybersecurity Alliance
Report an Incident
Connect your SIEM
Swagger
Github
Start
Who we protect

Cyber security for trucking companies and hauliers

Your trucks book slots in terminal systems and wait at the gate when those systems stop.

Take the 2-minute test
See the launch offer
Your cyber risks

What public sources say about hauliers and TMS developers

Each card links to its source. We kept only what the sources say.

Queues at the port
In May 2020 the computers that manage vessels, trucks and cargo at Shahid Rajaee port in Iran failed; long queues of trucks formed on the roads to the port.
Containers you cannot collect
When DP World Australia's terminals stopped for three days in November 2023, almost 30,000 containers were stranded, as The Record reported.
Your access is their supply chain
Terminals in scope of NIS2 must address the security of their suppliers and service providers (Article 21). Expect questions about how you reach their systems.
Shared and default passwords
Gate kiosks and booking accounts are often shared. The engineer self-test asks whether default and shared passwords are gone.

Sources: Al Jazeera, 19 May 2020 · The Record, 13 November 2023 · EUR-Lex: Directive (EU) 2022/2555, Article 21

Isometric illustration of a haulier system connected to a truck appointment API
What PCA gives you

What Port Cyber Alliance gives you

Launch offer
Ten one-hour video calls of engineering advice and two site visits a year, for every member.
Engineer self-test
Twelve questions on access, network, detection and recovery. About two minutes, answers kept in your browser.
Team self-test
For whoever leads IT or operations: people, visibility, exercises and the logistics chain.
Report an incident in confidence
Tell us what you see. We answer within one working day and help you prepare the next steps.
Ten checks in one week
A short list of cyber checks your team can do in a week, before anything else.
Appointment portal checklist
Shared logins, slot resale, bots, MFA and access logs on a truck appointment portal: a free 34-point checklist for terminals and hauliers.
Open-source packages
Free tools for port and terminal engineers: cyber, terminal integration and platforms.
Open source

Open-source packages for hauliers and TMS developers

Free tools we build for port and terminal engineers. Some are public, the others we send on request. Open a card for the details.

  • Isometric illustration: VBS API

    PublicTerminal integration

    VBS API

    Connect a transport management system to a terminal's truck appointment system.

    REST · JSON · API key · UML sequence diagram

    Details about VBS API
  • Isometric illustration: Terminal data contracts

    On requestTerminal integration

    Terminal data contracts

    Language-neutral contracts for container-terminal data, with fixtures and a conformance runner.

    JSON Schema 2020-12 · OpenAPI 3.1 · Python · DCSA Track & Trace

    Details about Terminal data contracts
  • Isometric illustration: Terminal integration kit

    On requestTerminal integration

    Terminal integration kit

    A small core and plugins to connect a TOS, a gate, a booking system or your back office.

    Python 3.10+ · Standard library only · plugin.json · Standard Webhooks

    Details about Terminal integration kit
  • Isometric illustration: TOS Groovy recipes

    On requestTerminal integration

    TOS Groovy recipes

    Read-only recipes for terminal operating systems: answer tracking questions, push gate events anywhere.

    Groovy · Navis N4 extensions · PHP relay

    Details about TOS Groovy recipes
  • Isometric illustration: Terminal devtools

    On requestTerminal integration

    Terminal devtools

    Small tools every terminal developer rewrites: ISO 6346 check digit and a fake TOS for tests.

    Python · PHP · ISO 6346 · UN/EDIFACT

    Details about Terminal devtools
  • Isometric illustration: Container tracking core

    On requestTerminal integration

    Container tracking core

    Where a container is and whether a truck can pick it up, the same answer whatever TOS is behind.

    Python 3.11+ · PHP 8.1+ · HTTP facade

    Details about Container tracking core
  • Isometric illustration: Terminal integration map

    ComingTerminal integration

    Terminal integration map

    Where to plug what at a container terminal, and what costs three weeks when you ignore it.

    Markdown · Sequence diagrams · ISO 6346 · UN/LOCODE

    Details about Terminal integration map

See every package and how to get them

Isometric illustration: VBS API

PublicTerminal integration

VBS API

Connect a transport management system to a terminal's truck appointment system.

For
Developers of hauliers and transport management systems (TMS)
Stack
REST · JSON · API key · UML sequence diagram · Code examples
Licence
Apache-2.0
State
The code is on our public GitHub. Use it today.

What is in it today

  • The five-step workflow: prevalidate an operation, create it, read the slots of a day, prevalidate an appointment, create it
  • Authentication by x-api-key and a portId header
  • One error shape: status 400 and an error field
  • Examples folder and a sequence diagram
View on GitHubTalk to us about it
Isometric illustration: Terminal data contracts

On requestTerminal integration

Terminal data contracts

Language-neutral contracts for container-terminal data, with fixtures and a conformance runner.

For
Engineers who connect a terminal operating system (TOS) to anything else
Stack
JSON Schema 2020-12 · OpenAPI 3.1 · Python · DCSA Track & Trace
Licence
To be decided (Apache-2.0 proposed)
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • Schemas: container tracking answer, structured not-found, one error shape, booking lookup, bill of lading
  • Six reference fixtures (fictitious containers, valid ISO 6346 check digits)
  • OpenAPI 3.1 of the tracking facade: GET /v0/tracking/{container_number} and by booking
  • A conformance runner (exit 0 / 1 / 2) and a mapping to DCSA Track & Trace 2.2.0

Next

  • OpenAPI 3.1 of the read-only terminal data API

What it will never do

  • Invent data: no data means the field is absent, never « unknown », never a default
Get the package and talk to us
Isometric illustration: Terminal integration kit

On requestTerminal integration

Terminal integration kit

A small core and plugins to connect a TOS, a gate, a booking system or your back office.

For
Integration engineers of terminals, ports and logistics platforms
Stack
Python 3.10+ · Standard library only · plugin.json · Standard Webhooks
Licence
To be decided (Apache-2.0 proposed)
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • The core and two reference plugins, tested
  • A mock terminal shaped like Navis N4
  • A read-only N4 connector
  • Health is green, red or undetermined: « could not check » is never « all good »

Next

  • The other connectors are specified, not written yet
Get the package and talk to us
Isometric illustration: TOS Groovy recipes

On requestTerminal integration

TOS Groovy recipes

Read-only recipes for terminal operating systems: answer tracking questions, push gate events anywhere.

For
Terminal IT teams running Navis N4 with the extension option
Stack
Groovy · Navis N4 extensions · PHP relay
Licence
MIT
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • n4-gate-event-push: every N4 gate passage pushed to an HTTPS receiver, PHP relay with queue and retries (relay tested, Groovy to run on a real N4)

Next

  • Container status, customs holds, charges, booking lookup, free time and demurrage
  • A read-only guard (a write attempt is refused, tested), rate limit and cache
  • Tideworks after N4, same facade

What it will never do

  • Write into a TOS, ever
  • Ship a recipe that never ran on a real TOS
Get the package and talk to us
Isometric illustration: Terminal devtools

On requestTerminal integration

Terminal devtools

Small tools every terminal developer rewrites: ISO 6346 check digit and a fake TOS for tests.

For
Developers who write terminal software or test against a TOS
Stack
Python · PHP · ISO 6346 · UN/EDIFACT · UN/LOCODE
Licence
To be decided (Apache-2.0 proposed)
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • ISO 6346 check digit in Python and PHP, tested against one shared set of test vectors
  • tos-mock: a fake TOS that serves the tracking facade on six fictitious containers

Next

  • ISO 6346 in TypeScript
  • An EDIFACT pretty-printer (COPARN, CODECO, BAPLIE, COARRI)
  • Offline UN/LOCODE
Get the package and talk to us
Isometric illustration: Container tracking core

On requestTerminal integration

Container tracking core

Where a container is and whether a truck can pick it up, the same answer whatever TOS is behind.

For
Terminals and port communities that publish container status
Stack
Python 3.11+ · PHP 8.1+ · HTTP facade
Licence
To be decided (Apache-2.0 proposed)
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • One library, two bindings (Python and PHP) that give identical answers
  • An HTTP facade that passes the conformance runner
  • Works before any API, on six fictitious demonstration containers

What it will never do

  • Serve an answer it cannot vouch for
Get the package and talk to us
Isometric illustration: Container tracking and history for WordPress

On requestTerminal integration

Container tracking and history for WordPress

Two plugins for a terminal's website: find a container, or a bill of lading and all its containers.

For
Terminals whose public website runs on WordPress
Stack
PHP 8.1+ · WordPress 6.4+ · Shortcodes and block
Licence
GPL-2.0-or-later
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • Container search: where it is, whether a truck can pick it up, and each hold with its reason
  • Bill of lading search: every container of a B/L; a container alone is refused, so nobody sees another customer's cycle
  • ISO 6346 check digit on every container number
  • Works at activation on demonstration data

Next

  • Drupal and Joomla versions
Get the package and talk to us
Isometric illustration: Terminal integration map

ComingTerminal integration

Terminal integration map

Where to plug what at a container terminal, and what costs three weeks when you ignore it.

For
Integrators starting a project at a container terminal
Stack
Markdown · Sequence diagrams · ISO 6346 · UN/LOCODE · UN/EDIFACT · SMDG MIGs
Licence
To be decided
State
Specified, being built. Ask us to be told first.

What it will contain

  • Layers: operations, customs holds, billing, gate and booking, EDI
  • « Am I allowed? » in 30 seconds, per TOS licence
  • Paths that work without the TOS extension licence

What it will never do

  • Republish vendor manuals
  • Quote licence prices
  • Advise bypassing a licence
Get the package and talk to us
Questions

Trucking companies: questions

Click a question to read the answer.

Yes. Any organization in the port chain can join: terminals, port authorities, marinas, oil and gas ports, shipping lines, hauliers, freight forwarders and the industrial shippers that depend on them. Start with the launch offer.

Annex I of NIS2 lists, under road transport, road authorities responsible for traffic management and operators of intelligent transport systems, not hauliers as such. The terminals and ports you work with may be in scope, and Article 21 asks them to secure their supply chain, so they may ask you about your security.

Yes. The VBS API package connects a transport management system to a terminal's truck appointment system. It is public; see the open-source packages.

No. They are benevolent checklists of twelve questions each, about two minutes, and the answers stay in your browser. Use them inside your team, then talk to us if something worries you.

Launch offer

Talk to engineers who work inside ports

Two free self-tests, about two minutes each, then advice from engineers who work inside terminals.

Want to know where you stand?

Take the 2-minute test

Send this page to a colleague

Someone in your team should read this? Add their e-mail, we send them the page from you.

Your colleagues' addresses are used for this mail only and are not kept.

Contact the alliance

Use our contact form: every message is read by the team.

Contact form
Report an incident

Port operators can report a cyber incident to the alliance at any time.

Incident reporting